1 /* Copyright 2008 IBM Corporation 2 * 2008 Red Hat, Inc. 3 * Copyright 2011 Intel Corporation 4 * Copyright 2016 Veertu, Inc. 5 * Copyright 2017 The Android Open Source Project 6 * 7 * QEMU Hypervisor.framework support 8 * 9 * This program is free software; you can redistribute it and/or 10 * modify it under the terms of version 2 of the GNU General Public 11 * License as published by the Free Software Foundation. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 16 * General Public License for more details. 17 * 18 * You should have received a copy of the GNU General Public License 19 * along with this program; if not, see <http://www.gnu.org/licenses/>. 20 * 21 * This file contain code under public domain from the hvdos project: 22 * https://github.com/mist64/hvdos 23 * 24 * Parts Copyright (c) 2011 NetApp, Inc. 25 * All rights reserved. 26 * 27 * Redistribution and use in source and binary forms, with or without 28 * modification, are permitted provided that the following conditions 29 * are met: 30 * 1. Redistributions of source code must retain the above copyright 31 * notice, this list of conditions and the following disclaimer. 32 * 2. Redistributions in binary form must reproduce the above copyright 33 * notice, this list of conditions and the following disclaimer in the 34 * documentation and/or other materials provided with the distribution. 35 * 36 * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND 37 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 38 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 39 * ARE DISCLAIMED. IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE 40 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 41 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 42 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 43 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 44 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 45 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 46 * SUCH DAMAGE. 47 */ 48 49 #include "qemu/osdep.h" 50 #include "qemu-common.h" 51 #include "qemu/error-report.h" 52 #include "qemu/memalign.h" 53 54 #include "sysemu/hvf.h" 55 #include "sysemu/hvf_int.h" 56 #include "sysemu/runstate.h" 57 #include "sysemu/cpus.h" 58 #include "hvf-i386.h" 59 #include "vmcs.h" 60 #include "vmx.h" 61 #include "x86.h" 62 #include "x86_descr.h" 63 #include "x86_mmu.h" 64 #include "x86_decode.h" 65 #include "x86_emu.h" 66 #include "x86_task.h" 67 #include "x86hvf.h" 68 69 #include <Hypervisor/hv.h> 70 #include <Hypervisor/hv_vmx.h> 71 #include <sys/sysctl.h> 72 73 #include "hw/i386/apic_internal.h" 74 #include "qemu/main-loop.h" 75 #include "qemu/accel.h" 76 #include "target/i386/cpu.h" 77 78 void vmx_update_tpr(CPUState *cpu) 79 { 80 /* TODO: need integrate APIC handling */ 81 X86CPU *x86_cpu = X86_CPU(cpu); 82 int tpr = cpu_get_apic_tpr(x86_cpu->apic_state) << 4; 83 int irr = apic_get_highest_priority_irr(x86_cpu->apic_state); 84 85 wreg(cpu->hvf->fd, HV_X86_TPR, tpr); 86 if (irr == -1) { 87 wvmcs(cpu->hvf->fd, VMCS_TPR_THRESHOLD, 0); 88 } else { 89 wvmcs(cpu->hvf->fd, VMCS_TPR_THRESHOLD, (irr > tpr) ? tpr >> 4 : 90 irr >> 4); 91 } 92 } 93 94 static void update_apic_tpr(CPUState *cpu) 95 { 96 X86CPU *x86_cpu = X86_CPU(cpu); 97 int tpr = rreg(cpu->hvf->fd, HV_X86_TPR) >> 4; 98 cpu_set_apic_tpr(x86_cpu->apic_state, tpr); 99 } 100 101 #define VECTORING_INFO_VECTOR_MASK 0xff 102 103 void hvf_handle_io(CPUArchState *env, uint16_t port, void *buffer, 104 int direction, int size, int count) 105 { 106 int i; 107 uint8_t *ptr = buffer; 108 109 for (i = 0; i < count; i++) { 110 address_space_rw(&address_space_io, port, MEMTXATTRS_UNSPECIFIED, 111 ptr, size, 112 direction); 113 ptr += size; 114 } 115 } 116 117 static bool ept_emulation_fault(hvf_slot *slot, uint64_t gpa, uint64_t ept_qual) 118 { 119 int read, write; 120 121 /* EPT fault on an instruction fetch doesn't make sense here */ 122 if (ept_qual & EPT_VIOLATION_INST_FETCH) { 123 return false; 124 } 125 126 /* EPT fault must be a read fault or a write fault */ 127 read = ept_qual & EPT_VIOLATION_DATA_READ ? 1 : 0; 128 write = ept_qual & EPT_VIOLATION_DATA_WRITE ? 1 : 0; 129 if ((read | write) == 0) { 130 return false; 131 } 132 133 if (write && slot) { 134 if (slot->flags & HVF_SLOT_LOG) { 135 memory_region_set_dirty(slot->region, gpa - slot->start, 1); 136 hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size, 137 HV_MEMORY_READ | HV_MEMORY_WRITE); 138 } 139 } 140 141 /* 142 * The EPT violation must have been caused by accessing a 143 * guest-physical address that is a translation of a guest-linear 144 * address. 145 */ 146 if ((ept_qual & EPT_VIOLATION_GLA_VALID) == 0 || 147 (ept_qual & EPT_VIOLATION_XLAT_VALID) == 0) { 148 return false; 149 } 150 151 if (!slot) { 152 return true; 153 } 154 if (!memory_region_is_ram(slot->region) && 155 !(read && memory_region_is_romd(slot->region))) { 156 return true; 157 } 158 return false; 159 } 160 161 void hvf_arch_vcpu_destroy(CPUState *cpu) 162 { 163 X86CPU *x86_cpu = X86_CPU(cpu); 164 CPUX86State *env = &x86_cpu->env; 165 166 g_free(env->hvf_mmio_buf); 167 } 168 169 static void init_tsc_freq(CPUX86State *env) 170 { 171 size_t length; 172 uint64_t tsc_freq; 173 174 if (env->tsc_khz != 0) { 175 return; 176 } 177 178 length = sizeof(uint64_t); 179 if (sysctlbyname("machdep.tsc.frequency", &tsc_freq, &length, NULL, 0)) { 180 return; 181 } 182 env->tsc_khz = tsc_freq / 1000; /* Hz to KHz */ 183 } 184 185 static void init_apic_bus_freq(CPUX86State *env) 186 { 187 size_t length; 188 uint64_t bus_freq; 189 190 if (env->apic_bus_freq != 0) { 191 return; 192 } 193 194 length = sizeof(uint64_t); 195 if (sysctlbyname("hw.busfrequency", &bus_freq, &length, NULL, 0)) { 196 return; 197 } 198 env->apic_bus_freq = bus_freq; 199 } 200 201 static inline bool tsc_is_known(CPUX86State *env) 202 { 203 return env->tsc_khz != 0; 204 } 205 206 static inline bool apic_bus_freq_is_known(CPUX86State *env) 207 { 208 return env->apic_bus_freq != 0; 209 } 210 211 void hvf_kick_vcpu_thread(CPUState *cpu) 212 { 213 cpus_kick_thread(cpu); 214 } 215 216 int hvf_arch_init(void) 217 { 218 return 0; 219 } 220 221 int hvf_arch_init_vcpu(CPUState *cpu) 222 { 223 X86CPU *x86cpu = X86_CPU(cpu); 224 CPUX86State *env = &x86cpu->env; 225 226 init_emu(); 227 init_decoder(); 228 229 hvf_state->hvf_caps = g_new0(struct hvf_vcpu_caps, 1); 230 env->hvf_mmio_buf = g_new(char, 4096); 231 232 if (x86cpu->vmware_cpuid_freq) { 233 init_tsc_freq(env); 234 init_apic_bus_freq(env); 235 236 if (!tsc_is_known(env) || !apic_bus_freq_is_known(env)) { 237 error_report("vmware-cpuid-freq: feature couldn't be enabled"); 238 } 239 } 240 241 if (hv_vmx_read_capability(HV_VMX_CAP_PINBASED, 242 &hvf_state->hvf_caps->vmx_cap_pinbased)) { 243 abort(); 244 } 245 if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED, 246 &hvf_state->hvf_caps->vmx_cap_procbased)) { 247 abort(); 248 } 249 if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED2, 250 &hvf_state->hvf_caps->vmx_cap_procbased2)) { 251 abort(); 252 } 253 if (hv_vmx_read_capability(HV_VMX_CAP_ENTRY, 254 &hvf_state->hvf_caps->vmx_cap_entry)) { 255 abort(); 256 } 257 258 /* set VMCS control fields */ 259 wvmcs(cpu->hvf->fd, VMCS_PIN_BASED_CTLS, 260 cap2ctrl(hvf_state->hvf_caps->vmx_cap_pinbased, 261 VMCS_PIN_BASED_CTLS_EXTINT | 262 VMCS_PIN_BASED_CTLS_NMI | 263 VMCS_PIN_BASED_CTLS_VNMI)); 264 wvmcs(cpu->hvf->fd, VMCS_PRI_PROC_BASED_CTLS, 265 cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased, 266 VMCS_PRI_PROC_BASED_CTLS_HLT | 267 VMCS_PRI_PROC_BASED_CTLS_MWAIT | 268 VMCS_PRI_PROC_BASED_CTLS_TSC_OFFSET | 269 VMCS_PRI_PROC_BASED_CTLS_TPR_SHADOW) | 270 VMCS_PRI_PROC_BASED_CTLS_SEC_CONTROL); 271 wvmcs(cpu->hvf->fd, VMCS_SEC_PROC_BASED_CTLS, 272 cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased2, 273 VMCS_PRI_PROC_BASED2_CTLS_APIC_ACCESSES)); 274 275 wvmcs(cpu->hvf->fd, VMCS_ENTRY_CTLS, cap2ctrl(hvf_state->hvf_caps->vmx_cap_entry, 276 0)); 277 wvmcs(cpu->hvf->fd, VMCS_EXCEPTION_BITMAP, 0); /* Double fault */ 278 279 wvmcs(cpu->hvf->fd, VMCS_TPR_THRESHOLD, 0); 280 281 x86cpu = X86_CPU(cpu); 282 x86cpu->env.xsave_buf_len = 4096; 283 x86cpu->env.xsave_buf = qemu_memalign(4096, x86cpu->env.xsave_buf_len); 284 285 /* 286 * The allocated storage must be large enough for all of the 287 * possible XSAVE state components. 288 */ 289 assert(hvf_get_supported_cpuid(0xd, 0, R_ECX) <= x86cpu->env.xsave_buf_len); 290 291 hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_STAR, 1); 292 hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_LSTAR, 1); 293 hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_CSTAR, 1); 294 hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_FMASK, 1); 295 hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_FSBASE, 1); 296 hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_GSBASE, 1); 297 hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_KERNELGSBASE, 1); 298 hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_TSC_AUX, 1); 299 hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_IA32_TSC, 1); 300 hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_IA32_SYSENTER_CS, 1); 301 hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_IA32_SYSENTER_EIP, 1); 302 hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_IA32_SYSENTER_ESP, 1); 303 304 return 0; 305 } 306 307 static void hvf_store_events(CPUState *cpu, uint32_t ins_len, uint64_t idtvec_info) 308 { 309 X86CPU *x86_cpu = X86_CPU(cpu); 310 CPUX86State *env = &x86_cpu->env; 311 312 env->exception_nr = -1; 313 env->exception_pending = 0; 314 env->exception_injected = 0; 315 env->interrupt_injected = -1; 316 env->nmi_injected = false; 317 env->ins_len = 0; 318 env->has_error_code = false; 319 if (idtvec_info & VMCS_IDT_VEC_VALID) { 320 switch (idtvec_info & VMCS_IDT_VEC_TYPE) { 321 case VMCS_IDT_VEC_HWINTR: 322 case VMCS_IDT_VEC_SWINTR: 323 env->interrupt_injected = idtvec_info & VMCS_IDT_VEC_VECNUM; 324 break; 325 case VMCS_IDT_VEC_NMI: 326 env->nmi_injected = true; 327 break; 328 case VMCS_IDT_VEC_HWEXCEPTION: 329 case VMCS_IDT_VEC_SWEXCEPTION: 330 env->exception_nr = idtvec_info & VMCS_IDT_VEC_VECNUM; 331 env->exception_injected = 1; 332 break; 333 case VMCS_IDT_VEC_PRIV_SWEXCEPTION: 334 default: 335 abort(); 336 } 337 if ((idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWEXCEPTION || 338 (idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWINTR) { 339 env->ins_len = ins_len; 340 } 341 if (idtvec_info & VMCS_IDT_VEC_ERRCODE_VALID) { 342 env->has_error_code = true; 343 env->error_code = rvmcs(cpu->hvf->fd, VMCS_IDT_VECTORING_ERROR); 344 } 345 } 346 if ((rvmcs(cpu->hvf->fd, VMCS_GUEST_INTERRUPTIBILITY) & 347 VMCS_INTERRUPTIBILITY_NMI_BLOCKING)) { 348 env->hflags2 |= HF2_NMI_MASK; 349 } else { 350 env->hflags2 &= ~HF2_NMI_MASK; 351 } 352 if (rvmcs(cpu->hvf->fd, VMCS_GUEST_INTERRUPTIBILITY) & 353 (VMCS_INTERRUPTIBILITY_STI_BLOCKING | 354 VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING)) { 355 env->hflags |= HF_INHIBIT_IRQ_MASK; 356 } else { 357 env->hflags &= ~HF_INHIBIT_IRQ_MASK; 358 } 359 } 360 361 static void hvf_cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count, 362 uint32_t *eax, uint32_t *ebx, 363 uint32_t *ecx, uint32_t *edx) 364 { 365 /* 366 * A wrapper extends cpu_x86_cpuid with 0x40000000 and 0x40000010 leafs, 367 * leafs 0x40000001-0x4000000F are filled with zeros 368 * Provides vmware-cpuid-freq support to hvf 369 * 370 * Note: leaf 0x40000000 not exposes HVF, 371 * leaving hypervisor signature empty 372 */ 373 374 if (index < 0x40000000 || index > 0x40000010 || 375 !tsc_is_known(env) || !apic_bus_freq_is_known(env)) { 376 377 cpu_x86_cpuid(env, index, count, eax, ebx, ecx, edx); 378 return; 379 } 380 381 switch (index) { 382 case 0x40000000: 383 *eax = 0x40000010; /* Max available cpuid leaf */ 384 *ebx = 0; /* Leave signature empty */ 385 *ecx = 0; 386 *edx = 0; 387 break; 388 case 0x40000010: 389 *eax = env->tsc_khz; 390 *ebx = env->apic_bus_freq / 1000; /* Hz to KHz */ 391 *ecx = 0; 392 *edx = 0; 393 break; 394 default: 395 *eax = 0; 396 *ebx = 0; 397 *ecx = 0; 398 *edx = 0; 399 break; 400 } 401 } 402 403 int hvf_vcpu_exec(CPUState *cpu) 404 { 405 X86CPU *x86_cpu = X86_CPU(cpu); 406 CPUX86State *env = &x86_cpu->env; 407 int ret = 0; 408 uint64_t rip = 0; 409 410 if (hvf_process_events(cpu)) { 411 return EXCP_HLT; 412 } 413 414 do { 415 if (cpu->vcpu_dirty) { 416 hvf_put_registers(cpu); 417 cpu->vcpu_dirty = false; 418 } 419 420 if (hvf_inject_interrupts(cpu)) { 421 return EXCP_INTERRUPT; 422 } 423 vmx_update_tpr(cpu); 424 425 qemu_mutex_unlock_iothread(); 426 if (!cpu_is_bsp(X86_CPU(cpu)) && cpu->halted) { 427 qemu_mutex_lock_iothread(); 428 return EXCP_HLT; 429 } 430 431 hv_return_t r = hv_vcpu_run(cpu->hvf->fd); 432 assert_hvf_ok(r); 433 434 /* handle VMEXIT */ 435 uint64_t exit_reason = rvmcs(cpu->hvf->fd, VMCS_EXIT_REASON); 436 uint64_t exit_qual = rvmcs(cpu->hvf->fd, VMCS_EXIT_QUALIFICATION); 437 uint32_t ins_len = (uint32_t)rvmcs(cpu->hvf->fd, 438 VMCS_EXIT_INSTRUCTION_LENGTH); 439 440 uint64_t idtvec_info = rvmcs(cpu->hvf->fd, VMCS_IDT_VECTORING_INFO); 441 442 hvf_store_events(cpu, ins_len, idtvec_info); 443 rip = rreg(cpu->hvf->fd, HV_X86_RIP); 444 env->eflags = rreg(cpu->hvf->fd, HV_X86_RFLAGS); 445 446 qemu_mutex_lock_iothread(); 447 448 update_apic_tpr(cpu); 449 current_cpu = cpu; 450 451 ret = 0; 452 switch (exit_reason) { 453 case EXIT_REASON_HLT: { 454 macvm_set_rip(cpu, rip + ins_len); 455 if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) && 456 (env->eflags & IF_MASK)) 457 && !(cpu->interrupt_request & CPU_INTERRUPT_NMI) && 458 !(idtvec_info & VMCS_IDT_VEC_VALID)) { 459 cpu->halted = 1; 460 ret = EXCP_HLT; 461 break; 462 } 463 ret = EXCP_INTERRUPT; 464 break; 465 } 466 case EXIT_REASON_MWAIT: { 467 ret = EXCP_INTERRUPT; 468 break; 469 } 470 /* Need to check if MMIO or unmapped fault */ 471 case EXIT_REASON_EPT_FAULT: 472 { 473 hvf_slot *slot; 474 uint64_t gpa = rvmcs(cpu->hvf->fd, VMCS_GUEST_PHYSICAL_ADDRESS); 475 476 if (((idtvec_info & VMCS_IDT_VEC_VALID) == 0) && 477 ((exit_qual & EXIT_QUAL_NMIUDTI) != 0)) { 478 vmx_set_nmi_blocking(cpu); 479 } 480 481 slot = hvf_find_overlap_slot(gpa, 1); 482 /* mmio */ 483 if (ept_emulation_fault(slot, gpa, exit_qual)) { 484 struct x86_decode decode; 485 486 load_regs(cpu); 487 decode_instruction(env, &decode); 488 exec_instruction(env, &decode); 489 store_regs(cpu); 490 break; 491 } 492 break; 493 } 494 case EXIT_REASON_INOUT: 495 { 496 uint32_t in = (exit_qual & 8) != 0; 497 uint32_t size = (exit_qual & 7) + 1; 498 uint32_t string = (exit_qual & 16) != 0; 499 uint32_t port = exit_qual >> 16; 500 /*uint32_t rep = (exit_qual & 0x20) != 0;*/ 501 502 if (!string && in) { 503 uint64_t val = 0; 504 load_regs(cpu); 505 hvf_handle_io(env, port, &val, 0, size, 1); 506 if (size == 1) { 507 AL(env) = val; 508 } else if (size == 2) { 509 AX(env) = val; 510 } else if (size == 4) { 511 RAX(env) = (uint32_t)val; 512 } else { 513 RAX(env) = (uint64_t)val; 514 } 515 env->eip += ins_len; 516 store_regs(cpu); 517 break; 518 } else if (!string && !in) { 519 RAX(env) = rreg(cpu->hvf->fd, HV_X86_RAX); 520 hvf_handle_io(env, port, &RAX(env), 1, size, 1); 521 macvm_set_rip(cpu, rip + ins_len); 522 break; 523 } 524 struct x86_decode decode; 525 526 load_regs(cpu); 527 decode_instruction(env, &decode); 528 assert(ins_len == decode.len); 529 exec_instruction(env, &decode); 530 store_regs(cpu); 531 532 break; 533 } 534 case EXIT_REASON_CPUID: { 535 uint32_t rax = (uint32_t)rreg(cpu->hvf->fd, HV_X86_RAX); 536 uint32_t rbx = (uint32_t)rreg(cpu->hvf->fd, HV_X86_RBX); 537 uint32_t rcx = (uint32_t)rreg(cpu->hvf->fd, HV_X86_RCX); 538 uint32_t rdx = (uint32_t)rreg(cpu->hvf->fd, HV_X86_RDX); 539 540 if (rax == 1) { 541 /* CPUID1.ecx.OSXSAVE needs to know CR4 */ 542 env->cr[4] = rvmcs(cpu->hvf->fd, VMCS_GUEST_CR4); 543 } 544 hvf_cpu_x86_cpuid(env, rax, rcx, &rax, &rbx, &rcx, &rdx); 545 546 wreg(cpu->hvf->fd, HV_X86_RAX, rax); 547 wreg(cpu->hvf->fd, HV_X86_RBX, rbx); 548 wreg(cpu->hvf->fd, HV_X86_RCX, rcx); 549 wreg(cpu->hvf->fd, HV_X86_RDX, rdx); 550 551 macvm_set_rip(cpu, rip + ins_len); 552 break; 553 } 554 case EXIT_REASON_XSETBV: { 555 X86CPU *x86_cpu = X86_CPU(cpu); 556 CPUX86State *env = &x86_cpu->env; 557 uint32_t eax = (uint32_t)rreg(cpu->hvf->fd, HV_X86_RAX); 558 uint32_t ecx = (uint32_t)rreg(cpu->hvf->fd, HV_X86_RCX); 559 uint32_t edx = (uint32_t)rreg(cpu->hvf->fd, HV_X86_RDX); 560 561 if (ecx) { 562 macvm_set_rip(cpu, rip + ins_len); 563 break; 564 } 565 env->xcr0 = ((uint64_t)edx << 32) | eax; 566 wreg(cpu->hvf->fd, HV_X86_XCR0, env->xcr0 | 1); 567 macvm_set_rip(cpu, rip + ins_len); 568 break; 569 } 570 case EXIT_REASON_INTR_WINDOW: 571 vmx_clear_int_window_exiting(cpu); 572 ret = EXCP_INTERRUPT; 573 break; 574 case EXIT_REASON_NMI_WINDOW: 575 vmx_clear_nmi_window_exiting(cpu); 576 ret = EXCP_INTERRUPT; 577 break; 578 case EXIT_REASON_EXT_INTR: 579 /* force exit and allow io handling */ 580 ret = EXCP_INTERRUPT; 581 break; 582 case EXIT_REASON_RDMSR: 583 case EXIT_REASON_WRMSR: 584 { 585 load_regs(cpu); 586 if (exit_reason == EXIT_REASON_RDMSR) { 587 simulate_rdmsr(cpu); 588 } else { 589 simulate_wrmsr(cpu); 590 } 591 env->eip += ins_len; 592 store_regs(cpu); 593 break; 594 } 595 case EXIT_REASON_CR_ACCESS: { 596 int cr; 597 int reg; 598 599 load_regs(cpu); 600 cr = exit_qual & 15; 601 reg = (exit_qual >> 8) & 15; 602 603 switch (cr) { 604 case 0x0: { 605 macvm_set_cr0(cpu->hvf->fd, RRX(env, reg)); 606 break; 607 } 608 case 4: { 609 macvm_set_cr4(cpu->hvf->fd, RRX(env, reg)); 610 break; 611 } 612 case 8: { 613 X86CPU *x86_cpu = X86_CPU(cpu); 614 if (exit_qual & 0x10) { 615 RRX(env, reg) = cpu_get_apic_tpr(x86_cpu->apic_state); 616 } else { 617 int tpr = RRX(env, reg); 618 cpu_set_apic_tpr(x86_cpu->apic_state, tpr); 619 ret = EXCP_INTERRUPT; 620 } 621 break; 622 } 623 default: 624 error_report("Unrecognized CR %d", cr); 625 abort(); 626 } 627 env->eip += ins_len; 628 store_regs(cpu); 629 break; 630 } 631 case EXIT_REASON_APIC_ACCESS: { /* TODO */ 632 struct x86_decode decode; 633 634 load_regs(cpu); 635 decode_instruction(env, &decode); 636 exec_instruction(env, &decode); 637 store_regs(cpu); 638 break; 639 } 640 case EXIT_REASON_TPR: { 641 ret = 1; 642 break; 643 } 644 case EXIT_REASON_TASK_SWITCH: { 645 uint64_t vinfo = rvmcs(cpu->hvf->fd, VMCS_IDT_VECTORING_INFO); 646 x68_segment_selector sel = {.sel = exit_qual & 0xffff}; 647 vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3, 648 vinfo & VMCS_INTR_VALID, vinfo & VECTORING_INFO_VECTOR_MASK, vinfo 649 & VMCS_INTR_T_MASK); 650 break; 651 } 652 case EXIT_REASON_TRIPLE_FAULT: { 653 qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET); 654 ret = EXCP_INTERRUPT; 655 break; 656 } 657 case EXIT_REASON_RDPMC: 658 wreg(cpu->hvf->fd, HV_X86_RAX, 0); 659 wreg(cpu->hvf->fd, HV_X86_RDX, 0); 660 macvm_set_rip(cpu, rip + ins_len); 661 break; 662 case VMX_REASON_VMCALL: 663 env->exception_nr = EXCP0D_GPF; 664 env->exception_injected = 1; 665 env->has_error_code = true; 666 env->error_code = 0; 667 break; 668 default: 669 error_report("%llx: unhandled exit %llx", rip, exit_reason); 670 } 671 } while (ret == 0); 672 673 return ret; 674 } 675