xref: /openbmc/qemu/target/i386/hvf/hvf.c (revision 89fc45d5)
1 /* Copyright 2008 IBM Corporation
2  *           2008 Red Hat, Inc.
3  * Copyright 2011 Intel Corporation
4  * Copyright 2016 Veertu, Inc.
5  * Copyright 2017 The Android Open Source Project
6  *
7  * QEMU Hypervisor.framework support
8  *
9  * This program is free software; you can redistribute it and/or
10  * modify it under the terms of version 2 of the GNU General Public
11  * License as published by the Free Software Foundation.
12  *
13  * This program is distributed in the hope that it will be useful,
14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
16  * General Public License for more details.
17  *
18  * You should have received a copy of the GNU General Public License
19  * along with this program; if not, see <http://www.gnu.org/licenses/>.
20  *
21  * This file contain code under public domain from the hvdos project:
22  * https://github.com/mist64/hvdos
23  *
24  * Parts Copyright (c) 2011 NetApp, Inc.
25  * All rights reserved.
26  *
27  * Redistribution and use in source and binary forms, with or without
28  * modification, are permitted provided that the following conditions
29  * are met:
30  * 1. Redistributions of source code must retain the above copyright
31  *    notice, this list of conditions and the following disclaimer.
32  * 2. Redistributions in binary form must reproduce the above copyright
33  *    notice, this list of conditions and the following disclaimer in the
34  *    documentation and/or other materials provided with the distribution.
35  *
36  * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
37  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
38  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
39  * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
40  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
41  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
42  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
43  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
44  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
45  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
46  * SUCH DAMAGE.
47  */
48 
49 #include "qemu/osdep.h"
50 #include "qemu-common.h"
51 #include "qemu/error-report.h"
52 #include "qemu/memalign.h"
53 
54 #include "sysemu/hvf.h"
55 #include "sysemu/hvf_int.h"
56 #include "sysemu/runstate.h"
57 #include "sysemu/cpus.h"
58 #include "hvf-i386.h"
59 #include "vmcs.h"
60 #include "vmx.h"
61 #include "x86.h"
62 #include "x86_descr.h"
63 #include "x86_mmu.h"
64 #include "x86_decode.h"
65 #include "x86_emu.h"
66 #include "x86_task.h"
67 #include "x86hvf.h"
68 
69 #include <Hypervisor/hv.h>
70 #include <Hypervisor/hv_vmx.h>
71 #include <sys/sysctl.h>
72 
73 #include "hw/i386/apic_internal.h"
74 #include "qemu/main-loop.h"
75 #include "qemu/accel.h"
76 #include "target/i386/cpu.h"
77 
78 void vmx_update_tpr(CPUState *cpu)
79 {
80     /* TODO: need integrate APIC handling */
81     X86CPU *x86_cpu = X86_CPU(cpu);
82     int tpr = cpu_get_apic_tpr(x86_cpu->apic_state) << 4;
83     int irr = apic_get_highest_priority_irr(x86_cpu->apic_state);
84 
85     wreg(cpu->hvf->fd, HV_X86_TPR, tpr);
86     if (irr == -1) {
87         wvmcs(cpu->hvf->fd, VMCS_TPR_THRESHOLD, 0);
88     } else {
89         wvmcs(cpu->hvf->fd, VMCS_TPR_THRESHOLD, (irr > tpr) ? tpr >> 4 :
90               irr >> 4);
91     }
92 }
93 
94 static void update_apic_tpr(CPUState *cpu)
95 {
96     X86CPU *x86_cpu = X86_CPU(cpu);
97     int tpr = rreg(cpu->hvf->fd, HV_X86_TPR) >> 4;
98     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
99 }
100 
101 #define VECTORING_INFO_VECTOR_MASK     0xff
102 
103 void hvf_handle_io(CPUArchState *env, uint16_t port, void *buffer,
104                   int direction, int size, int count)
105 {
106     int i;
107     uint8_t *ptr = buffer;
108 
109     for (i = 0; i < count; i++) {
110         address_space_rw(&address_space_io, port, MEMTXATTRS_UNSPECIFIED,
111                          ptr, size,
112                          direction);
113         ptr += size;
114     }
115 }
116 
117 static bool ept_emulation_fault(hvf_slot *slot, uint64_t gpa, uint64_t ept_qual)
118 {
119     int read, write;
120 
121     /* EPT fault on an instruction fetch doesn't make sense here */
122     if (ept_qual & EPT_VIOLATION_INST_FETCH) {
123         return false;
124     }
125 
126     /* EPT fault must be a read fault or a write fault */
127     read = ept_qual & EPT_VIOLATION_DATA_READ ? 1 : 0;
128     write = ept_qual & EPT_VIOLATION_DATA_WRITE ? 1 : 0;
129     if ((read | write) == 0) {
130         return false;
131     }
132 
133     if (write && slot) {
134         if (slot->flags & HVF_SLOT_LOG) {
135             memory_region_set_dirty(slot->region, gpa - slot->start, 1);
136             hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size,
137                           HV_MEMORY_READ | HV_MEMORY_WRITE);
138         }
139     }
140 
141     /*
142      * The EPT violation must have been caused by accessing a
143      * guest-physical address that is a translation of a guest-linear
144      * address.
145      */
146     if ((ept_qual & EPT_VIOLATION_GLA_VALID) == 0 ||
147         (ept_qual & EPT_VIOLATION_XLAT_VALID) == 0) {
148         return false;
149     }
150 
151     if (!slot) {
152         return true;
153     }
154     if (!memory_region_is_ram(slot->region) &&
155         !(read && memory_region_is_romd(slot->region))) {
156         return true;
157     }
158     return false;
159 }
160 
161 void hvf_arch_vcpu_destroy(CPUState *cpu)
162 {
163     X86CPU *x86_cpu = X86_CPU(cpu);
164     CPUX86State *env = &x86_cpu->env;
165 
166     g_free(env->hvf_mmio_buf);
167 }
168 
169 static void init_tsc_freq(CPUX86State *env)
170 {
171     size_t length;
172     uint64_t tsc_freq;
173 
174     if (env->tsc_khz != 0) {
175         return;
176     }
177 
178     length = sizeof(uint64_t);
179     if (sysctlbyname("machdep.tsc.frequency", &tsc_freq, &length, NULL, 0)) {
180         return;
181     }
182     env->tsc_khz = tsc_freq / 1000;  /* Hz to KHz */
183 }
184 
185 static void init_apic_bus_freq(CPUX86State *env)
186 {
187     size_t length;
188     uint64_t bus_freq;
189 
190     if (env->apic_bus_freq != 0) {
191         return;
192     }
193 
194     length = sizeof(uint64_t);
195     if (sysctlbyname("hw.busfrequency", &bus_freq, &length, NULL, 0)) {
196         return;
197     }
198     env->apic_bus_freq = bus_freq;
199 }
200 
201 static inline bool tsc_is_known(CPUX86State *env)
202 {
203     return env->tsc_khz != 0;
204 }
205 
206 static inline bool apic_bus_freq_is_known(CPUX86State *env)
207 {
208     return env->apic_bus_freq != 0;
209 }
210 
211 void hvf_kick_vcpu_thread(CPUState *cpu)
212 {
213     cpus_kick_thread(cpu);
214 }
215 
216 int hvf_arch_init(void)
217 {
218     return 0;
219 }
220 
221 int hvf_arch_init_vcpu(CPUState *cpu)
222 {
223     X86CPU *x86cpu = X86_CPU(cpu);
224     CPUX86State *env = &x86cpu->env;
225 
226     init_emu();
227     init_decoder();
228 
229     hvf_state->hvf_caps = g_new0(struct hvf_vcpu_caps, 1);
230     env->hvf_mmio_buf = g_new(char, 4096);
231 
232     if (x86cpu->vmware_cpuid_freq) {
233         init_tsc_freq(env);
234         init_apic_bus_freq(env);
235 
236         if (!tsc_is_known(env) || !apic_bus_freq_is_known(env)) {
237             error_report("vmware-cpuid-freq: feature couldn't be enabled");
238         }
239     }
240 
241     if (hv_vmx_read_capability(HV_VMX_CAP_PINBASED,
242         &hvf_state->hvf_caps->vmx_cap_pinbased)) {
243         abort();
244     }
245     if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED,
246         &hvf_state->hvf_caps->vmx_cap_procbased)) {
247         abort();
248     }
249     if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED2,
250         &hvf_state->hvf_caps->vmx_cap_procbased2)) {
251         abort();
252     }
253     if (hv_vmx_read_capability(HV_VMX_CAP_ENTRY,
254         &hvf_state->hvf_caps->vmx_cap_entry)) {
255         abort();
256     }
257 
258     /* set VMCS control fields */
259     wvmcs(cpu->hvf->fd, VMCS_PIN_BASED_CTLS,
260           cap2ctrl(hvf_state->hvf_caps->vmx_cap_pinbased,
261           VMCS_PIN_BASED_CTLS_EXTINT |
262           VMCS_PIN_BASED_CTLS_NMI |
263           VMCS_PIN_BASED_CTLS_VNMI));
264     wvmcs(cpu->hvf->fd, VMCS_PRI_PROC_BASED_CTLS,
265           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased,
266           VMCS_PRI_PROC_BASED_CTLS_HLT |
267           VMCS_PRI_PROC_BASED_CTLS_MWAIT |
268           VMCS_PRI_PROC_BASED_CTLS_TSC_OFFSET |
269           VMCS_PRI_PROC_BASED_CTLS_TPR_SHADOW) |
270           VMCS_PRI_PROC_BASED_CTLS_SEC_CONTROL);
271     wvmcs(cpu->hvf->fd, VMCS_SEC_PROC_BASED_CTLS,
272           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased2,
273                    VMCS_PRI_PROC_BASED2_CTLS_APIC_ACCESSES));
274 
275     wvmcs(cpu->hvf->fd, VMCS_ENTRY_CTLS, cap2ctrl(hvf_state->hvf_caps->vmx_cap_entry,
276           0));
277     wvmcs(cpu->hvf->fd, VMCS_EXCEPTION_BITMAP, 0); /* Double fault */
278 
279     wvmcs(cpu->hvf->fd, VMCS_TPR_THRESHOLD, 0);
280 
281     x86cpu = X86_CPU(cpu);
282     x86cpu->env.xsave_buf_len = 4096;
283     x86cpu->env.xsave_buf = qemu_memalign(4096, x86cpu->env.xsave_buf_len);
284 
285     /*
286      * The allocated storage must be large enough for all of the
287      * possible XSAVE state components.
288      */
289     assert(hvf_get_supported_cpuid(0xd, 0, R_ECX) <= x86cpu->env.xsave_buf_len);
290 
291     hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_STAR, 1);
292     hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_LSTAR, 1);
293     hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_CSTAR, 1);
294     hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_FMASK, 1);
295     hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_FSBASE, 1);
296     hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_GSBASE, 1);
297     hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_KERNELGSBASE, 1);
298     hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_TSC_AUX, 1);
299     hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_IA32_TSC, 1);
300     hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_IA32_SYSENTER_CS, 1);
301     hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_IA32_SYSENTER_EIP, 1);
302     hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_IA32_SYSENTER_ESP, 1);
303 
304     return 0;
305 }
306 
307 static void hvf_store_events(CPUState *cpu, uint32_t ins_len, uint64_t idtvec_info)
308 {
309     X86CPU *x86_cpu = X86_CPU(cpu);
310     CPUX86State *env = &x86_cpu->env;
311 
312     env->exception_nr = -1;
313     env->exception_pending = 0;
314     env->exception_injected = 0;
315     env->interrupt_injected = -1;
316     env->nmi_injected = false;
317     env->ins_len = 0;
318     env->has_error_code = false;
319     if (idtvec_info & VMCS_IDT_VEC_VALID) {
320         switch (idtvec_info & VMCS_IDT_VEC_TYPE) {
321         case VMCS_IDT_VEC_HWINTR:
322         case VMCS_IDT_VEC_SWINTR:
323             env->interrupt_injected = idtvec_info & VMCS_IDT_VEC_VECNUM;
324             break;
325         case VMCS_IDT_VEC_NMI:
326             env->nmi_injected = true;
327             break;
328         case VMCS_IDT_VEC_HWEXCEPTION:
329         case VMCS_IDT_VEC_SWEXCEPTION:
330             env->exception_nr = idtvec_info & VMCS_IDT_VEC_VECNUM;
331             env->exception_injected = 1;
332             break;
333         case VMCS_IDT_VEC_PRIV_SWEXCEPTION:
334         default:
335             abort();
336         }
337         if ((idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWEXCEPTION ||
338             (idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWINTR) {
339             env->ins_len = ins_len;
340         }
341         if (idtvec_info & VMCS_IDT_VEC_ERRCODE_VALID) {
342             env->has_error_code = true;
343             env->error_code = rvmcs(cpu->hvf->fd, VMCS_IDT_VECTORING_ERROR);
344         }
345     }
346     if ((rvmcs(cpu->hvf->fd, VMCS_GUEST_INTERRUPTIBILITY) &
347         VMCS_INTERRUPTIBILITY_NMI_BLOCKING)) {
348         env->hflags2 |= HF2_NMI_MASK;
349     } else {
350         env->hflags2 &= ~HF2_NMI_MASK;
351     }
352     if (rvmcs(cpu->hvf->fd, VMCS_GUEST_INTERRUPTIBILITY) &
353          (VMCS_INTERRUPTIBILITY_STI_BLOCKING |
354          VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING)) {
355         env->hflags |= HF_INHIBIT_IRQ_MASK;
356     } else {
357         env->hflags &= ~HF_INHIBIT_IRQ_MASK;
358     }
359 }
360 
361 static void hvf_cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
362                               uint32_t *eax, uint32_t *ebx,
363                               uint32_t *ecx, uint32_t *edx)
364 {
365     /*
366      * A wrapper extends cpu_x86_cpuid with 0x40000000 and 0x40000010 leafs,
367      * leafs 0x40000001-0x4000000F are filled with zeros
368      * Provides vmware-cpuid-freq support to hvf
369      *
370      * Note: leaf 0x40000000 not exposes HVF,
371      * leaving hypervisor signature empty
372      */
373 
374     if (index < 0x40000000 || index > 0x40000010 ||
375         !tsc_is_known(env) || !apic_bus_freq_is_known(env)) {
376 
377         cpu_x86_cpuid(env, index, count, eax, ebx, ecx, edx);
378         return;
379     }
380 
381     switch (index) {
382     case 0x40000000:
383         *eax = 0x40000010;    /* Max available cpuid leaf */
384         *ebx = 0;             /* Leave signature empty */
385         *ecx = 0;
386         *edx = 0;
387         break;
388     case 0x40000010:
389         *eax = env->tsc_khz;
390         *ebx = env->apic_bus_freq / 1000; /* Hz to KHz */
391         *ecx = 0;
392         *edx = 0;
393         break;
394     default:
395         *eax = 0;
396         *ebx = 0;
397         *ecx = 0;
398         *edx = 0;
399         break;
400     }
401 }
402 
403 int hvf_vcpu_exec(CPUState *cpu)
404 {
405     X86CPU *x86_cpu = X86_CPU(cpu);
406     CPUX86State *env = &x86_cpu->env;
407     int ret = 0;
408     uint64_t rip = 0;
409 
410     if (hvf_process_events(cpu)) {
411         return EXCP_HLT;
412     }
413 
414     do {
415         if (cpu->vcpu_dirty) {
416             hvf_put_registers(cpu);
417             cpu->vcpu_dirty = false;
418         }
419 
420         if (hvf_inject_interrupts(cpu)) {
421             return EXCP_INTERRUPT;
422         }
423         vmx_update_tpr(cpu);
424 
425         qemu_mutex_unlock_iothread();
426         if (!cpu_is_bsp(X86_CPU(cpu)) && cpu->halted) {
427             qemu_mutex_lock_iothread();
428             return EXCP_HLT;
429         }
430 
431         hv_return_t r  = hv_vcpu_run(cpu->hvf->fd);
432         assert_hvf_ok(r);
433 
434         /* handle VMEXIT */
435         uint64_t exit_reason = rvmcs(cpu->hvf->fd, VMCS_EXIT_REASON);
436         uint64_t exit_qual = rvmcs(cpu->hvf->fd, VMCS_EXIT_QUALIFICATION);
437         uint32_t ins_len = (uint32_t)rvmcs(cpu->hvf->fd,
438                                            VMCS_EXIT_INSTRUCTION_LENGTH);
439 
440         uint64_t idtvec_info = rvmcs(cpu->hvf->fd, VMCS_IDT_VECTORING_INFO);
441 
442         hvf_store_events(cpu, ins_len, idtvec_info);
443         rip = rreg(cpu->hvf->fd, HV_X86_RIP);
444         env->eflags = rreg(cpu->hvf->fd, HV_X86_RFLAGS);
445 
446         qemu_mutex_lock_iothread();
447 
448         update_apic_tpr(cpu);
449         current_cpu = cpu;
450 
451         ret = 0;
452         switch (exit_reason) {
453         case EXIT_REASON_HLT: {
454             macvm_set_rip(cpu, rip + ins_len);
455             if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) &&
456                 (env->eflags & IF_MASK))
457                 && !(cpu->interrupt_request & CPU_INTERRUPT_NMI) &&
458                 !(idtvec_info & VMCS_IDT_VEC_VALID)) {
459                 cpu->halted = 1;
460                 ret = EXCP_HLT;
461                 break;
462             }
463             ret = EXCP_INTERRUPT;
464             break;
465         }
466         case EXIT_REASON_MWAIT: {
467             ret = EXCP_INTERRUPT;
468             break;
469         }
470         /* Need to check if MMIO or unmapped fault */
471         case EXIT_REASON_EPT_FAULT:
472         {
473             hvf_slot *slot;
474             uint64_t gpa = rvmcs(cpu->hvf->fd, VMCS_GUEST_PHYSICAL_ADDRESS);
475 
476             if (((idtvec_info & VMCS_IDT_VEC_VALID) == 0) &&
477                 ((exit_qual & EXIT_QUAL_NMIUDTI) != 0)) {
478                 vmx_set_nmi_blocking(cpu);
479             }
480 
481             slot = hvf_find_overlap_slot(gpa, 1);
482             /* mmio */
483             if (ept_emulation_fault(slot, gpa, exit_qual)) {
484                 struct x86_decode decode;
485 
486                 load_regs(cpu);
487                 decode_instruction(env, &decode);
488                 exec_instruction(env, &decode);
489                 store_regs(cpu);
490                 break;
491             }
492             break;
493         }
494         case EXIT_REASON_INOUT:
495         {
496             uint32_t in = (exit_qual & 8) != 0;
497             uint32_t size =  (exit_qual & 7) + 1;
498             uint32_t string =  (exit_qual & 16) != 0;
499             uint32_t port =  exit_qual >> 16;
500             /*uint32_t rep = (exit_qual & 0x20) != 0;*/
501 
502             if (!string && in) {
503                 uint64_t val = 0;
504                 load_regs(cpu);
505                 hvf_handle_io(env, port, &val, 0, size, 1);
506                 if (size == 1) {
507                     AL(env) = val;
508                 } else if (size == 2) {
509                     AX(env) = val;
510                 } else if (size == 4) {
511                     RAX(env) = (uint32_t)val;
512                 } else {
513                     RAX(env) = (uint64_t)val;
514                 }
515                 env->eip += ins_len;
516                 store_regs(cpu);
517                 break;
518             } else if (!string && !in) {
519                 RAX(env) = rreg(cpu->hvf->fd, HV_X86_RAX);
520                 hvf_handle_io(env, port, &RAX(env), 1, size, 1);
521                 macvm_set_rip(cpu, rip + ins_len);
522                 break;
523             }
524             struct x86_decode decode;
525 
526             load_regs(cpu);
527             decode_instruction(env, &decode);
528             assert(ins_len == decode.len);
529             exec_instruction(env, &decode);
530             store_regs(cpu);
531 
532             break;
533         }
534         case EXIT_REASON_CPUID: {
535             uint32_t rax = (uint32_t)rreg(cpu->hvf->fd, HV_X86_RAX);
536             uint32_t rbx = (uint32_t)rreg(cpu->hvf->fd, HV_X86_RBX);
537             uint32_t rcx = (uint32_t)rreg(cpu->hvf->fd, HV_X86_RCX);
538             uint32_t rdx = (uint32_t)rreg(cpu->hvf->fd, HV_X86_RDX);
539 
540             if (rax == 1) {
541                 /* CPUID1.ecx.OSXSAVE needs to know CR4 */
542                 env->cr[4] = rvmcs(cpu->hvf->fd, VMCS_GUEST_CR4);
543             }
544             hvf_cpu_x86_cpuid(env, rax, rcx, &rax, &rbx, &rcx, &rdx);
545 
546             wreg(cpu->hvf->fd, HV_X86_RAX, rax);
547             wreg(cpu->hvf->fd, HV_X86_RBX, rbx);
548             wreg(cpu->hvf->fd, HV_X86_RCX, rcx);
549             wreg(cpu->hvf->fd, HV_X86_RDX, rdx);
550 
551             macvm_set_rip(cpu, rip + ins_len);
552             break;
553         }
554         case EXIT_REASON_XSETBV: {
555             X86CPU *x86_cpu = X86_CPU(cpu);
556             CPUX86State *env = &x86_cpu->env;
557             uint32_t eax = (uint32_t)rreg(cpu->hvf->fd, HV_X86_RAX);
558             uint32_t ecx = (uint32_t)rreg(cpu->hvf->fd, HV_X86_RCX);
559             uint32_t edx = (uint32_t)rreg(cpu->hvf->fd, HV_X86_RDX);
560 
561             if (ecx) {
562                 macvm_set_rip(cpu, rip + ins_len);
563                 break;
564             }
565             env->xcr0 = ((uint64_t)edx << 32) | eax;
566             wreg(cpu->hvf->fd, HV_X86_XCR0, env->xcr0 | 1);
567             macvm_set_rip(cpu, rip + ins_len);
568             break;
569         }
570         case EXIT_REASON_INTR_WINDOW:
571             vmx_clear_int_window_exiting(cpu);
572             ret = EXCP_INTERRUPT;
573             break;
574         case EXIT_REASON_NMI_WINDOW:
575             vmx_clear_nmi_window_exiting(cpu);
576             ret = EXCP_INTERRUPT;
577             break;
578         case EXIT_REASON_EXT_INTR:
579             /* force exit and allow io handling */
580             ret = EXCP_INTERRUPT;
581             break;
582         case EXIT_REASON_RDMSR:
583         case EXIT_REASON_WRMSR:
584         {
585             load_regs(cpu);
586             if (exit_reason == EXIT_REASON_RDMSR) {
587                 simulate_rdmsr(cpu);
588             } else {
589                 simulate_wrmsr(cpu);
590             }
591             env->eip += ins_len;
592             store_regs(cpu);
593             break;
594         }
595         case EXIT_REASON_CR_ACCESS: {
596             int cr;
597             int reg;
598 
599             load_regs(cpu);
600             cr = exit_qual & 15;
601             reg = (exit_qual >> 8) & 15;
602 
603             switch (cr) {
604             case 0x0: {
605                 macvm_set_cr0(cpu->hvf->fd, RRX(env, reg));
606                 break;
607             }
608             case 4: {
609                 macvm_set_cr4(cpu->hvf->fd, RRX(env, reg));
610                 break;
611             }
612             case 8: {
613                 X86CPU *x86_cpu = X86_CPU(cpu);
614                 if (exit_qual & 0x10) {
615                     RRX(env, reg) = cpu_get_apic_tpr(x86_cpu->apic_state);
616                 } else {
617                     int tpr = RRX(env, reg);
618                     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
619                     ret = EXCP_INTERRUPT;
620                 }
621                 break;
622             }
623             default:
624                 error_report("Unrecognized CR %d", cr);
625                 abort();
626             }
627             env->eip += ins_len;
628             store_regs(cpu);
629             break;
630         }
631         case EXIT_REASON_APIC_ACCESS: { /* TODO */
632             struct x86_decode decode;
633 
634             load_regs(cpu);
635             decode_instruction(env, &decode);
636             exec_instruction(env, &decode);
637             store_regs(cpu);
638             break;
639         }
640         case EXIT_REASON_TPR: {
641             ret = 1;
642             break;
643         }
644         case EXIT_REASON_TASK_SWITCH: {
645             uint64_t vinfo = rvmcs(cpu->hvf->fd, VMCS_IDT_VECTORING_INFO);
646             x68_segment_selector sel = {.sel = exit_qual & 0xffff};
647             vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3,
648              vinfo & VMCS_INTR_VALID, vinfo & VECTORING_INFO_VECTOR_MASK, vinfo
649              & VMCS_INTR_T_MASK);
650             break;
651         }
652         case EXIT_REASON_TRIPLE_FAULT: {
653             qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
654             ret = EXCP_INTERRUPT;
655             break;
656         }
657         case EXIT_REASON_RDPMC:
658             wreg(cpu->hvf->fd, HV_X86_RAX, 0);
659             wreg(cpu->hvf->fd, HV_X86_RDX, 0);
660             macvm_set_rip(cpu, rip + ins_len);
661             break;
662         case VMX_REASON_VMCALL:
663             env->exception_nr = EXCP0D_GPF;
664             env->exception_injected = 1;
665             env->has_error_code = true;
666             env->error_code = 0;
667             break;
668         default:
669             error_report("%llx: unhandled exit %llx", rip, exit_reason);
670         }
671     } while (ret == 0);
672 
673     return ret;
674 }
675