1 /* Copyright 2008 IBM Corporation 2 * 2008 Red Hat, Inc. 3 * Copyright 2011 Intel Corporation 4 * Copyright 2016 Veertu, Inc. 5 * Copyright 2017 The Android Open Source Project 6 * 7 * QEMU Hypervisor.framework support 8 * 9 * This program is free software; you can redistribute it and/or 10 * modify it under the terms of version 2 of the GNU General Public 11 * License as published by the Free Software Foundation. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 16 * General Public License for more details. 17 * 18 * You should have received a copy of the GNU General Public License 19 * along with this program; if not, see <http://www.gnu.org/licenses/>. 20 * 21 * This file contain code under public domain from the hvdos project: 22 * https://github.com/mist64/hvdos 23 * 24 * Parts Copyright (c) 2011 NetApp, Inc. 25 * All rights reserved. 26 * 27 * Redistribution and use in source and binary forms, with or without 28 * modification, are permitted provided that the following conditions 29 * are met: 30 * 1. Redistributions of source code must retain the above copyright 31 * notice, this list of conditions and the following disclaimer. 32 * 2. Redistributions in binary form must reproduce the above copyright 33 * notice, this list of conditions and the following disclaimer in the 34 * documentation and/or other materials provided with the distribution. 35 * 36 * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND 37 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 38 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 39 * ARE DISCLAIMED. IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE 40 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 41 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 42 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 43 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 44 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 45 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 46 * SUCH DAMAGE. 47 */ 48 #include "qemu/osdep.h" 49 #include "qemu-common.h" 50 #include "qemu/error-report.h" 51 52 #include "sysemu/hvf.h" 53 #include "hvf-i386.h" 54 #include "vmcs.h" 55 #include "vmx.h" 56 #include "x86.h" 57 #include "x86_descr.h" 58 #include "x86_mmu.h" 59 #include "x86_decode.h" 60 #include "x86_emu.h" 61 #include "x86_task.h" 62 #include "x86hvf.h" 63 64 #include <Hypervisor/hv.h> 65 #include <Hypervisor/hv_vmx.h> 66 67 #include "exec/address-spaces.h" 68 #include "hw/i386/apic_internal.h" 69 #include "qemu/main-loop.h" 70 #include "sysemu/accel.h" 71 #include "sysemu/sysemu.h" 72 #include "target/i386/cpu.h" 73 74 HVFState *hvf_state; 75 76 static void assert_hvf_ok(hv_return_t ret) 77 { 78 if (ret == HV_SUCCESS) { 79 return; 80 } 81 82 switch (ret) { 83 case HV_ERROR: 84 error_report("Error: HV_ERROR"); 85 break; 86 case HV_BUSY: 87 error_report("Error: HV_BUSY"); 88 break; 89 case HV_BAD_ARGUMENT: 90 error_report("Error: HV_BAD_ARGUMENT"); 91 break; 92 case HV_NO_RESOURCES: 93 error_report("Error: HV_NO_RESOURCES"); 94 break; 95 case HV_NO_DEVICE: 96 error_report("Error: HV_NO_DEVICE"); 97 break; 98 case HV_UNSUPPORTED: 99 error_report("Error: HV_UNSUPPORTED"); 100 break; 101 default: 102 error_report("Unknown Error"); 103 } 104 105 abort(); 106 } 107 108 /* Memory slots */ 109 hvf_slot *hvf_find_overlap_slot(uint64_t start, uint64_t end) 110 { 111 hvf_slot *slot; 112 int x; 113 for (x = 0; x < hvf_state->num_slots; ++x) { 114 slot = &hvf_state->slots[x]; 115 if (slot->size && start < (slot->start + slot->size) && 116 end > slot->start) { 117 return slot; 118 } 119 } 120 return NULL; 121 } 122 123 struct mac_slot { 124 int present; 125 uint64_t size; 126 uint64_t gpa_start; 127 uint64_t gva; 128 }; 129 130 struct mac_slot mac_slots[32]; 131 #define ALIGN(x, y) (((x) + (y) - 1) & ~((y) - 1)) 132 133 static int do_hvf_set_memory(hvf_slot *slot) 134 { 135 struct mac_slot *macslot; 136 hv_memory_flags_t flags; 137 hv_return_t ret; 138 139 macslot = &mac_slots[slot->slot_id]; 140 141 if (macslot->present) { 142 if (macslot->size != slot->size) { 143 macslot->present = 0; 144 ret = hv_vm_unmap(macslot->gpa_start, macslot->size); 145 assert_hvf_ok(ret); 146 } 147 } 148 149 if (!slot->size) { 150 return 0; 151 } 152 153 flags = HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC; 154 155 macslot->present = 1; 156 macslot->gpa_start = slot->start; 157 macslot->size = slot->size; 158 ret = hv_vm_map((hv_uvaddr_t)slot->mem, slot->start, slot->size, flags); 159 assert_hvf_ok(ret); 160 return 0; 161 } 162 163 void hvf_set_phys_mem(MemoryRegionSection *section, bool add) 164 { 165 hvf_slot *mem; 166 MemoryRegion *area = section->mr; 167 168 if (!memory_region_is_ram(area)) { 169 return; 170 } 171 172 mem = hvf_find_overlap_slot( 173 section->offset_within_address_space, 174 section->offset_within_address_space + int128_get64(section->size)); 175 176 if (mem && add) { 177 if (mem->size == int128_get64(section->size) && 178 mem->start == section->offset_within_address_space && 179 mem->mem == (memory_region_get_ram_ptr(area) + 180 section->offset_within_region)) { 181 return; /* Same region was attempted to register, go away. */ 182 } 183 } 184 185 /* Region needs to be reset. set the size to 0 and remap it. */ 186 if (mem) { 187 mem->size = 0; 188 if (do_hvf_set_memory(mem)) { 189 error_report("Failed to reset overlapping slot"); 190 abort(); 191 } 192 } 193 194 if (!add) { 195 return; 196 } 197 198 /* Now make a new slot. */ 199 int x; 200 201 for (x = 0; x < hvf_state->num_slots; ++x) { 202 mem = &hvf_state->slots[x]; 203 if (!mem->size) { 204 break; 205 } 206 } 207 208 if (x == hvf_state->num_slots) { 209 error_report("No free slots"); 210 abort(); 211 } 212 213 mem->size = int128_get64(section->size); 214 mem->mem = memory_region_get_ram_ptr(area) + section->offset_within_region; 215 mem->start = section->offset_within_address_space; 216 mem->region = area; 217 218 if (do_hvf_set_memory(mem)) { 219 error_report("Error registering new memory slot"); 220 abort(); 221 } 222 } 223 224 void vmx_update_tpr(CPUState *cpu) 225 { 226 /* TODO: need integrate APIC handling */ 227 X86CPU *x86_cpu = X86_CPU(cpu); 228 int tpr = cpu_get_apic_tpr(x86_cpu->apic_state) << 4; 229 int irr = apic_get_highest_priority_irr(x86_cpu->apic_state); 230 231 wreg(cpu->hvf_fd, HV_X86_TPR, tpr); 232 if (irr == -1) { 233 wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0); 234 } else { 235 wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, (irr > tpr) ? tpr >> 4 : 236 irr >> 4); 237 } 238 } 239 240 void update_apic_tpr(CPUState *cpu) 241 { 242 X86CPU *x86_cpu = X86_CPU(cpu); 243 int tpr = rreg(cpu->hvf_fd, HV_X86_TPR) >> 4; 244 cpu_set_apic_tpr(x86_cpu->apic_state, tpr); 245 } 246 247 #define VECTORING_INFO_VECTOR_MASK 0xff 248 249 static void hvf_handle_interrupt(CPUState * cpu, int mask) 250 { 251 cpu->interrupt_request |= mask; 252 if (!qemu_cpu_is_self(cpu)) { 253 qemu_cpu_kick(cpu); 254 } 255 } 256 257 void hvf_handle_io(CPUArchState *env, uint16_t port, void *buffer, 258 int direction, int size, int count) 259 { 260 int i; 261 uint8_t *ptr = buffer; 262 263 for (i = 0; i < count; i++) { 264 address_space_rw(&address_space_io, port, MEMTXATTRS_UNSPECIFIED, 265 ptr, size, 266 direction); 267 ptr += size; 268 } 269 } 270 271 /* TODO: synchronize vcpu state */ 272 static void do_hvf_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg) 273 { 274 CPUState *cpu_state = cpu; 275 if (cpu_state->vcpu_dirty == 0) { 276 hvf_get_registers(cpu_state); 277 } 278 279 cpu_state->vcpu_dirty = 1; 280 } 281 282 void hvf_cpu_synchronize_state(CPUState *cpu_state) 283 { 284 if (cpu_state->vcpu_dirty == 0) { 285 run_on_cpu(cpu_state, do_hvf_cpu_synchronize_state, RUN_ON_CPU_NULL); 286 } 287 } 288 289 static void do_hvf_cpu_synchronize_post_reset(CPUState *cpu, run_on_cpu_data arg) 290 { 291 CPUState *cpu_state = cpu; 292 hvf_put_registers(cpu_state); 293 cpu_state->vcpu_dirty = false; 294 } 295 296 void hvf_cpu_synchronize_post_reset(CPUState *cpu_state) 297 { 298 run_on_cpu(cpu_state, do_hvf_cpu_synchronize_post_reset, RUN_ON_CPU_NULL); 299 } 300 301 void _hvf_cpu_synchronize_post_init(CPUState *cpu, run_on_cpu_data arg) 302 { 303 CPUState *cpu_state = cpu; 304 hvf_put_registers(cpu_state); 305 cpu_state->vcpu_dirty = false; 306 } 307 308 void hvf_cpu_synchronize_post_init(CPUState *cpu_state) 309 { 310 run_on_cpu(cpu_state, _hvf_cpu_synchronize_post_init, RUN_ON_CPU_NULL); 311 } 312 313 static bool ept_emulation_fault(hvf_slot *slot, uint64_t gpa, uint64_t ept_qual) 314 { 315 int read, write; 316 317 /* EPT fault on an instruction fetch doesn't make sense here */ 318 if (ept_qual & EPT_VIOLATION_INST_FETCH) { 319 return false; 320 } 321 322 /* EPT fault must be a read fault or a write fault */ 323 read = ept_qual & EPT_VIOLATION_DATA_READ ? 1 : 0; 324 write = ept_qual & EPT_VIOLATION_DATA_WRITE ? 1 : 0; 325 if ((read | write) == 0) { 326 return false; 327 } 328 329 if (write && slot) { 330 if (slot->flags & HVF_SLOT_LOG) { 331 memory_region_set_dirty(slot->region, gpa - slot->start, 1); 332 hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size, 333 HV_MEMORY_READ | HV_MEMORY_WRITE); 334 } 335 } 336 337 /* 338 * The EPT violation must have been caused by accessing a 339 * guest-physical address that is a translation of a guest-linear 340 * address. 341 */ 342 if ((ept_qual & EPT_VIOLATION_GLA_VALID) == 0 || 343 (ept_qual & EPT_VIOLATION_XLAT_VALID) == 0) { 344 return false; 345 } 346 347 return !slot; 348 } 349 350 static void hvf_set_dirty_tracking(MemoryRegionSection *section, bool on) 351 { 352 hvf_slot *slot; 353 354 slot = hvf_find_overlap_slot( 355 section->offset_within_address_space, 356 section->offset_within_address_space + int128_get64(section->size)); 357 358 /* protect region against writes; begin tracking it */ 359 if (on) { 360 slot->flags |= HVF_SLOT_LOG; 361 hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size, 362 HV_MEMORY_READ); 363 /* stop tracking region*/ 364 } else { 365 slot->flags &= ~HVF_SLOT_LOG; 366 hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size, 367 HV_MEMORY_READ | HV_MEMORY_WRITE); 368 } 369 } 370 371 static void hvf_log_start(MemoryListener *listener, 372 MemoryRegionSection *section, int old, int new) 373 { 374 if (old != 0) { 375 return; 376 } 377 378 hvf_set_dirty_tracking(section, 1); 379 } 380 381 static void hvf_log_stop(MemoryListener *listener, 382 MemoryRegionSection *section, int old, int new) 383 { 384 if (new != 0) { 385 return; 386 } 387 388 hvf_set_dirty_tracking(section, 0); 389 } 390 391 static void hvf_log_sync(MemoryListener *listener, 392 MemoryRegionSection *section) 393 { 394 /* 395 * sync of dirty pages is handled elsewhere; just make sure we keep 396 * tracking the region. 397 */ 398 hvf_set_dirty_tracking(section, 1); 399 } 400 401 static void hvf_region_add(MemoryListener *listener, 402 MemoryRegionSection *section) 403 { 404 hvf_set_phys_mem(section, true); 405 } 406 407 static void hvf_region_del(MemoryListener *listener, 408 MemoryRegionSection *section) 409 { 410 hvf_set_phys_mem(section, false); 411 } 412 413 static MemoryListener hvf_memory_listener = { 414 .priority = 10, 415 .region_add = hvf_region_add, 416 .region_del = hvf_region_del, 417 .log_start = hvf_log_start, 418 .log_stop = hvf_log_stop, 419 .log_sync = hvf_log_sync, 420 }; 421 422 void hvf_reset_vcpu(CPUState *cpu) { 423 424 /* TODO: this shouldn't be needed; there is already a call to 425 * cpu_synchronize_all_post_reset in vl.c 426 */ 427 wvmcs(cpu->hvf_fd, VMCS_ENTRY_CTLS, 0); 428 wvmcs(cpu->hvf_fd, VMCS_GUEST_IA32_EFER, 0); 429 macvm_set_cr0(cpu->hvf_fd, 0x60000010); 430 431 wvmcs(cpu->hvf_fd, VMCS_CR4_MASK, CR4_VMXE_MASK); 432 wvmcs(cpu->hvf_fd, VMCS_CR4_SHADOW, 0x0); 433 wvmcs(cpu->hvf_fd, VMCS_GUEST_CR4, CR4_VMXE_MASK); 434 435 /* set VMCS guest state fields */ 436 wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_SELECTOR, 0xf000); 437 wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_LIMIT, 0xffff); 438 wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_ACCESS_RIGHTS, 0x9b); 439 wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_BASE, 0xffff0000); 440 441 wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_SELECTOR, 0); 442 wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_LIMIT, 0xffff); 443 wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_ACCESS_RIGHTS, 0x93); 444 wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_BASE, 0); 445 446 wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_SELECTOR, 0); 447 wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_LIMIT, 0xffff); 448 wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_ACCESS_RIGHTS, 0x93); 449 wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_BASE, 0); 450 451 wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_SELECTOR, 0); 452 wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_LIMIT, 0xffff); 453 wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_ACCESS_RIGHTS, 0x93); 454 wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_BASE, 0); 455 456 wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_SELECTOR, 0); 457 wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_LIMIT, 0xffff); 458 wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_ACCESS_RIGHTS, 0x93); 459 wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_BASE, 0); 460 461 wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_SELECTOR, 0); 462 wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_LIMIT, 0xffff); 463 wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_ACCESS_RIGHTS, 0x93); 464 wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_BASE, 0); 465 466 wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_SELECTOR, 0); 467 wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_LIMIT, 0); 468 wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_ACCESS_RIGHTS, 0x10000); 469 wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_BASE, 0); 470 471 wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_SELECTOR, 0); 472 wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_LIMIT, 0); 473 wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_ACCESS_RIGHTS, 0x83); 474 wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_BASE, 0); 475 476 wvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_LIMIT, 0); 477 wvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_BASE, 0); 478 479 wvmcs(cpu->hvf_fd, VMCS_GUEST_IDTR_LIMIT, 0); 480 wvmcs(cpu->hvf_fd, VMCS_GUEST_IDTR_BASE, 0); 481 482 /*wvmcs(cpu->hvf_fd, VMCS_GUEST_CR2, 0x0);*/ 483 wvmcs(cpu->hvf_fd, VMCS_GUEST_CR3, 0x0); 484 485 wreg(cpu->hvf_fd, HV_X86_RIP, 0xfff0); 486 wreg(cpu->hvf_fd, HV_X86_RDX, 0x623); 487 wreg(cpu->hvf_fd, HV_X86_RFLAGS, 0x2); 488 wreg(cpu->hvf_fd, HV_X86_RSP, 0x0); 489 wreg(cpu->hvf_fd, HV_X86_RAX, 0x0); 490 wreg(cpu->hvf_fd, HV_X86_RBX, 0x0); 491 wreg(cpu->hvf_fd, HV_X86_RCX, 0x0); 492 wreg(cpu->hvf_fd, HV_X86_RSI, 0x0); 493 wreg(cpu->hvf_fd, HV_X86_RDI, 0x0); 494 wreg(cpu->hvf_fd, HV_X86_RBP, 0x0); 495 496 for (int i = 0; i < 8; i++) { 497 wreg(cpu->hvf_fd, HV_X86_R8 + i, 0x0); 498 } 499 500 hv_vm_sync_tsc(0); 501 hv_vcpu_invalidate_tlb(cpu->hvf_fd); 502 hv_vcpu_flush(cpu->hvf_fd); 503 } 504 505 void hvf_vcpu_destroy(CPUState *cpu) 506 { 507 hv_return_t ret = hv_vcpu_destroy((hv_vcpuid_t)cpu->hvf_fd); 508 assert_hvf_ok(ret); 509 } 510 511 static void dummy_signal(int sig) 512 { 513 } 514 515 int hvf_init_vcpu(CPUState *cpu) 516 { 517 518 X86CPU *x86cpu = X86_CPU(cpu); 519 CPUX86State *env = &x86cpu->env; 520 int r; 521 522 /* init cpu signals */ 523 sigset_t set; 524 struct sigaction sigact; 525 526 memset(&sigact, 0, sizeof(sigact)); 527 sigact.sa_handler = dummy_signal; 528 sigaction(SIG_IPI, &sigact, NULL); 529 530 pthread_sigmask(SIG_BLOCK, NULL, &set); 531 sigdelset(&set, SIG_IPI); 532 533 init_emu(); 534 init_decoder(); 535 536 hvf_state->hvf_caps = g_new0(struct hvf_vcpu_caps, 1); 537 env->hvf_emul = g_new0(HVFX86EmulatorState, 1); 538 539 r = hv_vcpu_create((hv_vcpuid_t *)&cpu->hvf_fd, HV_VCPU_DEFAULT); 540 cpu->vcpu_dirty = 1; 541 assert_hvf_ok(r); 542 543 if (hv_vmx_read_capability(HV_VMX_CAP_PINBASED, 544 &hvf_state->hvf_caps->vmx_cap_pinbased)) { 545 abort(); 546 } 547 if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED, 548 &hvf_state->hvf_caps->vmx_cap_procbased)) { 549 abort(); 550 } 551 if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED2, 552 &hvf_state->hvf_caps->vmx_cap_procbased2)) { 553 abort(); 554 } 555 if (hv_vmx_read_capability(HV_VMX_CAP_ENTRY, 556 &hvf_state->hvf_caps->vmx_cap_entry)) { 557 abort(); 558 } 559 560 /* set VMCS control fields */ 561 wvmcs(cpu->hvf_fd, VMCS_PIN_BASED_CTLS, 562 cap2ctrl(hvf_state->hvf_caps->vmx_cap_pinbased, 563 VMCS_PIN_BASED_CTLS_EXTINT | 564 VMCS_PIN_BASED_CTLS_NMI | 565 VMCS_PIN_BASED_CTLS_VNMI)); 566 wvmcs(cpu->hvf_fd, VMCS_PRI_PROC_BASED_CTLS, 567 cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased, 568 VMCS_PRI_PROC_BASED_CTLS_HLT | 569 VMCS_PRI_PROC_BASED_CTLS_MWAIT | 570 VMCS_PRI_PROC_BASED_CTLS_TSC_OFFSET | 571 VMCS_PRI_PROC_BASED_CTLS_TPR_SHADOW) | 572 VMCS_PRI_PROC_BASED_CTLS_SEC_CONTROL); 573 wvmcs(cpu->hvf_fd, VMCS_SEC_PROC_BASED_CTLS, 574 cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased2, 575 VMCS_PRI_PROC_BASED2_CTLS_APIC_ACCESSES)); 576 577 wvmcs(cpu->hvf_fd, VMCS_ENTRY_CTLS, cap2ctrl(hvf_state->hvf_caps->vmx_cap_entry, 578 0)); 579 wvmcs(cpu->hvf_fd, VMCS_EXCEPTION_BITMAP, 0); /* Double fault */ 580 581 wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0); 582 583 x86cpu = X86_CPU(cpu); 584 x86cpu->env.xsave_buf = qemu_memalign(4096, 4096); 585 586 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_STAR, 1); 587 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_LSTAR, 1); 588 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_CSTAR, 1); 589 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FMASK, 1); 590 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FSBASE, 1); 591 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_GSBASE, 1); 592 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_KERNELGSBASE, 1); 593 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_TSC_AUX, 1); 594 /*hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_TSC, 1);*/ 595 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_CS, 1); 596 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_EIP, 1); 597 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_ESP, 1); 598 599 return 0; 600 } 601 602 static void hvf_store_events(CPUState *cpu, uint32_t ins_len, uint64_t idtvec_info) 603 { 604 X86CPU *x86_cpu = X86_CPU(cpu); 605 CPUX86State *env = &x86_cpu->env; 606 607 env->exception_nr = -1; 608 env->exception_pending = 0; 609 env->exception_injected = 0; 610 env->interrupt_injected = -1; 611 env->nmi_injected = false; 612 if (idtvec_info & VMCS_IDT_VEC_VALID) { 613 switch (idtvec_info & VMCS_IDT_VEC_TYPE) { 614 case VMCS_IDT_VEC_HWINTR: 615 case VMCS_IDT_VEC_SWINTR: 616 env->interrupt_injected = idtvec_info & VMCS_IDT_VEC_VECNUM; 617 break; 618 case VMCS_IDT_VEC_NMI: 619 env->nmi_injected = true; 620 break; 621 case VMCS_IDT_VEC_HWEXCEPTION: 622 case VMCS_IDT_VEC_SWEXCEPTION: 623 env->exception_nr = idtvec_info & VMCS_IDT_VEC_VECNUM; 624 env->exception_injected = 1; 625 break; 626 case VMCS_IDT_VEC_PRIV_SWEXCEPTION: 627 default: 628 abort(); 629 } 630 if ((idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWEXCEPTION || 631 (idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWINTR) { 632 env->ins_len = ins_len; 633 } 634 if (idtvec_info & VMCS_INTR_DEL_ERRCODE) { 635 env->has_error_code = true; 636 env->error_code = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_ERROR); 637 } 638 } 639 if ((rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) & 640 VMCS_INTERRUPTIBILITY_NMI_BLOCKING)) { 641 env->hflags2 |= HF2_NMI_MASK; 642 } else { 643 env->hflags2 &= ~HF2_NMI_MASK; 644 } 645 if (rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) & 646 (VMCS_INTERRUPTIBILITY_STI_BLOCKING | 647 VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING)) { 648 env->hflags |= HF_INHIBIT_IRQ_MASK; 649 } else { 650 env->hflags &= ~HF_INHIBIT_IRQ_MASK; 651 } 652 } 653 654 int hvf_vcpu_exec(CPUState *cpu) 655 { 656 X86CPU *x86_cpu = X86_CPU(cpu); 657 CPUX86State *env = &x86_cpu->env; 658 int ret = 0; 659 uint64_t rip = 0; 660 661 if (hvf_process_events(cpu)) { 662 return EXCP_HLT; 663 } 664 665 do { 666 if (cpu->vcpu_dirty) { 667 hvf_put_registers(cpu); 668 cpu->vcpu_dirty = false; 669 } 670 671 if (hvf_inject_interrupts(cpu)) { 672 return EXCP_INTERRUPT; 673 } 674 vmx_update_tpr(cpu); 675 676 qemu_mutex_unlock_iothread(); 677 if (!cpu_is_bsp(X86_CPU(cpu)) && cpu->halted) { 678 qemu_mutex_lock_iothread(); 679 return EXCP_HLT; 680 } 681 682 hv_return_t r = hv_vcpu_run(cpu->hvf_fd); 683 assert_hvf_ok(r); 684 685 /* handle VMEXIT */ 686 uint64_t exit_reason = rvmcs(cpu->hvf_fd, VMCS_EXIT_REASON); 687 uint64_t exit_qual = rvmcs(cpu->hvf_fd, VMCS_EXIT_QUALIFICATION); 688 uint32_t ins_len = (uint32_t)rvmcs(cpu->hvf_fd, 689 VMCS_EXIT_INSTRUCTION_LENGTH); 690 691 uint64_t idtvec_info = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO); 692 693 hvf_store_events(cpu, ins_len, idtvec_info); 694 rip = rreg(cpu->hvf_fd, HV_X86_RIP); 695 RFLAGS(env) = rreg(cpu->hvf_fd, HV_X86_RFLAGS); 696 env->eflags = RFLAGS(env); 697 698 qemu_mutex_lock_iothread(); 699 700 update_apic_tpr(cpu); 701 current_cpu = cpu; 702 703 ret = 0; 704 switch (exit_reason) { 705 case EXIT_REASON_HLT: { 706 macvm_set_rip(cpu, rip + ins_len); 707 if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) && 708 (EFLAGS(env) & IF_MASK)) 709 && !(cpu->interrupt_request & CPU_INTERRUPT_NMI) && 710 !(idtvec_info & VMCS_IDT_VEC_VALID)) { 711 cpu->halted = 1; 712 ret = EXCP_HLT; 713 break; 714 } 715 ret = EXCP_INTERRUPT; 716 break; 717 } 718 case EXIT_REASON_MWAIT: { 719 ret = EXCP_INTERRUPT; 720 break; 721 } 722 /* Need to check if MMIO or unmmaped fault */ 723 case EXIT_REASON_EPT_FAULT: 724 { 725 hvf_slot *slot; 726 uint64_t gpa = rvmcs(cpu->hvf_fd, VMCS_GUEST_PHYSICAL_ADDRESS); 727 728 if (((idtvec_info & VMCS_IDT_VEC_VALID) == 0) && 729 ((exit_qual & EXIT_QUAL_NMIUDTI) != 0)) { 730 vmx_set_nmi_blocking(cpu); 731 } 732 733 slot = hvf_find_overlap_slot(gpa, gpa); 734 /* mmio */ 735 if (ept_emulation_fault(slot, gpa, exit_qual)) { 736 struct x86_decode decode; 737 738 load_regs(cpu); 739 env->hvf_emul->fetch_rip = rip; 740 741 decode_instruction(env, &decode); 742 exec_instruction(env, &decode); 743 store_regs(cpu); 744 break; 745 } 746 break; 747 } 748 case EXIT_REASON_INOUT: 749 { 750 uint32_t in = (exit_qual & 8) != 0; 751 uint32_t size = (exit_qual & 7) + 1; 752 uint32_t string = (exit_qual & 16) != 0; 753 uint32_t port = exit_qual >> 16; 754 /*uint32_t rep = (exit_qual & 0x20) != 0;*/ 755 756 if (!string && in) { 757 uint64_t val = 0; 758 load_regs(cpu); 759 hvf_handle_io(env, port, &val, 0, size, 1); 760 if (size == 1) { 761 AL(env) = val; 762 } else if (size == 2) { 763 AX(env) = val; 764 } else if (size == 4) { 765 RAX(env) = (uint32_t)val; 766 } else { 767 RAX(env) = (uint64_t)val; 768 } 769 RIP(env) += ins_len; 770 store_regs(cpu); 771 break; 772 } else if (!string && !in) { 773 RAX(env) = rreg(cpu->hvf_fd, HV_X86_RAX); 774 hvf_handle_io(env, port, &RAX(env), 1, size, 1); 775 macvm_set_rip(cpu, rip + ins_len); 776 break; 777 } 778 struct x86_decode decode; 779 780 load_regs(cpu); 781 env->hvf_emul->fetch_rip = rip; 782 783 decode_instruction(env, &decode); 784 assert(ins_len == decode.len); 785 exec_instruction(env, &decode); 786 store_regs(cpu); 787 788 break; 789 } 790 case EXIT_REASON_CPUID: { 791 uint32_t rax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX); 792 uint32_t rbx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RBX); 793 uint32_t rcx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX); 794 uint32_t rdx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX); 795 796 cpu_x86_cpuid(env, rax, rcx, &rax, &rbx, &rcx, &rdx); 797 798 wreg(cpu->hvf_fd, HV_X86_RAX, rax); 799 wreg(cpu->hvf_fd, HV_X86_RBX, rbx); 800 wreg(cpu->hvf_fd, HV_X86_RCX, rcx); 801 wreg(cpu->hvf_fd, HV_X86_RDX, rdx); 802 803 macvm_set_rip(cpu, rip + ins_len); 804 break; 805 } 806 case EXIT_REASON_XSETBV: { 807 X86CPU *x86_cpu = X86_CPU(cpu); 808 CPUX86State *env = &x86_cpu->env; 809 uint32_t eax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX); 810 uint32_t ecx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX); 811 uint32_t edx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX); 812 813 if (ecx) { 814 macvm_set_rip(cpu, rip + ins_len); 815 break; 816 } 817 env->xcr0 = ((uint64_t)edx << 32) | eax; 818 wreg(cpu->hvf_fd, HV_X86_XCR0, env->xcr0 | 1); 819 macvm_set_rip(cpu, rip + ins_len); 820 break; 821 } 822 case EXIT_REASON_INTR_WINDOW: 823 vmx_clear_int_window_exiting(cpu); 824 ret = EXCP_INTERRUPT; 825 break; 826 case EXIT_REASON_NMI_WINDOW: 827 vmx_clear_nmi_window_exiting(cpu); 828 ret = EXCP_INTERRUPT; 829 break; 830 case EXIT_REASON_EXT_INTR: 831 /* force exit and allow io handling */ 832 ret = EXCP_INTERRUPT; 833 break; 834 case EXIT_REASON_RDMSR: 835 case EXIT_REASON_WRMSR: 836 { 837 load_regs(cpu); 838 if (exit_reason == EXIT_REASON_RDMSR) { 839 simulate_rdmsr(cpu); 840 } else { 841 simulate_wrmsr(cpu); 842 } 843 RIP(env) += rvmcs(cpu->hvf_fd, VMCS_EXIT_INSTRUCTION_LENGTH); 844 store_regs(cpu); 845 break; 846 } 847 case EXIT_REASON_CR_ACCESS: { 848 int cr; 849 int reg; 850 851 load_regs(cpu); 852 cr = exit_qual & 15; 853 reg = (exit_qual >> 8) & 15; 854 855 switch (cr) { 856 case 0x0: { 857 macvm_set_cr0(cpu->hvf_fd, RRX(env, reg)); 858 break; 859 } 860 case 4: { 861 macvm_set_cr4(cpu->hvf_fd, RRX(env, reg)); 862 break; 863 } 864 case 8: { 865 X86CPU *x86_cpu = X86_CPU(cpu); 866 if (exit_qual & 0x10) { 867 RRX(env, reg) = cpu_get_apic_tpr(x86_cpu->apic_state); 868 } else { 869 int tpr = RRX(env, reg); 870 cpu_set_apic_tpr(x86_cpu->apic_state, tpr); 871 ret = EXCP_INTERRUPT; 872 } 873 break; 874 } 875 default: 876 error_report("Unrecognized CR %d", cr); 877 abort(); 878 } 879 RIP(env) += ins_len; 880 store_regs(cpu); 881 break; 882 } 883 case EXIT_REASON_APIC_ACCESS: { /* TODO */ 884 struct x86_decode decode; 885 886 load_regs(cpu); 887 env->hvf_emul->fetch_rip = rip; 888 889 decode_instruction(env, &decode); 890 exec_instruction(env, &decode); 891 store_regs(cpu); 892 break; 893 } 894 case EXIT_REASON_TPR: { 895 ret = 1; 896 break; 897 } 898 case EXIT_REASON_TASK_SWITCH: { 899 uint64_t vinfo = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO); 900 x68_segment_selector sel = {.sel = exit_qual & 0xffff}; 901 vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3, 902 vinfo & VMCS_INTR_VALID, vinfo & VECTORING_INFO_VECTOR_MASK, vinfo 903 & VMCS_INTR_T_MASK); 904 break; 905 } 906 case EXIT_REASON_TRIPLE_FAULT: { 907 qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET); 908 ret = EXCP_INTERRUPT; 909 break; 910 } 911 case EXIT_REASON_RDPMC: 912 wreg(cpu->hvf_fd, HV_X86_RAX, 0); 913 wreg(cpu->hvf_fd, HV_X86_RDX, 0); 914 macvm_set_rip(cpu, rip + ins_len); 915 break; 916 case VMX_REASON_VMCALL: 917 env->exception_nr = EXCP0D_GPF; 918 env->exception_injected = 1; 919 env->has_error_code = true; 920 env->error_code = 0; 921 break; 922 default: 923 error_report("%llx: unhandled exit %llx", rip, exit_reason); 924 } 925 } while (ret == 0); 926 927 return ret; 928 } 929 930 bool hvf_allowed; 931 932 static int hvf_accel_init(MachineState *ms) 933 { 934 int x; 935 hv_return_t ret; 936 HVFState *s; 937 938 ret = hv_vm_create(HV_VM_DEFAULT); 939 assert_hvf_ok(ret); 940 941 s = g_new0(HVFState, 1); 942 943 s->num_slots = 32; 944 for (x = 0; x < s->num_slots; ++x) { 945 s->slots[x].size = 0; 946 s->slots[x].slot_id = x; 947 } 948 949 hvf_state = s; 950 cpu_interrupt_handler = hvf_handle_interrupt; 951 memory_listener_register(&hvf_memory_listener, &address_space_memory); 952 return 0; 953 } 954 955 static void hvf_accel_class_init(ObjectClass *oc, void *data) 956 { 957 AccelClass *ac = ACCEL_CLASS(oc); 958 ac->name = "HVF"; 959 ac->init_machine = hvf_accel_init; 960 ac->allowed = &hvf_allowed; 961 } 962 963 static const TypeInfo hvf_accel_type = { 964 .name = TYPE_HVF_ACCEL, 965 .parent = TYPE_ACCEL, 966 .class_init = hvf_accel_class_init, 967 }; 968 969 static void hvf_type_init(void) 970 { 971 type_register_static(&hvf_accel_type); 972 } 973 974 type_init(hvf_type_init); 975