1 /* Copyright 2008 IBM Corporation 2 * 2008 Red Hat, Inc. 3 * Copyright 2011 Intel Corporation 4 * Copyright 2016 Veertu, Inc. 5 * Copyright 2017 The Android Open Source Project 6 * 7 * QEMU Hypervisor.framework support 8 * 9 * This program is free software; you can redistribute it and/or 10 * modify it under the terms of version 2 of the GNU General Public 11 * License as published by the Free Software Foundation. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 16 * General Public License for more details. 17 * 18 * You should have received a copy of the GNU General Public License 19 * along with this program; if not, see <http://www.gnu.org/licenses/>. 20 * 21 * This file contain code under public domain from the hvdos project: 22 * https://github.com/mist64/hvdos 23 * 24 * Parts Copyright (c) 2011 NetApp, Inc. 25 * All rights reserved. 26 * 27 * Redistribution and use in source and binary forms, with or without 28 * modification, are permitted provided that the following conditions 29 * are met: 30 * 1. Redistributions of source code must retain the above copyright 31 * notice, this list of conditions and the following disclaimer. 32 * 2. Redistributions in binary form must reproduce the above copyright 33 * notice, this list of conditions and the following disclaimer in the 34 * documentation and/or other materials provided with the distribution. 35 * 36 * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND 37 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 38 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 39 * ARE DISCLAIMED. IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE 40 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 41 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 42 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 43 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 44 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 45 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 46 * SUCH DAMAGE. 47 */ 48 49 #include "qemu/osdep.h" 50 #include "qemu/error-report.h" 51 #include "qemu/memalign.h" 52 #include "qapi/error.h" 53 #include "migration/blocker.h" 54 55 #include "sysemu/hvf.h" 56 #include "sysemu/hvf_int.h" 57 #include "sysemu/runstate.h" 58 #include "sysemu/cpus.h" 59 #include "hvf-i386.h" 60 #include "vmcs.h" 61 #include "vmx.h" 62 #include "x86.h" 63 #include "x86_descr.h" 64 #include "x86_mmu.h" 65 #include "x86_decode.h" 66 #include "x86_emu.h" 67 #include "x86_task.h" 68 #include "x86hvf.h" 69 70 #include <Hypervisor/hv.h> 71 #include <Hypervisor/hv_vmx.h> 72 #include <sys/sysctl.h> 73 74 #include "hw/i386/apic_internal.h" 75 #include "qemu/main-loop.h" 76 #include "qemu/accel.h" 77 #include "target/i386/cpu.h" 78 79 static Error *invtsc_mig_blocker; 80 81 void vmx_update_tpr(CPUState *cpu) 82 { 83 /* TODO: need integrate APIC handling */ 84 X86CPU *x86_cpu = X86_CPU(cpu); 85 int tpr = cpu_get_apic_tpr(x86_cpu->apic_state) << 4; 86 int irr = apic_get_highest_priority_irr(x86_cpu->apic_state); 87 88 wreg(cpu->accel->fd, HV_X86_TPR, tpr); 89 if (irr == -1) { 90 wvmcs(cpu->accel->fd, VMCS_TPR_THRESHOLD, 0); 91 } else { 92 wvmcs(cpu->accel->fd, VMCS_TPR_THRESHOLD, (irr > tpr) ? tpr >> 4 : 93 irr >> 4); 94 } 95 } 96 97 static void update_apic_tpr(CPUState *cpu) 98 { 99 X86CPU *x86_cpu = X86_CPU(cpu); 100 int tpr = rreg(cpu->accel->fd, HV_X86_TPR) >> 4; 101 cpu_set_apic_tpr(x86_cpu->apic_state, tpr); 102 } 103 104 #define VECTORING_INFO_VECTOR_MASK 0xff 105 106 void hvf_handle_io(CPUArchState *env, uint16_t port, void *buffer, 107 int direction, int size, int count) 108 { 109 int i; 110 uint8_t *ptr = buffer; 111 112 for (i = 0; i < count; i++) { 113 address_space_rw(&address_space_io, port, MEMTXATTRS_UNSPECIFIED, 114 ptr, size, 115 direction); 116 ptr += size; 117 } 118 } 119 120 static bool ept_emulation_fault(hvf_slot *slot, uint64_t gpa, uint64_t ept_qual) 121 { 122 int read, write; 123 124 /* EPT fault on an instruction fetch doesn't make sense here */ 125 if (ept_qual & EPT_VIOLATION_INST_FETCH) { 126 return false; 127 } 128 129 /* EPT fault must be a read fault or a write fault */ 130 read = ept_qual & EPT_VIOLATION_DATA_READ ? 1 : 0; 131 write = ept_qual & EPT_VIOLATION_DATA_WRITE ? 1 : 0; 132 if ((read | write) == 0) { 133 return false; 134 } 135 136 if (write && slot) { 137 if (slot->flags & HVF_SLOT_LOG) { 138 uint64_t dirty_page_start = gpa & ~(TARGET_PAGE_SIZE - 1u); 139 memory_region_set_dirty(slot->region, gpa - slot->start, 1); 140 hv_vm_protect(dirty_page_start, TARGET_PAGE_SIZE, 141 HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC); 142 } 143 } 144 145 /* 146 * The EPT violation must have been caused by accessing a 147 * guest-physical address that is a translation of a guest-linear 148 * address. 149 */ 150 if ((ept_qual & EPT_VIOLATION_GLA_VALID) == 0 || 151 (ept_qual & EPT_VIOLATION_XLAT_VALID) == 0) { 152 return false; 153 } 154 155 if (!slot) { 156 return true; 157 } 158 if (!memory_region_is_ram(slot->region) && 159 !(read && memory_region_is_romd(slot->region))) { 160 return true; 161 } 162 return false; 163 } 164 165 void hvf_arch_vcpu_destroy(CPUState *cpu) 166 { 167 X86CPU *x86_cpu = X86_CPU(cpu); 168 CPUX86State *env = &x86_cpu->env; 169 170 g_free(env->hvf_mmio_buf); 171 } 172 173 static void init_tsc_freq(CPUX86State *env) 174 { 175 size_t length; 176 uint64_t tsc_freq; 177 178 if (env->tsc_khz != 0) { 179 return; 180 } 181 182 length = sizeof(uint64_t); 183 if (sysctlbyname("machdep.tsc.frequency", &tsc_freq, &length, NULL, 0)) { 184 return; 185 } 186 env->tsc_khz = tsc_freq / 1000; /* Hz to KHz */ 187 } 188 189 static void init_apic_bus_freq(CPUX86State *env) 190 { 191 size_t length; 192 uint64_t bus_freq; 193 194 if (env->apic_bus_freq != 0) { 195 return; 196 } 197 198 length = sizeof(uint64_t); 199 if (sysctlbyname("hw.busfrequency", &bus_freq, &length, NULL, 0)) { 200 return; 201 } 202 env->apic_bus_freq = bus_freq; 203 } 204 205 static inline bool tsc_is_known(CPUX86State *env) 206 { 207 return env->tsc_khz != 0; 208 } 209 210 static inline bool apic_bus_freq_is_known(CPUX86State *env) 211 { 212 return env->apic_bus_freq != 0; 213 } 214 215 void hvf_kick_vcpu_thread(CPUState *cpu) 216 { 217 cpus_kick_thread(cpu); 218 hv_vcpu_interrupt(&cpu->accel->fd, 1); 219 } 220 221 int hvf_arch_init(void) 222 { 223 return 0; 224 } 225 226 int hvf_arch_init_vcpu(CPUState *cpu) 227 { 228 X86CPU *x86cpu = X86_CPU(cpu); 229 CPUX86State *env = &x86cpu->env; 230 Error *local_err = NULL; 231 int r; 232 uint64_t reqCap; 233 234 init_emu(); 235 init_decoder(); 236 237 hvf_state->hvf_caps = g_new0(struct hvf_vcpu_caps, 1); 238 env->hvf_mmio_buf = g_new(char, 4096); 239 240 if (x86cpu->vmware_cpuid_freq) { 241 init_tsc_freq(env); 242 init_apic_bus_freq(env); 243 244 if (!tsc_is_known(env) || !apic_bus_freq_is_known(env)) { 245 error_report("vmware-cpuid-freq: feature couldn't be enabled"); 246 } 247 } 248 249 if ((env->features[FEAT_8000_0007_EDX] & CPUID_APM_INVTSC) && 250 invtsc_mig_blocker == NULL) { 251 error_setg(&invtsc_mig_blocker, 252 "State blocked by non-migratable CPU device (invtsc flag)"); 253 r = migrate_add_blocker(&invtsc_mig_blocker, &local_err); 254 if (r < 0) { 255 error_report_err(local_err); 256 return r; 257 } 258 } 259 260 261 if (hv_vmx_read_capability(HV_VMX_CAP_PINBASED, 262 &hvf_state->hvf_caps->vmx_cap_pinbased)) { 263 abort(); 264 } 265 if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED, 266 &hvf_state->hvf_caps->vmx_cap_procbased)) { 267 abort(); 268 } 269 if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED2, 270 &hvf_state->hvf_caps->vmx_cap_procbased2)) { 271 abort(); 272 } 273 if (hv_vmx_read_capability(HV_VMX_CAP_ENTRY, 274 &hvf_state->hvf_caps->vmx_cap_entry)) { 275 abort(); 276 } 277 278 /* set VMCS control fields */ 279 wvmcs(cpu->accel->fd, VMCS_PIN_BASED_CTLS, 280 cap2ctrl(hvf_state->hvf_caps->vmx_cap_pinbased, 281 VMCS_PIN_BASED_CTLS_EXTINT | 282 VMCS_PIN_BASED_CTLS_NMI | 283 VMCS_PIN_BASED_CTLS_VNMI)); 284 wvmcs(cpu->accel->fd, VMCS_PRI_PROC_BASED_CTLS, 285 cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased, 286 VMCS_PRI_PROC_BASED_CTLS_HLT | 287 VMCS_PRI_PROC_BASED_CTLS_MWAIT | 288 VMCS_PRI_PROC_BASED_CTLS_TSC_OFFSET | 289 VMCS_PRI_PROC_BASED_CTLS_TPR_SHADOW) | 290 VMCS_PRI_PROC_BASED_CTLS_SEC_CONTROL); 291 292 reqCap = VMCS_PRI_PROC_BASED2_CTLS_APIC_ACCESSES; 293 294 /* Is RDTSCP support in CPUID? If so, enable it in the VMCS. */ 295 if (hvf_get_supported_cpuid(0x80000001, 0, R_EDX) & CPUID_EXT2_RDTSCP) { 296 reqCap |= VMCS_PRI_PROC_BASED2_CTLS_RDTSCP; 297 } 298 299 wvmcs(cpu->accel->fd, VMCS_SEC_PROC_BASED_CTLS, 300 cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased2, reqCap)); 301 302 wvmcs(cpu->accel->fd, VMCS_ENTRY_CTLS, 303 cap2ctrl(hvf_state->hvf_caps->vmx_cap_entry, 0)); 304 wvmcs(cpu->accel->fd, VMCS_EXCEPTION_BITMAP, 0); /* Double fault */ 305 306 wvmcs(cpu->accel->fd, VMCS_TPR_THRESHOLD, 0); 307 308 x86cpu = X86_CPU(cpu); 309 x86cpu->env.xsave_buf_len = 4096; 310 x86cpu->env.xsave_buf = qemu_memalign(4096, x86cpu->env.xsave_buf_len); 311 312 /* 313 * The allocated storage must be large enough for all of the 314 * possible XSAVE state components. 315 */ 316 assert(hvf_get_supported_cpuid(0xd, 0, R_ECX) <= x86cpu->env.xsave_buf_len); 317 318 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_STAR, 1); 319 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_LSTAR, 1); 320 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_CSTAR, 1); 321 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_FMASK, 1); 322 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_FSBASE, 1); 323 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_GSBASE, 1); 324 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_KERNELGSBASE, 1); 325 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_TSC_AUX, 1); 326 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_TSC, 1); 327 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_SYSENTER_CS, 1); 328 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_SYSENTER_EIP, 1); 329 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_SYSENTER_ESP, 1); 330 331 return 0; 332 } 333 334 static void hvf_store_events(CPUState *cpu, uint32_t ins_len, uint64_t idtvec_info) 335 { 336 X86CPU *x86_cpu = X86_CPU(cpu); 337 CPUX86State *env = &x86_cpu->env; 338 339 env->exception_nr = -1; 340 env->exception_pending = 0; 341 env->exception_injected = 0; 342 env->interrupt_injected = -1; 343 env->nmi_injected = false; 344 env->ins_len = 0; 345 env->has_error_code = false; 346 if (idtvec_info & VMCS_IDT_VEC_VALID) { 347 switch (idtvec_info & VMCS_IDT_VEC_TYPE) { 348 case VMCS_IDT_VEC_HWINTR: 349 case VMCS_IDT_VEC_SWINTR: 350 env->interrupt_injected = idtvec_info & VMCS_IDT_VEC_VECNUM; 351 break; 352 case VMCS_IDT_VEC_NMI: 353 env->nmi_injected = true; 354 break; 355 case VMCS_IDT_VEC_HWEXCEPTION: 356 case VMCS_IDT_VEC_SWEXCEPTION: 357 env->exception_nr = idtvec_info & VMCS_IDT_VEC_VECNUM; 358 env->exception_injected = 1; 359 break; 360 case VMCS_IDT_VEC_PRIV_SWEXCEPTION: 361 default: 362 abort(); 363 } 364 if ((idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWEXCEPTION || 365 (idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWINTR) { 366 env->ins_len = ins_len; 367 } 368 if (idtvec_info & VMCS_IDT_VEC_ERRCODE_VALID) { 369 env->has_error_code = true; 370 env->error_code = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_ERROR); 371 } 372 } 373 if ((rvmcs(cpu->accel->fd, VMCS_GUEST_INTERRUPTIBILITY) & 374 VMCS_INTERRUPTIBILITY_NMI_BLOCKING)) { 375 env->hflags2 |= HF2_NMI_MASK; 376 } else { 377 env->hflags2 &= ~HF2_NMI_MASK; 378 } 379 if (rvmcs(cpu->accel->fd, VMCS_GUEST_INTERRUPTIBILITY) & 380 (VMCS_INTERRUPTIBILITY_STI_BLOCKING | 381 VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING)) { 382 env->hflags |= HF_INHIBIT_IRQ_MASK; 383 } else { 384 env->hflags &= ~HF_INHIBIT_IRQ_MASK; 385 } 386 } 387 388 static void hvf_cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count, 389 uint32_t *eax, uint32_t *ebx, 390 uint32_t *ecx, uint32_t *edx) 391 { 392 /* 393 * A wrapper extends cpu_x86_cpuid with 0x40000000 and 0x40000010 leafs, 394 * leafs 0x40000001-0x4000000F are filled with zeros 395 * Provides vmware-cpuid-freq support to hvf 396 * 397 * Note: leaf 0x40000000 not exposes HVF, 398 * leaving hypervisor signature empty 399 */ 400 401 if (index < 0x40000000 || index > 0x40000010 || 402 !tsc_is_known(env) || !apic_bus_freq_is_known(env)) { 403 404 cpu_x86_cpuid(env, index, count, eax, ebx, ecx, edx); 405 return; 406 } 407 408 switch (index) { 409 case 0x40000000: 410 *eax = 0x40000010; /* Max available cpuid leaf */ 411 *ebx = 0; /* Leave signature empty */ 412 *ecx = 0; 413 *edx = 0; 414 break; 415 case 0x40000010: 416 *eax = env->tsc_khz; 417 *ebx = env->apic_bus_freq / 1000; /* Hz to KHz */ 418 *ecx = 0; 419 *edx = 0; 420 break; 421 default: 422 *eax = 0; 423 *ebx = 0; 424 *ecx = 0; 425 *edx = 0; 426 break; 427 } 428 } 429 430 static hv_return_t hvf_vcpu_run(hv_vcpuid_t vcpu_id) 431 { 432 /* 433 * hv_vcpu_run_until is available and recommended from macOS 10.15+, 434 * HV_DEADLINE_FOREVER from 11.0. Test for availability at runtime and fall 435 * back to hv_vcpu_run() only where necessary. 436 */ 437 #ifndef MAC_OS_VERSION_11_0 438 return hv_vcpu_run(vcpu_id); 439 #elif MAC_OS_X_VERSION_MIN_REQUIRED >= MAC_OS_VERSION_11_0 440 return hv_vcpu_run_until(vcpu_id, HV_DEADLINE_FOREVER); 441 #else /* MAC_OS_X_VERSION_MIN_REQUIRED < MAC_OS_VERSION_11_0 */ 442 /* 11.0 SDK or newer, but could be < 11 at runtime */ 443 if (__builtin_available(macOS 11.0, *)) { 444 return hv_vcpu_run_until(vcpu_id, HV_DEADLINE_FOREVER); 445 } else { 446 return hv_vcpu_run(vcpu_id); 447 } 448 #endif 449 } 450 451 int hvf_vcpu_exec(CPUState *cpu) 452 { 453 X86CPU *x86_cpu = X86_CPU(cpu); 454 CPUX86State *env = &x86_cpu->env; 455 int ret = 0; 456 uint64_t rip = 0; 457 458 if (hvf_process_events(cpu)) { 459 return EXCP_HLT; 460 } 461 462 do { 463 if (cpu->accel->dirty) { 464 hvf_put_registers(cpu); 465 cpu->accel->dirty = false; 466 } 467 468 if (hvf_inject_interrupts(cpu)) { 469 return EXCP_INTERRUPT; 470 } 471 vmx_update_tpr(cpu); 472 473 bql_unlock(); 474 if (!cpu_is_bsp(X86_CPU(cpu)) && cpu->halted) { 475 bql_lock(); 476 return EXCP_HLT; 477 } 478 479 hv_return_t r = hvf_vcpu_run(cpu->accel->fd); 480 assert_hvf_ok(r); 481 482 /* handle VMEXIT */ 483 uint64_t exit_reason = rvmcs(cpu->accel->fd, VMCS_EXIT_REASON); 484 uint64_t exit_qual = rvmcs(cpu->accel->fd, VMCS_EXIT_QUALIFICATION); 485 uint32_t ins_len = (uint32_t)rvmcs(cpu->accel->fd, 486 VMCS_EXIT_INSTRUCTION_LENGTH); 487 488 uint64_t idtvec_info = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_INFO); 489 490 hvf_store_events(cpu, ins_len, idtvec_info); 491 rip = rreg(cpu->accel->fd, HV_X86_RIP); 492 env->eflags = rreg(cpu->accel->fd, HV_X86_RFLAGS); 493 494 bql_lock(); 495 496 update_apic_tpr(cpu); 497 current_cpu = cpu; 498 499 ret = 0; 500 switch (exit_reason) { 501 case EXIT_REASON_HLT: { 502 macvm_set_rip(cpu, rip + ins_len); 503 if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) && 504 (env->eflags & IF_MASK)) 505 && !(cpu->interrupt_request & CPU_INTERRUPT_NMI) && 506 !(idtvec_info & VMCS_IDT_VEC_VALID)) { 507 cpu->halted = 1; 508 ret = EXCP_HLT; 509 break; 510 } 511 ret = EXCP_INTERRUPT; 512 break; 513 } 514 case EXIT_REASON_MWAIT: { 515 ret = EXCP_INTERRUPT; 516 break; 517 } 518 /* Need to check if MMIO or unmapped fault */ 519 case EXIT_REASON_EPT_FAULT: 520 { 521 hvf_slot *slot; 522 uint64_t gpa = rvmcs(cpu->accel->fd, VMCS_GUEST_PHYSICAL_ADDRESS); 523 524 if (((idtvec_info & VMCS_IDT_VEC_VALID) == 0) && 525 ((exit_qual & EXIT_QUAL_NMIUDTI) != 0)) { 526 vmx_set_nmi_blocking(cpu); 527 } 528 529 slot = hvf_find_overlap_slot(gpa, 1); 530 /* mmio */ 531 if (ept_emulation_fault(slot, gpa, exit_qual)) { 532 struct x86_decode decode; 533 534 load_regs(cpu); 535 decode_instruction(env, &decode); 536 exec_instruction(env, &decode); 537 store_regs(cpu); 538 break; 539 } 540 break; 541 } 542 case EXIT_REASON_INOUT: 543 { 544 uint32_t in = (exit_qual & 8) != 0; 545 uint32_t size = (exit_qual & 7) + 1; 546 uint32_t string = (exit_qual & 16) != 0; 547 uint32_t port = exit_qual >> 16; 548 /*uint32_t rep = (exit_qual & 0x20) != 0;*/ 549 550 if (!string && in) { 551 uint64_t val = 0; 552 load_regs(cpu); 553 hvf_handle_io(env, port, &val, 0, size, 1); 554 if (size == 1) { 555 AL(env) = val; 556 } else if (size == 2) { 557 AX(env) = val; 558 } else if (size == 4) { 559 RAX(env) = (uint32_t)val; 560 } else { 561 RAX(env) = (uint64_t)val; 562 } 563 env->eip += ins_len; 564 store_regs(cpu); 565 break; 566 } else if (!string && !in) { 567 RAX(env) = rreg(cpu->accel->fd, HV_X86_RAX); 568 hvf_handle_io(env, port, &RAX(env), 1, size, 1); 569 macvm_set_rip(cpu, rip + ins_len); 570 break; 571 } 572 struct x86_decode decode; 573 574 load_regs(cpu); 575 decode_instruction(env, &decode); 576 assert(ins_len == decode.len); 577 exec_instruction(env, &decode); 578 store_regs(cpu); 579 580 break; 581 } 582 case EXIT_REASON_CPUID: { 583 uint32_t rax = (uint32_t)rreg(cpu->accel->fd, HV_X86_RAX); 584 uint32_t rbx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RBX); 585 uint32_t rcx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RCX); 586 uint32_t rdx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RDX); 587 588 if (rax == 1) { 589 /* CPUID1.ecx.OSXSAVE needs to know CR4 */ 590 env->cr[4] = rvmcs(cpu->accel->fd, VMCS_GUEST_CR4); 591 } 592 hvf_cpu_x86_cpuid(env, rax, rcx, &rax, &rbx, &rcx, &rdx); 593 594 wreg(cpu->accel->fd, HV_X86_RAX, rax); 595 wreg(cpu->accel->fd, HV_X86_RBX, rbx); 596 wreg(cpu->accel->fd, HV_X86_RCX, rcx); 597 wreg(cpu->accel->fd, HV_X86_RDX, rdx); 598 599 macvm_set_rip(cpu, rip + ins_len); 600 break; 601 } 602 case EXIT_REASON_XSETBV: { 603 X86CPU *x86_cpu = X86_CPU(cpu); 604 CPUX86State *env = &x86_cpu->env; 605 uint32_t eax = (uint32_t)rreg(cpu->accel->fd, HV_X86_RAX); 606 uint32_t ecx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RCX); 607 uint32_t edx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RDX); 608 609 if (ecx) { 610 macvm_set_rip(cpu, rip + ins_len); 611 break; 612 } 613 env->xcr0 = ((uint64_t)edx << 32) | eax; 614 wreg(cpu->accel->fd, HV_X86_XCR0, env->xcr0 | 1); 615 macvm_set_rip(cpu, rip + ins_len); 616 break; 617 } 618 case EXIT_REASON_INTR_WINDOW: 619 vmx_clear_int_window_exiting(cpu); 620 ret = EXCP_INTERRUPT; 621 break; 622 case EXIT_REASON_NMI_WINDOW: 623 vmx_clear_nmi_window_exiting(cpu); 624 ret = EXCP_INTERRUPT; 625 break; 626 case EXIT_REASON_EXT_INTR: 627 /* force exit and allow io handling */ 628 ret = EXCP_INTERRUPT; 629 break; 630 case EXIT_REASON_RDMSR: 631 case EXIT_REASON_WRMSR: 632 { 633 load_regs(cpu); 634 if (exit_reason == EXIT_REASON_RDMSR) { 635 simulate_rdmsr(env); 636 } else { 637 simulate_wrmsr(env); 638 } 639 env->eip += ins_len; 640 store_regs(cpu); 641 break; 642 } 643 case EXIT_REASON_CR_ACCESS: { 644 int cr; 645 int reg; 646 647 load_regs(cpu); 648 cr = exit_qual & 15; 649 reg = (exit_qual >> 8) & 15; 650 651 switch (cr) { 652 case 0x0: { 653 macvm_set_cr0(cpu->accel->fd, RRX(env, reg)); 654 break; 655 } 656 case 4: { 657 macvm_set_cr4(cpu->accel->fd, RRX(env, reg)); 658 break; 659 } 660 case 8: { 661 X86CPU *x86_cpu = X86_CPU(cpu); 662 if (exit_qual & 0x10) { 663 RRX(env, reg) = cpu_get_apic_tpr(x86_cpu->apic_state); 664 } else { 665 int tpr = RRX(env, reg); 666 cpu_set_apic_tpr(x86_cpu->apic_state, tpr); 667 ret = EXCP_INTERRUPT; 668 } 669 break; 670 } 671 default: 672 error_report("Unrecognized CR %d", cr); 673 abort(); 674 } 675 env->eip += ins_len; 676 store_regs(cpu); 677 break; 678 } 679 case EXIT_REASON_APIC_ACCESS: { /* TODO */ 680 struct x86_decode decode; 681 682 load_regs(cpu); 683 decode_instruction(env, &decode); 684 exec_instruction(env, &decode); 685 store_regs(cpu); 686 break; 687 } 688 case EXIT_REASON_TPR: { 689 ret = 1; 690 break; 691 } 692 case EXIT_REASON_TASK_SWITCH: { 693 uint64_t vinfo = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_INFO); 694 x68_segment_selector sel = {.sel = exit_qual & 0xffff}; 695 vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3, 696 vinfo & VMCS_INTR_VALID, vinfo & VECTORING_INFO_VECTOR_MASK, vinfo 697 & VMCS_INTR_T_MASK); 698 break; 699 } 700 case EXIT_REASON_TRIPLE_FAULT: { 701 qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET); 702 ret = EXCP_INTERRUPT; 703 break; 704 } 705 case EXIT_REASON_RDPMC: 706 wreg(cpu->accel->fd, HV_X86_RAX, 0); 707 wreg(cpu->accel->fd, HV_X86_RDX, 0); 708 macvm_set_rip(cpu, rip + ins_len); 709 break; 710 case VMX_REASON_VMCALL: 711 env->exception_nr = EXCP0D_GPF; 712 env->exception_injected = 1; 713 env->has_error_code = true; 714 env->error_code = 0; 715 break; 716 default: 717 error_report("%llx: unhandled exit %llx", rip, exit_reason); 718 } 719 } while (ret == 0); 720 721 return ret; 722 } 723 724 int hvf_arch_insert_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp) 725 { 726 return -ENOSYS; 727 } 728 729 int hvf_arch_remove_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp) 730 { 731 return -ENOSYS; 732 } 733 734 int hvf_arch_insert_hw_breakpoint(vaddr addr, vaddr len, int type) 735 { 736 return -ENOSYS; 737 } 738 739 int hvf_arch_remove_hw_breakpoint(vaddr addr, vaddr len, int type) 740 { 741 return -ENOSYS; 742 } 743 744 void hvf_arch_remove_all_hw_breakpoints(void) 745 { 746 } 747 748 void hvf_arch_update_guest_debug(CPUState *cpu) 749 { 750 } 751 752 bool hvf_arch_supports_guest_debug(void) 753 { 754 return false; 755 } 756