1 /* Copyright 2008 IBM Corporation
2 * 2008 Red Hat, Inc.
3 * Copyright 2011 Intel Corporation
4 * Copyright 2016 Veertu, Inc.
5 * Copyright 2017 The Android Open Source Project
6 *
7 * QEMU Hypervisor.framework support
8 *
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of version 2 of the GNU General Public
11 * License as published by the Free Software Foundation.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, see <http://www.gnu.org/licenses/>.
20 *
21 * This file contain code under public domain from the hvdos project:
22 * https://github.com/mist64/hvdos
23 *
24 * Parts Copyright (c) 2011 NetApp, Inc.
25 * All rights reserved.
26 *
27 * Redistribution and use in source and binary forms, with or without
28 * modification, are permitted provided that the following conditions
29 * are met:
30 * 1. Redistributions of source code must retain the above copyright
31 * notice, this list of conditions and the following disclaimer.
32 * 2. Redistributions in binary form must reproduce the above copyright
33 * notice, this list of conditions and the following disclaimer in the
34 * documentation and/or other materials provided with the distribution.
35 *
36 * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
37 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
38 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
39 * ARE DISCLAIMED. IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
40 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
41 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
42 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
43 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
44 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
45 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
46 * SUCH DAMAGE.
47 */
48
49 #include "qemu/osdep.h"
50 #include "qemu/error-report.h"
51 #include "qemu/memalign.h"
52 #include "qapi/error.h"
53 #include "migration/blocker.h"
54
55 #include "sysemu/hvf.h"
56 #include "sysemu/hvf_int.h"
57 #include "sysemu/runstate.h"
58 #include "sysemu/cpus.h"
59 #include "hvf-i386.h"
60 #include "vmcs.h"
61 #include "vmx.h"
62 #include "x86.h"
63 #include "x86_descr.h"
64 #include "x86_mmu.h"
65 #include "x86_decode.h"
66 #include "x86_emu.h"
67 #include "x86_task.h"
68 #include "x86hvf.h"
69
70 #include <Hypervisor/hv.h>
71 #include <Hypervisor/hv_vmx.h>
72 #include <sys/sysctl.h>
73
74 #include "hw/i386/apic_internal.h"
75 #include "qemu/main-loop.h"
76 #include "qemu/accel.h"
77 #include "target/i386/cpu.h"
78
79 static Error *invtsc_mig_blocker;
80
vmx_update_tpr(CPUState * cpu)81 void vmx_update_tpr(CPUState *cpu)
82 {
83 /* TODO: need integrate APIC handling */
84 X86CPU *x86_cpu = X86_CPU(cpu);
85 int tpr = cpu_get_apic_tpr(x86_cpu->apic_state) << 4;
86 int irr = apic_get_highest_priority_irr(x86_cpu->apic_state);
87
88 wreg(cpu->accel->fd, HV_X86_TPR, tpr);
89 if (irr == -1) {
90 wvmcs(cpu->accel->fd, VMCS_TPR_THRESHOLD, 0);
91 } else {
92 wvmcs(cpu->accel->fd, VMCS_TPR_THRESHOLD, (irr > tpr) ? tpr >> 4 :
93 irr >> 4);
94 }
95 }
96
update_apic_tpr(CPUState * cpu)97 static void update_apic_tpr(CPUState *cpu)
98 {
99 X86CPU *x86_cpu = X86_CPU(cpu);
100 int tpr = rreg(cpu->accel->fd, HV_X86_TPR) >> 4;
101 cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
102 }
103
104 #define VECTORING_INFO_VECTOR_MASK 0xff
105
hvf_handle_io(CPUArchState * env,uint16_t port,void * buffer,int direction,int size,int count)106 void hvf_handle_io(CPUArchState *env, uint16_t port, void *buffer,
107 int direction, int size, int count)
108 {
109 int i;
110 uint8_t *ptr = buffer;
111
112 for (i = 0; i < count; i++) {
113 address_space_rw(&address_space_io, port, MEMTXATTRS_UNSPECIFIED,
114 ptr, size,
115 direction);
116 ptr += size;
117 }
118 }
119
ept_emulation_fault(hvf_slot * slot,uint64_t gpa,uint64_t ept_qual)120 static bool ept_emulation_fault(hvf_slot *slot, uint64_t gpa, uint64_t ept_qual)
121 {
122 int read, write;
123
124 /* EPT fault on an instruction fetch doesn't make sense here */
125 if (ept_qual & EPT_VIOLATION_INST_FETCH) {
126 return false;
127 }
128
129 /* EPT fault must be a read fault or a write fault */
130 read = ept_qual & EPT_VIOLATION_DATA_READ ? 1 : 0;
131 write = ept_qual & EPT_VIOLATION_DATA_WRITE ? 1 : 0;
132 if ((read | write) == 0) {
133 return false;
134 }
135
136 if (write && slot) {
137 if (slot->flags & HVF_SLOT_LOG) {
138 uint64_t dirty_page_start = gpa & ~(TARGET_PAGE_SIZE - 1u);
139 memory_region_set_dirty(slot->region, gpa - slot->start, 1);
140 hv_vm_protect(dirty_page_start, TARGET_PAGE_SIZE,
141 HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC);
142 }
143 }
144
145 /*
146 * The EPT violation must have been caused by accessing a
147 * guest-physical address that is a translation of a guest-linear
148 * address.
149 */
150 if ((ept_qual & EPT_VIOLATION_GLA_VALID) == 0 ||
151 (ept_qual & EPT_VIOLATION_XLAT_VALID) == 0) {
152 return false;
153 }
154
155 if (!slot) {
156 return true;
157 }
158 if (!memory_region_is_ram(slot->region) &&
159 !(read && memory_region_is_romd(slot->region))) {
160 return true;
161 }
162 return false;
163 }
164
hvf_arch_vcpu_destroy(CPUState * cpu)165 void hvf_arch_vcpu_destroy(CPUState *cpu)
166 {
167 X86CPU *x86_cpu = X86_CPU(cpu);
168 CPUX86State *env = &x86_cpu->env;
169
170 g_free(env->hvf_mmio_buf);
171 }
172
init_tsc_freq(CPUX86State * env)173 static void init_tsc_freq(CPUX86State *env)
174 {
175 size_t length;
176 uint64_t tsc_freq;
177
178 if (env->tsc_khz != 0) {
179 return;
180 }
181
182 length = sizeof(uint64_t);
183 if (sysctlbyname("machdep.tsc.frequency", &tsc_freq, &length, NULL, 0)) {
184 return;
185 }
186 env->tsc_khz = tsc_freq / 1000; /* Hz to KHz */
187 }
188
init_apic_bus_freq(CPUX86State * env)189 static void init_apic_bus_freq(CPUX86State *env)
190 {
191 size_t length;
192 uint64_t bus_freq;
193
194 if (env->apic_bus_freq != 0) {
195 return;
196 }
197
198 length = sizeof(uint64_t);
199 if (sysctlbyname("hw.busfrequency", &bus_freq, &length, NULL, 0)) {
200 return;
201 }
202 env->apic_bus_freq = bus_freq;
203 }
204
tsc_is_known(CPUX86State * env)205 static inline bool tsc_is_known(CPUX86State *env)
206 {
207 return env->tsc_khz != 0;
208 }
209
apic_bus_freq_is_known(CPUX86State * env)210 static inline bool apic_bus_freq_is_known(CPUX86State *env)
211 {
212 return env->apic_bus_freq != 0;
213 }
214
hvf_kick_vcpu_thread(CPUState * cpu)215 void hvf_kick_vcpu_thread(CPUState *cpu)
216 {
217 cpus_kick_thread(cpu);
218 hv_vcpu_interrupt(&cpu->accel->fd, 1);
219 }
220
hvf_arch_init(void)221 int hvf_arch_init(void)
222 {
223 return 0;
224 }
225
hvf_arch_init_vcpu(CPUState * cpu)226 int hvf_arch_init_vcpu(CPUState *cpu)
227 {
228 X86CPU *x86cpu = X86_CPU(cpu);
229 CPUX86State *env = &x86cpu->env;
230 Error *local_err = NULL;
231 int r;
232 uint64_t reqCap;
233
234 init_emu();
235 init_decoder();
236
237 hvf_state->hvf_caps = g_new0(struct hvf_vcpu_caps, 1);
238 env->hvf_mmio_buf = g_new(char, 4096);
239
240 if (x86cpu->vmware_cpuid_freq) {
241 init_tsc_freq(env);
242 init_apic_bus_freq(env);
243
244 if (!tsc_is_known(env) || !apic_bus_freq_is_known(env)) {
245 error_report("vmware-cpuid-freq: feature couldn't be enabled");
246 }
247 }
248
249 if ((env->features[FEAT_8000_0007_EDX] & CPUID_APM_INVTSC) &&
250 invtsc_mig_blocker == NULL) {
251 error_setg(&invtsc_mig_blocker,
252 "State blocked by non-migratable CPU device (invtsc flag)");
253 r = migrate_add_blocker(&invtsc_mig_blocker, &local_err);
254 if (r < 0) {
255 error_report_err(local_err);
256 return r;
257 }
258 }
259
260
261 if (hv_vmx_read_capability(HV_VMX_CAP_PINBASED,
262 &hvf_state->hvf_caps->vmx_cap_pinbased)) {
263 abort();
264 }
265 if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED,
266 &hvf_state->hvf_caps->vmx_cap_procbased)) {
267 abort();
268 }
269 if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED2,
270 &hvf_state->hvf_caps->vmx_cap_procbased2)) {
271 abort();
272 }
273 if (hv_vmx_read_capability(HV_VMX_CAP_ENTRY,
274 &hvf_state->hvf_caps->vmx_cap_entry)) {
275 abort();
276 }
277
278 /* set VMCS control fields */
279 wvmcs(cpu->accel->fd, VMCS_PIN_BASED_CTLS,
280 cap2ctrl(hvf_state->hvf_caps->vmx_cap_pinbased,
281 VMCS_PIN_BASED_CTLS_EXTINT |
282 VMCS_PIN_BASED_CTLS_NMI |
283 VMCS_PIN_BASED_CTLS_VNMI));
284 wvmcs(cpu->accel->fd, VMCS_PRI_PROC_BASED_CTLS,
285 cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased,
286 VMCS_PRI_PROC_BASED_CTLS_HLT |
287 VMCS_PRI_PROC_BASED_CTLS_MWAIT |
288 VMCS_PRI_PROC_BASED_CTLS_TSC_OFFSET |
289 VMCS_PRI_PROC_BASED_CTLS_TPR_SHADOW) |
290 VMCS_PRI_PROC_BASED_CTLS_SEC_CONTROL);
291
292 reqCap = VMCS_PRI_PROC_BASED2_CTLS_APIC_ACCESSES;
293
294 /* Is RDTSCP support in CPUID? If so, enable it in the VMCS. */
295 if (hvf_get_supported_cpuid(0x80000001, 0, R_EDX) & CPUID_EXT2_RDTSCP) {
296 reqCap |= VMCS_PRI_PROC_BASED2_CTLS_RDTSCP;
297 }
298
299 wvmcs(cpu->accel->fd, VMCS_SEC_PROC_BASED_CTLS,
300 cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased2, reqCap));
301
302 wvmcs(cpu->accel->fd, VMCS_ENTRY_CTLS,
303 cap2ctrl(hvf_state->hvf_caps->vmx_cap_entry, 0));
304 wvmcs(cpu->accel->fd, VMCS_EXCEPTION_BITMAP, 0); /* Double fault */
305
306 wvmcs(cpu->accel->fd, VMCS_TPR_THRESHOLD, 0);
307
308 x86cpu = X86_CPU(cpu);
309 x86cpu->env.xsave_buf_len = 4096;
310 x86cpu->env.xsave_buf = qemu_memalign(4096, x86cpu->env.xsave_buf_len);
311
312 /*
313 * The allocated storage must be large enough for all of the
314 * possible XSAVE state components.
315 */
316 assert(hvf_get_supported_cpuid(0xd, 0, R_ECX) <= x86cpu->env.xsave_buf_len);
317
318 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_STAR, 1);
319 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_LSTAR, 1);
320 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_CSTAR, 1);
321 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_FMASK, 1);
322 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_FSBASE, 1);
323 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_GSBASE, 1);
324 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_KERNELGSBASE, 1);
325 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_TSC_AUX, 1);
326 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_TSC, 1);
327 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_SYSENTER_CS, 1);
328 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_SYSENTER_EIP, 1);
329 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_SYSENTER_ESP, 1);
330
331 return 0;
332 }
333
hvf_store_events(CPUState * cpu,uint32_t ins_len,uint64_t idtvec_info)334 static void hvf_store_events(CPUState *cpu, uint32_t ins_len, uint64_t idtvec_info)
335 {
336 X86CPU *x86_cpu = X86_CPU(cpu);
337 CPUX86State *env = &x86_cpu->env;
338
339 env->exception_nr = -1;
340 env->exception_pending = 0;
341 env->exception_injected = 0;
342 env->interrupt_injected = -1;
343 env->nmi_injected = false;
344 env->ins_len = 0;
345 env->has_error_code = false;
346 if (idtvec_info & VMCS_IDT_VEC_VALID) {
347 switch (idtvec_info & VMCS_IDT_VEC_TYPE) {
348 case VMCS_IDT_VEC_HWINTR:
349 case VMCS_IDT_VEC_SWINTR:
350 env->interrupt_injected = idtvec_info & VMCS_IDT_VEC_VECNUM;
351 break;
352 case VMCS_IDT_VEC_NMI:
353 env->nmi_injected = true;
354 break;
355 case VMCS_IDT_VEC_HWEXCEPTION:
356 case VMCS_IDT_VEC_SWEXCEPTION:
357 env->exception_nr = idtvec_info & VMCS_IDT_VEC_VECNUM;
358 env->exception_injected = 1;
359 break;
360 case VMCS_IDT_VEC_PRIV_SWEXCEPTION:
361 default:
362 abort();
363 }
364 if ((idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWEXCEPTION ||
365 (idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWINTR) {
366 env->ins_len = ins_len;
367 }
368 if (idtvec_info & VMCS_IDT_VEC_ERRCODE_VALID) {
369 env->has_error_code = true;
370 env->error_code = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_ERROR);
371 }
372 }
373 if ((rvmcs(cpu->accel->fd, VMCS_GUEST_INTERRUPTIBILITY) &
374 VMCS_INTERRUPTIBILITY_NMI_BLOCKING)) {
375 env->hflags2 |= HF2_NMI_MASK;
376 } else {
377 env->hflags2 &= ~HF2_NMI_MASK;
378 }
379 if (rvmcs(cpu->accel->fd, VMCS_GUEST_INTERRUPTIBILITY) &
380 (VMCS_INTERRUPTIBILITY_STI_BLOCKING |
381 VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING)) {
382 env->hflags |= HF_INHIBIT_IRQ_MASK;
383 } else {
384 env->hflags &= ~HF_INHIBIT_IRQ_MASK;
385 }
386 }
387
hvf_cpu_x86_cpuid(CPUX86State * env,uint32_t index,uint32_t count,uint32_t * eax,uint32_t * ebx,uint32_t * ecx,uint32_t * edx)388 static void hvf_cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
389 uint32_t *eax, uint32_t *ebx,
390 uint32_t *ecx, uint32_t *edx)
391 {
392 /*
393 * A wrapper extends cpu_x86_cpuid with 0x40000000 and 0x40000010 leafs,
394 * leafs 0x40000001-0x4000000F are filled with zeros
395 * Provides vmware-cpuid-freq support to hvf
396 *
397 * Note: leaf 0x40000000 not exposes HVF,
398 * leaving hypervisor signature empty
399 */
400
401 if (index < 0x40000000 || index > 0x40000010 ||
402 !tsc_is_known(env) || !apic_bus_freq_is_known(env)) {
403
404 cpu_x86_cpuid(env, index, count, eax, ebx, ecx, edx);
405 return;
406 }
407
408 switch (index) {
409 case 0x40000000:
410 *eax = 0x40000010; /* Max available cpuid leaf */
411 *ebx = 0; /* Leave signature empty */
412 *ecx = 0;
413 *edx = 0;
414 break;
415 case 0x40000010:
416 *eax = env->tsc_khz;
417 *ebx = env->apic_bus_freq / 1000; /* Hz to KHz */
418 *ecx = 0;
419 *edx = 0;
420 break;
421 default:
422 *eax = 0;
423 *ebx = 0;
424 *ecx = 0;
425 *edx = 0;
426 break;
427 }
428 }
429
hvf_vcpu_exec(CPUState * cpu)430 int hvf_vcpu_exec(CPUState *cpu)
431 {
432 X86CPU *x86_cpu = X86_CPU(cpu);
433 CPUX86State *env = &x86_cpu->env;
434 int ret = 0;
435 uint64_t rip = 0;
436
437 if (hvf_process_events(cpu)) {
438 return EXCP_HLT;
439 }
440
441 do {
442 if (cpu->accel->dirty) {
443 hvf_put_registers(cpu);
444 cpu->accel->dirty = false;
445 }
446
447 if (hvf_inject_interrupts(cpu)) {
448 return EXCP_INTERRUPT;
449 }
450 vmx_update_tpr(cpu);
451
452 bql_unlock();
453 if (!cpu_is_bsp(X86_CPU(cpu)) && cpu->halted) {
454 bql_lock();
455 return EXCP_HLT;
456 }
457
458 hv_return_t r = hv_vcpu_run_until(cpu->accel->fd, HV_DEADLINE_FOREVER);
459 assert_hvf_ok(r);
460
461 /* handle VMEXIT */
462 uint64_t exit_reason = rvmcs(cpu->accel->fd, VMCS_EXIT_REASON);
463 uint64_t exit_qual = rvmcs(cpu->accel->fd, VMCS_EXIT_QUALIFICATION);
464 uint32_t ins_len = (uint32_t)rvmcs(cpu->accel->fd,
465 VMCS_EXIT_INSTRUCTION_LENGTH);
466
467 uint64_t idtvec_info = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_INFO);
468
469 hvf_store_events(cpu, ins_len, idtvec_info);
470 rip = rreg(cpu->accel->fd, HV_X86_RIP);
471 env->eflags = rreg(cpu->accel->fd, HV_X86_RFLAGS);
472
473 bql_lock();
474
475 update_apic_tpr(cpu);
476 current_cpu = cpu;
477
478 ret = 0;
479 switch (exit_reason) {
480 case EXIT_REASON_HLT: {
481 macvm_set_rip(cpu, rip + ins_len);
482 if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) &&
483 (env->eflags & IF_MASK))
484 && !(cpu->interrupt_request & CPU_INTERRUPT_NMI) &&
485 !(idtvec_info & VMCS_IDT_VEC_VALID)) {
486 cpu->halted = 1;
487 ret = EXCP_HLT;
488 break;
489 }
490 ret = EXCP_INTERRUPT;
491 break;
492 }
493 case EXIT_REASON_MWAIT: {
494 ret = EXCP_INTERRUPT;
495 break;
496 }
497 /* Need to check if MMIO or unmapped fault */
498 case EXIT_REASON_EPT_FAULT:
499 {
500 hvf_slot *slot;
501 uint64_t gpa = rvmcs(cpu->accel->fd, VMCS_GUEST_PHYSICAL_ADDRESS);
502
503 if (((idtvec_info & VMCS_IDT_VEC_VALID) == 0) &&
504 ((exit_qual & EXIT_QUAL_NMIUDTI) != 0)) {
505 vmx_set_nmi_blocking(cpu);
506 }
507
508 slot = hvf_find_overlap_slot(gpa, 1);
509 /* mmio */
510 if (ept_emulation_fault(slot, gpa, exit_qual)) {
511 struct x86_decode decode;
512
513 load_regs(cpu);
514 decode_instruction(env, &decode);
515 exec_instruction(env, &decode);
516 store_regs(cpu);
517 break;
518 }
519 break;
520 }
521 case EXIT_REASON_INOUT:
522 {
523 uint32_t in = (exit_qual & 8) != 0;
524 uint32_t size = (exit_qual & 7) + 1;
525 uint32_t string = (exit_qual & 16) != 0;
526 uint32_t port = exit_qual >> 16;
527 /*uint32_t rep = (exit_qual & 0x20) != 0;*/
528
529 if (!string && in) {
530 uint64_t val = 0;
531 load_regs(cpu);
532 hvf_handle_io(env, port, &val, 0, size, 1);
533 if (size == 1) {
534 AL(env) = val;
535 } else if (size == 2) {
536 AX(env) = val;
537 } else if (size == 4) {
538 RAX(env) = (uint32_t)val;
539 } else {
540 RAX(env) = (uint64_t)val;
541 }
542 env->eip += ins_len;
543 store_regs(cpu);
544 break;
545 } else if (!string && !in) {
546 RAX(env) = rreg(cpu->accel->fd, HV_X86_RAX);
547 hvf_handle_io(env, port, &RAX(env), 1, size, 1);
548 macvm_set_rip(cpu, rip + ins_len);
549 break;
550 }
551 struct x86_decode decode;
552
553 load_regs(cpu);
554 decode_instruction(env, &decode);
555 assert(ins_len == decode.len);
556 exec_instruction(env, &decode);
557 store_regs(cpu);
558
559 break;
560 }
561 case EXIT_REASON_CPUID: {
562 uint32_t rax = (uint32_t)rreg(cpu->accel->fd, HV_X86_RAX);
563 uint32_t rbx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RBX);
564 uint32_t rcx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RCX);
565 uint32_t rdx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RDX);
566
567 if (rax == 1) {
568 /* CPUID1.ecx.OSXSAVE needs to know CR4 */
569 env->cr[4] = rvmcs(cpu->accel->fd, VMCS_GUEST_CR4);
570 }
571 hvf_cpu_x86_cpuid(env, rax, rcx, &rax, &rbx, &rcx, &rdx);
572
573 wreg(cpu->accel->fd, HV_X86_RAX, rax);
574 wreg(cpu->accel->fd, HV_X86_RBX, rbx);
575 wreg(cpu->accel->fd, HV_X86_RCX, rcx);
576 wreg(cpu->accel->fd, HV_X86_RDX, rdx);
577
578 macvm_set_rip(cpu, rip + ins_len);
579 break;
580 }
581 case EXIT_REASON_XSETBV: {
582 X86CPU *x86_cpu = X86_CPU(cpu);
583 CPUX86State *env = &x86_cpu->env;
584 uint32_t eax = (uint32_t)rreg(cpu->accel->fd, HV_X86_RAX);
585 uint32_t ecx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RCX);
586 uint32_t edx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RDX);
587
588 if (ecx) {
589 macvm_set_rip(cpu, rip + ins_len);
590 break;
591 }
592 env->xcr0 = ((uint64_t)edx << 32) | eax;
593 wreg(cpu->accel->fd, HV_X86_XCR0, env->xcr0 | 1);
594 macvm_set_rip(cpu, rip + ins_len);
595 break;
596 }
597 case EXIT_REASON_INTR_WINDOW:
598 vmx_clear_int_window_exiting(cpu);
599 ret = EXCP_INTERRUPT;
600 break;
601 case EXIT_REASON_NMI_WINDOW:
602 vmx_clear_nmi_window_exiting(cpu);
603 ret = EXCP_INTERRUPT;
604 break;
605 case EXIT_REASON_EXT_INTR:
606 /* force exit and allow io handling */
607 ret = EXCP_INTERRUPT;
608 break;
609 case EXIT_REASON_RDMSR:
610 case EXIT_REASON_WRMSR:
611 {
612 load_regs(cpu);
613 if (exit_reason == EXIT_REASON_RDMSR) {
614 simulate_rdmsr(env);
615 } else {
616 simulate_wrmsr(env);
617 }
618 env->eip += ins_len;
619 store_regs(cpu);
620 break;
621 }
622 case EXIT_REASON_CR_ACCESS: {
623 int cr;
624 int reg;
625
626 load_regs(cpu);
627 cr = exit_qual & 15;
628 reg = (exit_qual >> 8) & 15;
629
630 switch (cr) {
631 case 0x0: {
632 macvm_set_cr0(cpu->accel->fd, RRX(env, reg));
633 break;
634 }
635 case 4: {
636 macvm_set_cr4(cpu->accel->fd, RRX(env, reg));
637 break;
638 }
639 case 8: {
640 X86CPU *x86_cpu = X86_CPU(cpu);
641 if (exit_qual & 0x10) {
642 RRX(env, reg) = cpu_get_apic_tpr(x86_cpu->apic_state);
643 } else {
644 int tpr = RRX(env, reg);
645 cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
646 ret = EXCP_INTERRUPT;
647 }
648 break;
649 }
650 default:
651 error_report("Unrecognized CR %d", cr);
652 abort();
653 }
654 env->eip += ins_len;
655 store_regs(cpu);
656 break;
657 }
658 case EXIT_REASON_APIC_ACCESS: { /* TODO */
659 struct x86_decode decode;
660
661 load_regs(cpu);
662 decode_instruction(env, &decode);
663 exec_instruction(env, &decode);
664 store_regs(cpu);
665 break;
666 }
667 case EXIT_REASON_TPR: {
668 ret = 1;
669 break;
670 }
671 case EXIT_REASON_TASK_SWITCH: {
672 uint64_t vinfo = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_INFO);
673 x68_segment_selector sel = {.sel = exit_qual & 0xffff};
674 vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3,
675 vinfo & VMCS_INTR_VALID, vinfo & VECTORING_INFO_VECTOR_MASK, vinfo
676 & VMCS_INTR_T_MASK);
677 break;
678 }
679 case EXIT_REASON_TRIPLE_FAULT: {
680 qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
681 ret = EXCP_INTERRUPT;
682 break;
683 }
684 case EXIT_REASON_RDPMC:
685 wreg(cpu->accel->fd, HV_X86_RAX, 0);
686 wreg(cpu->accel->fd, HV_X86_RDX, 0);
687 macvm_set_rip(cpu, rip + ins_len);
688 break;
689 case VMX_REASON_VMCALL:
690 env->exception_nr = EXCP0D_GPF;
691 env->exception_injected = 1;
692 env->has_error_code = true;
693 env->error_code = 0;
694 break;
695 default:
696 error_report("%llx: unhandled exit %llx", rip, exit_reason);
697 }
698 } while (ret == 0);
699
700 return ret;
701 }
702
hvf_arch_insert_sw_breakpoint(CPUState * cpu,struct hvf_sw_breakpoint * bp)703 int hvf_arch_insert_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp)
704 {
705 return -ENOSYS;
706 }
707
hvf_arch_remove_sw_breakpoint(CPUState * cpu,struct hvf_sw_breakpoint * bp)708 int hvf_arch_remove_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp)
709 {
710 return -ENOSYS;
711 }
712
hvf_arch_insert_hw_breakpoint(vaddr addr,vaddr len,int type)713 int hvf_arch_insert_hw_breakpoint(vaddr addr, vaddr len, int type)
714 {
715 return -ENOSYS;
716 }
717
hvf_arch_remove_hw_breakpoint(vaddr addr,vaddr len,int type)718 int hvf_arch_remove_hw_breakpoint(vaddr addr, vaddr len, int type)
719 {
720 return -ENOSYS;
721 }
722
hvf_arch_remove_all_hw_breakpoints(void)723 void hvf_arch_remove_all_hw_breakpoints(void)
724 {
725 }
726
hvf_arch_update_guest_debug(CPUState * cpu)727 void hvf_arch_update_guest_debug(CPUState *cpu)
728 {
729 }
730
hvf_arch_supports_guest_debug(void)731 bool hvf_arch_supports_guest_debug(void)
732 {
733 return false;
734 }
735