xref: /openbmc/qemu/target/i386/hvf/hvf.c (revision 7d87775f)
1 /* Copyright 2008 IBM Corporation
2  *           2008 Red Hat, Inc.
3  * Copyright 2011 Intel Corporation
4  * Copyright 2016 Veertu, Inc.
5  * Copyright 2017 The Android Open Source Project
6  *
7  * QEMU Hypervisor.framework support
8  *
9  * This program is free software; you can redistribute it and/or
10  * modify it under the terms of version 2 of the GNU General Public
11  * License as published by the Free Software Foundation.
12  *
13  * This program is distributed in the hope that it will be useful,
14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
16  * General Public License for more details.
17  *
18  * You should have received a copy of the GNU General Public License
19  * along with this program; if not, see <http://www.gnu.org/licenses/>.
20  *
21  * This file contain code under public domain from the hvdos project:
22  * https://github.com/mist64/hvdos
23  *
24  * Parts Copyright (c) 2011 NetApp, Inc.
25  * All rights reserved.
26  *
27  * Redistribution and use in source and binary forms, with or without
28  * modification, are permitted provided that the following conditions
29  * are met:
30  * 1. Redistributions of source code must retain the above copyright
31  *    notice, this list of conditions and the following disclaimer.
32  * 2. Redistributions in binary form must reproduce the above copyright
33  *    notice, this list of conditions and the following disclaimer in the
34  *    documentation and/or other materials provided with the distribution.
35  *
36  * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
37  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
38  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
39  * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
40  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
41  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
42  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
43  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
44  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
45  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
46  * SUCH DAMAGE.
47  */
48 
49 #include "qemu/osdep.h"
50 #include "qemu/error-report.h"
51 #include "qemu/memalign.h"
52 #include "qapi/error.h"
53 #include "migration/blocker.h"
54 
55 #include "sysemu/hvf.h"
56 #include "sysemu/hvf_int.h"
57 #include "sysemu/runstate.h"
58 #include "sysemu/cpus.h"
59 #include "hvf-i386.h"
60 #include "vmcs.h"
61 #include "vmx.h"
62 #include "x86.h"
63 #include "x86_descr.h"
64 #include "x86_mmu.h"
65 #include "x86_decode.h"
66 #include "x86_emu.h"
67 #include "x86_task.h"
68 #include "x86hvf.h"
69 
70 #include <Hypervisor/hv.h>
71 #include <Hypervisor/hv_vmx.h>
72 #include <sys/sysctl.h>
73 
74 #include "hw/i386/apic_internal.h"
75 #include "qemu/main-loop.h"
76 #include "qemu/accel.h"
77 #include "target/i386/cpu.h"
78 
79 static Error *invtsc_mig_blocker;
80 
81 void vmx_update_tpr(CPUState *cpu)
82 {
83     /* TODO: need integrate APIC handling */
84     X86CPU *x86_cpu = X86_CPU(cpu);
85     int tpr = cpu_get_apic_tpr(x86_cpu->apic_state) << 4;
86     int irr = apic_get_highest_priority_irr(x86_cpu->apic_state);
87 
88     wreg(cpu->accel->fd, HV_X86_TPR, tpr);
89     if (irr == -1) {
90         wvmcs(cpu->accel->fd, VMCS_TPR_THRESHOLD, 0);
91     } else {
92         wvmcs(cpu->accel->fd, VMCS_TPR_THRESHOLD, (irr > tpr) ? tpr >> 4 :
93               irr >> 4);
94     }
95 }
96 
97 static void update_apic_tpr(CPUState *cpu)
98 {
99     X86CPU *x86_cpu = X86_CPU(cpu);
100     int tpr = rreg(cpu->accel->fd, HV_X86_TPR) >> 4;
101     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
102 }
103 
104 #define VECTORING_INFO_VECTOR_MASK     0xff
105 
106 void hvf_handle_io(CPUArchState *env, uint16_t port, void *buffer,
107                   int direction, int size, int count)
108 {
109     int i;
110     uint8_t *ptr = buffer;
111 
112     for (i = 0; i < count; i++) {
113         address_space_rw(&address_space_io, port, MEMTXATTRS_UNSPECIFIED,
114                          ptr, size,
115                          direction);
116         ptr += size;
117     }
118 }
119 
120 static bool ept_emulation_fault(hvf_slot *slot, uint64_t gpa, uint64_t ept_qual)
121 {
122     int read, write;
123 
124     /* EPT fault on an instruction fetch doesn't make sense here */
125     if (ept_qual & EPT_VIOLATION_INST_FETCH) {
126         return false;
127     }
128 
129     /* EPT fault must be a read fault or a write fault */
130     read = ept_qual & EPT_VIOLATION_DATA_READ ? 1 : 0;
131     write = ept_qual & EPT_VIOLATION_DATA_WRITE ? 1 : 0;
132     if ((read | write) == 0) {
133         return false;
134     }
135 
136     if (write && slot) {
137         if (slot->flags & HVF_SLOT_LOG) {
138             uint64_t dirty_page_start = gpa & ~(TARGET_PAGE_SIZE - 1u);
139             memory_region_set_dirty(slot->region, gpa - slot->start, 1);
140             hv_vm_protect(dirty_page_start, TARGET_PAGE_SIZE,
141                           HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC);
142         }
143     }
144 
145     /*
146      * The EPT violation must have been caused by accessing a
147      * guest-physical address that is a translation of a guest-linear
148      * address.
149      */
150     if ((ept_qual & EPT_VIOLATION_GLA_VALID) == 0 ||
151         (ept_qual & EPT_VIOLATION_XLAT_VALID) == 0) {
152         return false;
153     }
154 
155     if (!slot) {
156         return true;
157     }
158     if (!memory_region_is_ram(slot->region) &&
159         !(read && memory_region_is_romd(slot->region))) {
160         return true;
161     }
162     return false;
163 }
164 
165 void hvf_arch_vcpu_destroy(CPUState *cpu)
166 {
167     X86CPU *x86_cpu = X86_CPU(cpu);
168     CPUX86State *env = &x86_cpu->env;
169 
170     g_free(env->hvf_mmio_buf);
171 }
172 
173 static void init_tsc_freq(CPUX86State *env)
174 {
175     size_t length;
176     uint64_t tsc_freq;
177 
178     if (env->tsc_khz != 0) {
179         return;
180     }
181 
182     length = sizeof(uint64_t);
183     if (sysctlbyname("machdep.tsc.frequency", &tsc_freq, &length, NULL, 0)) {
184         return;
185     }
186     env->tsc_khz = tsc_freq / 1000;  /* Hz to KHz */
187 }
188 
189 static void init_apic_bus_freq(CPUX86State *env)
190 {
191     size_t length;
192     uint64_t bus_freq;
193 
194     if (env->apic_bus_freq != 0) {
195         return;
196     }
197 
198     length = sizeof(uint64_t);
199     if (sysctlbyname("hw.busfrequency", &bus_freq, &length, NULL, 0)) {
200         return;
201     }
202     env->apic_bus_freq = bus_freq;
203 }
204 
205 static inline bool tsc_is_known(CPUX86State *env)
206 {
207     return env->tsc_khz != 0;
208 }
209 
210 static inline bool apic_bus_freq_is_known(CPUX86State *env)
211 {
212     return env->apic_bus_freq != 0;
213 }
214 
215 void hvf_kick_vcpu_thread(CPUState *cpu)
216 {
217     cpus_kick_thread(cpu);
218     hv_vcpu_interrupt(&cpu->accel->fd, 1);
219 }
220 
221 int hvf_arch_init(void)
222 {
223     return 0;
224 }
225 
226 hv_return_t hvf_arch_vm_create(MachineState *ms, uint32_t pa_range)
227 {
228     return hv_vm_create(HV_VM_DEFAULT);
229 }
230 
231 int hvf_arch_init_vcpu(CPUState *cpu)
232 {
233     X86CPU *x86cpu = X86_CPU(cpu);
234     CPUX86State *env = &x86cpu->env;
235     Error *local_err = NULL;
236     int r;
237     uint64_t reqCap;
238 
239     init_emu();
240     init_decoder();
241 
242     if (hvf_state->hvf_caps == NULL) {
243         hvf_state->hvf_caps = g_new0(struct hvf_vcpu_caps, 1);
244     }
245     env->hvf_mmio_buf = g_new(char, 4096);
246 
247     if (x86cpu->vmware_cpuid_freq) {
248         init_tsc_freq(env);
249         init_apic_bus_freq(env);
250 
251         if (!tsc_is_known(env) || !apic_bus_freq_is_known(env)) {
252             error_report("vmware-cpuid-freq: feature couldn't be enabled");
253         }
254     }
255 
256     if ((env->features[FEAT_8000_0007_EDX] & CPUID_APM_INVTSC) &&
257         invtsc_mig_blocker == NULL) {
258         error_setg(&invtsc_mig_blocker,
259                    "State blocked by non-migratable CPU device (invtsc flag)");
260         r = migrate_add_blocker(&invtsc_mig_blocker, &local_err);
261         if (r < 0) {
262             error_report_err(local_err);
263             return r;
264         }
265     }
266 
267 
268     if (hv_vmx_read_capability(HV_VMX_CAP_PINBASED,
269         &hvf_state->hvf_caps->vmx_cap_pinbased)) {
270         abort();
271     }
272     if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED,
273         &hvf_state->hvf_caps->vmx_cap_procbased)) {
274         abort();
275     }
276     if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED2,
277         &hvf_state->hvf_caps->vmx_cap_procbased2)) {
278         abort();
279     }
280     if (hv_vmx_read_capability(HV_VMX_CAP_ENTRY,
281         &hvf_state->hvf_caps->vmx_cap_entry)) {
282         abort();
283     }
284 
285     /* set VMCS control fields */
286     wvmcs(cpu->accel->fd, VMCS_PIN_BASED_CTLS,
287           cap2ctrl(hvf_state->hvf_caps->vmx_cap_pinbased,
288                    VMCS_PIN_BASED_CTLS_EXTINT |
289                    VMCS_PIN_BASED_CTLS_NMI |
290                    VMCS_PIN_BASED_CTLS_VNMI));
291     wvmcs(cpu->accel->fd, VMCS_PRI_PROC_BASED_CTLS,
292           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased,
293                    VMCS_PRI_PROC_BASED_CTLS_HLT |
294                    VMCS_PRI_PROC_BASED_CTLS_MWAIT |
295                    VMCS_PRI_PROC_BASED_CTLS_TSC_OFFSET |
296                    VMCS_PRI_PROC_BASED_CTLS_TPR_SHADOW) |
297           VMCS_PRI_PROC_BASED_CTLS_SEC_CONTROL);
298 
299     reqCap = VMCS_PRI_PROC_BASED2_CTLS_APIC_ACCESSES;
300 
301     /* Is RDTSCP support in CPUID?  If so, enable it in the VMCS. */
302     if (hvf_get_supported_cpuid(0x80000001, 0, R_EDX) & CPUID_EXT2_RDTSCP) {
303         reqCap |= VMCS_PRI_PROC_BASED2_CTLS_RDTSCP;
304     }
305 
306     wvmcs(cpu->accel->fd, VMCS_SEC_PROC_BASED_CTLS,
307           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased2, reqCap));
308 
309     wvmcs(cpu->accel->fd, VMCS_ENTRY_CTLS,
310           cap2ctrl(hvf_state->hvf_caps->vmx_cap_entry, 0));
311     wvmcs(cpu->accel->fd, VMCS_EXCEPTION_BITMAP, 0); /* Double fault */
312 
313     wvmcs(cpu->accel->fd, VMCS_TPR_THRESHOLD, 0);
314 
315     x86cpu = X86_CPU(cpu);
316     x86cpu->env.xsave_buf_len = 4096;
317     x86cpu->env.xsave_buf = qemu_memalign(4096, x86cpu->env.xsave_buf_len);
318 
319     /*
320      * The allocated storage must be large enough for all of the
321      * possible XSAVE state components.
322      */
323     assert(hvf_get_supported_cpuid(0xd, 0, R_ECX) <= x86cpu->env.xsave_buf_len);
324 
325     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_STAR, 1);
326     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_LSTAR, 1);
327     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_CSTAR, 1);
328     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_FMASK, 1);
329     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_FSBASE, 1);
330     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_GSBASE, 1);
331     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_KERNELGSBASE, 1);
332     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_TSC_AUX, 1);
333     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_TSC, 1);
334     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_SYSENTER_CS, 1);
335     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_SYSENTER_EIP, 1);
336     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_SYSENTER_ESP, 1);
337 
338     return 0;
339 }
340 
341 static void hvf_store_events(CPUState *cpu, uint32_t ins_len, uint64_t idtvec_info)
342 {
343     X86CPU *x86_cpu = X86_CPU(cpu);
344     CPUX86State *env = &x86_cpu->env;
345 
346     env->exception_nr = -1;
347     env->exception_pending = 0;
348     env->exception_injected = 0;
349     env->interrupt_injected = -1;
350     env->nmi_injected = false;
351     env->ins_len = 0;
352     env->has_error_code = false;
353     if (idtvec_info & VMCS_IDT_VEC_VALID) {
354         switch (idtvec_info & VMCS_IDT_VEC_TYPE) {
355         case VMCS_IDT_VEC_HWINTR:
356         case VMCS_IDT_VEC_SWINTR:
357             env->interrupt_injected = idtvec_info & VMCS_IDT_VEC_VECNUM;
358             break;
359         case VMCS_IDT_VEC_NMI:
360             env->nmi_injected = true;
361             break;
362         case VMCS_IDT_VEC_HWEXCEPTION:
363         case VMCS_IDT_VEC_SWEXCEPTION:
364             env->exception_nr = idtvec_info & VMCS_IDT_VEC_VECNUM;
365             env->exception_injected = 1;
366             break;
367         case VMCS_IDT_VEC_PRIV_SWEXCEPTION:
368         default:
369             abort();
370         }
371         if ((idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWEXCEPTION ||
372             (idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWINTR) {
373             env->ins_len = ins_len;
374         }
375         if (idtvec_info & VMCS_IDT_VEC_ERRCODE_VALID) {
376             env->has_error_code = true;
377             env->error_code = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_ERROR);
378         }
379     }
380     if ((rvmcs(cpu->accel->fd, VMCS_GUEST_INTERRUPTIBILITY) &
381         VMCS_INTERRUPTIBILITY_NMI_BLOCKING)) {
382         env->hflags2 |= HF2_NMI_MASK;
383     } else {
384         env->hflags2 &= ~HF2_NMI_MASK;
385     }
386     if (rvmcs(cpu->accel->fd, VMCS_GUEST_INTERRUPTIBILITY) &
387          (VMCS_INTERRUPTIBILITY_STI_BLOCKING |
388          VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING)) {
389         env->hflags |= HF_INHIBIT_IRQ_MASK;
390     } else {
391         env->hflags &= ~HF_INHIBIT_IRQ_MASK;
392     }
393 }
394 
395 static void hvf_cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
396                               uint32_t *eax, uint32_t *ebx,
397                               uint32_t *ecx, uint32_t *edx)
398 {
399     /*
400      * A wrapper extends cpu_x86_cpuid with 0x40000000 and 0x40000010 leafs,
401      * leafs 0x40000001-0x4000000F are filled with zeros
402      * Provides vmware-cpuid-freq support to hvf
403      *
404      * Note: leaf 0x40000000 not exposes HVF,
405      * leaving hypervisor signature empty
406      */
407 
408     if (index < 0x40000000 || index > 0x40000010 ||
409         !tsc_is_known(env) || !apic_bus_freq_is_known(env)) {
410 
411         cpu_x86_cpuid(env, index, count, eax, ebx, ecx, edx);
412         return;
413     }
414 
415     switch (index) {
416     case 0x40000000:
417         *eax = 0x40000010;    /* Max available cpuid leaf */
418         *ebx = 0;             /* Leave signature empty */
419         *ecx = 0;
420         *edx = 0;
421         break;
422     case 0x40000010:
423         *eax = env->tsc_khz;
424         *ebx = env->apic_bus_freq / 1000; /* Hz to KHz */
425         *ecx = 0;
426         *edx = 0;
427         break;
428     default:
429         *eax = 0;
430         *ebx = 0;
431         *ecx = 0;
432         *edx = 0;
433         break;
434     }
435 }
436 
437 int hvf_vcpu_exec(CPUState *cpu)
438 {
439     X86CPU *x86_cpu = X86_CPU(cpu);
440     CPUX86State *env = &x86_cpu->env;
441     int ret = 0;
442     uint64_t rip = 0;
443 
444     if (hvf_process_events(cpu)) {
445         return EXCP_HLT;
446     }
447 
448     do {
449         if (cpu->accel->dirty) {
450             hvf_put_registers(cpu);
451             cpu->accel->dirty = false;
452         }
453 
454         if (hvf_inject_interrupts(cpu)) {
455             return EXCP_INTERRUPT;
456         }
457         vmx_update_tpr(cpu);
458 
459         bql_unlock();
460         if (!cpu_is_bsp(X86_CPU(cpu)) && cpu->halted) {
461             bql_lock();
462             return EXCP_HLT;
463         }
464 
465         hv_return_t r = hv_vcpu_run_until(cpu->accel->fd, HV_DEADLINE_FOREVER);
466         assert_hvf_ok(r);
467 
468         /* handle VMEXIT */
469         uint64_t exit_reason = rvmcs(cpu->accel->fd, VMCS_EXIT_REASON);
470         uint64_t exit_qual = rvmcs(cpu->accel->fd, VMCS_EXIT_QUALIFICATION);
471         uint32_t ins_len = (uint32_t)rvmcs(cpu->accel->fd,
472                                            VMCS_EXIT_INSTRUCTION_LENGTH);
473 
474         uint64_t idtvec_info = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_INFO);
475 
476         hvf_store_events(cpu, ins_len, idtvec_info);
477         rip = rreg(cpu->accel->fd, HV_X86_RIP);
478         env->eflags = rreg(cpu->accel->fd, HV_X86_RFLAGS);
479 
480         bql_lock();
481 
482         update_apic_tpr(cpu);
483         current_cpu = cpu;
484 
485         ret = 0;
486         switch (exit_reason) {
487         case EXIT_REASON_HLT: {
488             macvm_set_rip(cpu, rip + ins_len);
489             if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) &&
490                 (env->eflags & IF_MASK))
491                 && !(cpu->interrupt_request & CPU_INTERRUPT_NMI) &&
492                 !(idtvec_info & VMCS_IDT_VEC_VALID)) {
493                 cpu->halted = 1;
494                 ret = EXCP_HLT;
495                 break;
496             }
497             ret = EXCP_INTERRUPT;
498             break;
499         }
500         case EXIT_REASON_MWAIT: {
501             ret = EXCP_INTERRUPT;
502             break;
503         }
504         /* Need to check if MMIO or unmapped fault */
505         case EXIT_REASON_EPT_FAULT:
506         {
507             hvf_slot *slot;
508             uint64_t gpa = rvmcs(cpu->accel->fd, VMCS_GUEST_PHYSICAL_ADDRESS);
509 
510             if (((idtvec_info & VMCS_IDT_VEC_VALID) == 0) &&
511                 ((exit_qual & EXIT_QUAL_NMIUDTI) != 0)) {
512                 vmx_set_nmi_blocking(cpu);
513             }
514 
515             slot = hvf_find_overlap_slot(gpa, 1);
516             /* mmio */
517             if (ept_emulation_fault(slot, gpa, exit_qual)) {
518                 struct x86_decode decode;
519 
520                 load_regs(cpu);
521                 decode_instruction(env, &decode);
522                 exec_instruction(env, &decode);
523                 store_regs(cpu);
524                 break;
525             }
526             break;
527         }
528         case EXIT_REASON_INOUT:
529         {
530             uint32_t in = (exit_qual & 8) != 0;
531             uint32_t size =  (exit_qual & 7) + 1;
532             uint32_t string =  (exit_qual & 16) != 0;
533             uint32_t port =  exit_qual >> 16;
534             /*uint32_t rep = (exit_qual & 0x20) != 0;*/
535 
536             if (!string && in) {
537                 uint64_t val = 0;
538                 load_regs(cpu);
539                 hvf_handle_io(env, port, &val, 0, size, 1);
540                 if (size == 1) {
541                     AL(env) = val;
542                 } else if (size == 2) {
543                     AX(env) = val;
544                 } else if (size == 4) {
545                     RAX(env) = (uint32_t)val;
546                 } else {
547                     RAX(env) = (uint64_t)val;
548                 }
549                 env->eip += ins_len;
550                 store_regs(cpu);
551                 break;
552             } else if (!string && !in) {
553                 RAX(env) = rreg(cpu->accel->fd, HV_X86_RAX);
554                 hvf_handle_io(env, port, &RAX(env), 1, size, 1);
555                 macvm_set_rip(cpu, rip + ins_len);
556                 break;
557             }
558             struct x86_decode decode;
559 
560             load_regs(cpu);
561             decode_instruction(env, &decode);
562             assert(ins_len == decode.len);
563             exec_instruction(env, &decode);
564             store_regs(cpu);
565 
566             break;
567         }
568         case EXIT_REASON_CPUID: {
569             uint32_t rax = (uint32_t)rreg(cpu->accel->fd, HV_X86_RAX);
570             uint32_t rbx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RBX);
571             uint32_t rcx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RCX);
572             uint32_t rdx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RDX);
573 
574             if (rax == 1) {
575                 /* CPUID1.ecx.OSXSAVE needs to know CR4 */
576                 env->cr[4] = rvmcs(cpu->accel->fd, VMCS_GUEST_CR4);
577             }
578             hvf_cpu_x86_cpuid(env, rax, rcx, &rax, &rbx, &rcx, &rdx);
579 
580             wreg(cpu->accel->fd, HV_X86_RAX, rax);
581             wreg(cpu->accel->fd, HV_X86_RBX, rbx);
582             wreg(cpu->accel->fd, HV_X86_RCX, rcx);
583             wreg(cpu->accel->fd, HV_X86_RDX, rdx);
584 
585             macvm_set_rip(cpu, rip + ins_len);
586             break;
587         }
588         case EXIT_REASON_XSETBV: {
589             uint32_t eax = (uint32_t)rreg(cpu->accel->fd, HV_X86_RAX);
590             uint32_t ecx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RCX);
591             uint32_t edx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RDX);
592 
593             if (ecx) {
594                 macvm_set_rip(cpu, rip + ins_len);
595                 break;
596             }
597             env->xcr0 = ((uint64_t)edx << 32) | eax;
598             wreg(cpu->accel->fd, HV_X86_XCR0, env->xcr0 | 1);
599             macvm_set_rip(cpu, rip + ins_len);
600             break;
601         }
602         case EXIT_REASON_INTR_WINDOW:
603             vmx_clear_int_window_exiting(cpu);
604             ret = EXCP_INTERRUPT;
605             break;
606         case EXIT_REASON_NMI_WINDOW:
607             vmx_clear_nmi_window_exiting(cpu);
608             ret = EXCP_INTERRUPT;
609             break;
610         case EXIT_REASON_EXT_INTR:
611             /* force exit and allow io handling */
612             ret = EXCP_INTERRUPT;
613             break;
614         case EXIT_REASON_RDMSR:
615         case EXIT_REASON_WRMSR:
616         {
617             load_regs(cpu);
618             if (exit_reason == EXIT_REASON_RDMSR) {
619                 simulate_rdmsr(env);
620             } else {
621                 simulate_wrmsr(env);
622             }
623             env->eip += ins_len;
624             store_regs(cpu);
625             break;
626         }
627         case EXIT_REASON_CR_ACCESS: {
628             int cr;
629             int reg;
630 
631             load_regs(cpu);
632             cr = exit_qual & 15;
633             reg = (exit_qual >> 8) & 15;
634 
635             switch (cr) {
636             case 0x0: {
637                 macvm_set_cr0(cpu->accel->fd, RRX(env, reg));
638                 break;
639             }
640             case 4: {
641                 macvm_set_cr4(cpu->accel->fd, RRX(env, reg));
642                 break;
643             }
644             case 8: {
645                 if (exit_qual & 0x10) {
646                     RRX(env, reg) = cpu_get_apic_tpr(x86_cpu->apic_state);
647                 } else {
648                     int tpr = RRX(env, reg);
649                     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
650                     ret = EXCP_INTERRUPT;
651                 }
652                 break;
653             }
654             default:
655                 error_report("Unrecognized CR %d", cr);
656                 abort();
657             }
658             env->eip += ins_len;
659             store_regs(cpu);
660             break;
661         }
662         case EXIT_REASON_APIC_ACCESS: { /* TODO */
663             struct x86_decode decode;
664 
665             load_regs(cpu);
666             decode_instruction(env, &decode);
667             exec_instruction(env, &decode);
668             store_regs(cpu);
669             break;
670         }
671         case EXIT_REASON_TPR: {
672             ret = 1;
673             break;
674         }
675         case EXIT_REASON_TASK_SWITCH: {
676             uint64_t vinfo = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_INFO);
677             x68_segment_selector sel = {.sel = exit_qual & 0xffff};
678             vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3,
679              vinfo & VMCS_INTR_VALID, vinfo & VECTORING_INFO_VECTOR_MASK, vinfo
680              & VMCS_INTR_T_MASK);
681             break;
682         }
683         case EXIT_REASON_TRIPLE_FAULT: {
684             qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
685             ret = EXCP_INTERRUPT;
686             break;
687         }
688         case EXIT_REASON_RDPMC:
689             wreg(cpu->accel->fd, HV_X86_RAX, 0);
690             wreg(cpu->accel->fd, HV_X86_RDX, 0);
691             macvm_set_rip(cpu, rip + ins_len);
692             break;
693         case VMX_REASON_VMCALL:
694             env->exception_nr = EXCP0D_GPF;
695             env->exception_injected = 1;
696             env->has_error_code = true;
697             env->error_code = 0;
698             break;
699         default:
700             error_report("%llx: unhandled exit %llx", rip, exit_reason);
701         }
702     } while (ret == 0);
703 
704     return ret;
705 }
706 
707 int hvf_arch_insert_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp)
708 {
709     return -ENOSYS;
710 }
711 
712 int hvf_arch_remove_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp)
713 {
714     return -ENOSYS;
715 }
716 
717 int hvf_arch_insert_hw_breakpoint(vaddr addr, vaddr len, int type)
718 {
719     return -ENOSYS;
720 }
721 
722 int hvf_arch_remove_hw_breakpoint(vaddr addr, vaddr len, int type)
723 {
724     return -ENOSYS;
725 }
726 
727 void hvf_arch_remove_all_hw_breakpoints(void)
728 {
729 }
730 
731 void hvf_arch_update_guest_debug(CPUState *cpu)
732 {
733 }
734 
735 bool hvf_arch_supports_guest_debug(void)
736 {
737     return false;
738 }
739