1 /* Copyright 2008 IBM Corporation 2 * 2008 Red Hat, Inc. 3 * Copyright 2011 Intel Corporation 4 * Copyright 2016 Veertu, Inc. 5 * Copyright 2017 The Android Open Source Project 6 * 7 * QEMU Hypervisor.framework support 8 * 9 * This program is free software; you can redistribute it and/or 10 * modify it under the terms of version 2 of the GNU General Public 11 * License as published by the Free Software Foundation. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 16 * Lesser General Public License for more details. 17 * 18 * You should have received a copy of the GNU Lesser General Public 19 * License along with this program; if not, see <http://www.gnu.org/licenses/>. 20 * 21 * This file contain code under public domain from the hvdos project: 22 * https://github.com/mist64/hvdos 23 * 24 * Parts Copyright (c) 2011 NetApp, Inc. 25 * All rights reserved. 26 * 27 * Redistribution and use in source and binary forms, with or without 28 * modification, are permitted provided that the following conditions 29 * are met: 30 * 1. Redistributions of source code must retain the above copyright 31 * notice, this list of conditions and the following disclaimer. 32 * 2. Redistributions in binary form must reproduce the above copyright 33 * notice, this list of conditions and the following disclaimer in the 34 * documentation and/or other materials provided with the distribution. 35 * 36 * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND 37 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 38 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 39 * ARE DISCLAIMED. IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE 40 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 41 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 42 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 43 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 44 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 45 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 46 * SUCH DAMAGE. 47 */ 48 #include "qemu/osdep.h" 49 #include "qemu-common.h" 50 #include "qemu/error-report.h" 51 52 #include "sysemu/hvf.h" 53 #include "hvf-i386.h" 54 #include "vmcs.h" 55 #include "vmx.h" 56 #include "x86.h" 57 #include "x86_descr.h" 58 #include "x86_mmu.h" 59 #include "x86_decode.h" 60 #include "x86_emu.h" 61 #include "x86_task.h" 62 #include "x86hvf.h" 63 64 #include <Hypervisor/hv.h> 65 #include <Hypervisor/hv_vmx.h> 66 67 #include "exec/address-spaces.h" 68 #include "hw/i386/apic_internal.h" 69 #include "hw/boards.h" 70 #include "qemu/main-loop.h" 71 #include "sysemu/accel.h" 72 #include "sysemu/sysemu.h" 73 #include "target/i386/cpu.h" 74 75 HVFState *hvf_state; 76 int hvf_disabled = 1; 77 78 static void assert_hvf_ok(hv_return_t ret) 79 { 80 if (ret == HV_SUCCESS) { 81 return; 82 } 83 84 switch (ret) { 85 case HV_ERROR: 86 error_report("Error: HV_ERROR"); 87 break; 88 case HV_BUSY: 89 error_report("Error: HV_BUSY"); 90 break; 91 case HV_BAD_ARGUMENT: 92 error_report("Error: HV_BAD_ARGUMENT"); 93 break; 94 case HV_NO_RESOURCES: 95 error_report("Error: HV_NO_RESOURCES"); 96 break; 97 case HV_NO_DEVICE: 98 error_report("Error: HV_NO_DEVICE"); 99 break; 100 case HV_UNSUPPORTED: 101 error_report("Error: HV_UNSUPPORTED"); 102 break; 103 default: 104 error_report("Unknown Error"); 105 } 106 107 abort(); 108 } 109 110 /* Memory slots */ 111 hvf_slot *hvf_find_overlap_slot(uint64_t start, uint64_t end) 112 { 113 hvf_slot *slot; 114 int x; 115 for (x = 0; x < hvf_state->num_slots; ++x) { 116 slot = &hvf_state->slots[x]; 117 if (slot->size && start < (slot->start + slot->size) && 118 end > slot->start) { 119 return slot; 120 } 121 } 122 return NULL; 123 } 124 125 struct mac_slot { 126 int present; 127 uint64_t size; 128 uint64_t gpa_start; 129 uint64_t gva; 130 }; 131 132 struct mac_slot mac_slots[32]; 133 #define ALIGN(x, y) (((x) + (y) - 1) & ~((y) - 1)) 134 135 static int do_hvf_set_memory(hvf_slot *slot) 136 { 137 struct mac_slot *macslot; 138 hv_memory_flags_t flags; 139 hv_return_t ret; 140 141 macslot = &mac_slots[slot->slot_id]; 142 143 if (macslot->present) { 144 if (macslot->size != slot->size) { 145 macslot->present = 0; 146 ret = hv_vm_unmap(macslot->gpa_start, macslot->size); 147 assert_hvf_ok(ret); 148 } 149 } 150 151 if (!slot->size) { 152 return 0; 153 } 154 155 flags = HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC; 156 157 macslot->present = 1; 158 macslot->gpa_start = slot->start; 159 macslot->size = slot->size; 160 ret = hv_vm_map((hv_uvaddr_t)slot->mem, slot->start, slot->size, flags); 161 assert_hvf_ok(ret); 162 return 0; 163 } 164 165 void hvf_set_phys_mem(MemoryRegionSection *section, bool add) 166 { 167 hvf_slot *mem; 168 MemoryRegion *area = section->mr; 169 170 if (!memory_region_is_ram(area)) { 171 return; 172 } 173 174 mem = hvf_find_overlap_slot( 175 section->offset_within_address_space, 176 section->offset_within_address_space + int128_get64(section->size)); 177 178 if (mem && add) { 179 if (mem->size == int128_get64(section->size) && 180 mem->start == section->offset_within_address_space && 181 mem->mem == (memory_region_get_ram_ptr(area) + 182 section->offset_within_region)) { 183 return; /* Same region was attempted to register, go away. */ 184 } 185 } 186 187 /* Region needs to be reset. set the size to 0 and remap it. */ 188 if (mem) { 189 mem->size = 0; 190 if (do_hvf_set_memory(mem)) { 191 error_report("Failed to reset overlapping slot"); 192 abort(); 193 } 194 } 195 196 if (!add) { 197 return; 198 } 199 200 /* Now make a new slot. */ 201 int x; 202 203 for (x = 0; x < hvf_state->num_slots; ++x) { 204 mem = &hvf_state->slots[x]; 205 if (!mem->size) { 206 break; 207 } 208 } 209 210 if (x == hvf_state->num_slots) { 211 error_report("No free slots"); 212 abort(); 213 } 214 215 mem->size = int128_get64(section->size); 216 mem->mem = memory_region_get_ram_ptr(area) + section->offset_within_region; 217 mem->start = section->offset_within_address_space; 218 mem->region = area; 219 220 if (do_hvf_set_memory(mem)) { 221 error_report("Error registering new memory slot"); 222 abort(); 223 } 224 } 225 226 void vmx_update_tpr(CPUState *cpu) 227 { 228 /* TODO: need integrate APIC handling */ 229 X86CPU *x86_cpu = X86_CPU(cpu); 230 int tpr = cpu_get_apic_tpr(x86_cpu->apic_state) << 4; 231 int irr = apic_get_highest_priority_irr(x86_cpu->apic_state); 232 233 wreg(cpu->hvf_fd, HV_X86_TPR, tpr); 234 if (irr == -1) { 235 wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0); 236 } else { 237 wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, (irr > tpr) ? tpr >> 4 : 238 irr >> 4); 239 } 240 } 241 242 void update_apic_tpr(CPUState *cpu) 243 { 244 X86CPU *x86_cpu = X86_CPU(cpu); 245 int tpr = rreg(cpu->hvf_fd, HV_X86_TPR) >> 4; 246 cpu_set_apic_tpr(x86_cpu->apic_state, tpr); 247 } 248 249 #define VECTORING_INFO_VECTOR_MASK 0xff 250 251 static void hvf_handle_interrupt(CPUState * cpu, int mask) 252 { 253 cpu->interrupt_request |= mask; 254 if (!qemu_cpu_is_self(cpu)) { 255 qemu_cpu_kick(cpu); 256 } 257 } 258 259 void hvf_handle_io(CPUArchState *env, uint16_t port, void *buffer, 260 int direction, int size, int count) 261 { 262 int i; 263 uint8_t *ptr = buffer; 264 265 for (i = 0; i < count; i++) { 266 address_space_rw(&address_space_io, port, MEMTXATTRS_UNSPECIFIED, 267 ptr, size, 268 direction); 269 ptr += size; 270 } 271 } 272 273 /* TODO: synchronize vcpu state */ 274 static void do_hvf_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg) 275 { 276 CPUState *cpu_state = cpu; 277 if (cpu_state->vcpu_dirty == 0) { 278 hvf_get_registers(cpu_state); 279 } 280 281 cpu_state->vcpu_dirty = 1; 282 } 283 284 void hvf_cpu_synchronize_state(CPUState *cpu_state) 285 { 286 if (cpu_state->vcpu_dirty == 0) { 287 run_on_cpu(cpu_state, do_hvf_cpu_synchronize_state, RUN_ON_CPU_NULL); 288 } 289 } 290 291 static void do_hvf_cpu_synchronize_post_reset(CPUState *cpu, run_on_cpu_data arg) 292 { 293 CPUState *cpu_state = cpu; 294 hvf_put_registers(cpu_state); 295 cpu_state->vcpu_dirty = false; 296 } 297 298 void hvf_cpu_synchronize_post_reset(CPUState *cpu_state) 299 { 300 run_on_cpu(cpu_state, do_hvf_cpu_synchronize_post_reset, RUN_ON_CPU_NULL); 301 } 302 303 void _hvf_cpu_synchronize_post_init(CPUState *cpu, run_on_cpu_data arg) 304 { 305 CPUState *cpu_state = cpu; 306 hvf_put_registers(cpu_state); 307 cpu_state->vcpu_dirty = false; 308 } 309 310 void hvf_cpu_synchronize_post_init(CPUState *cpu_state) 311 { 312 run_on_cpu(cpu_state, _hvf_cpu_synchronize_post_init, RUN_ON_CPU_NULL); 313 } 314 315 static bool ept_emulation_fault(hvf_slot *slot, uint64_t gpa, uint64_t ept_qual) 316 { 317 int read, write; 318 319 /* EPT fault on an instruction fetch doesn't make sense here */ 320 if (ept_qual & EPT_VIOLATION_INST_FETCH) { 321 return false; 322 } 323 324 /* EPT fault must be a read fault or a write fault */ 325 read = ept_qual & EPT_VIOLATION_DATA_READ ? 1 : 0; 326 write = ept_qual & EPT_VIOLATION_DATA_WRITE ? 1 : 0; 327 if ((read | write) == 0) { 328 return false; 329 } 330 331 if (write && slot) { 332 if (slot->flags & HVF_SLOT_LOG) { 333 memory_region_set_dirty(slot->region, gpa - slot->start, 1); 334 hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size, 335 HV_MEMORY_READ | HV_MEMORY_WRITE); 336 } 337 } 338 339 /* 340 * The EPT violation must have been caused by accessing a 341 * guest-physical address that is a translation of a guest-linear 342 * address. 343 */ 344 if ((ept_qual & EPT_VIOLATION_GLA_VALID) == 0 || 345 (ept_qual & EPT_VIOLATION_XLAT_VALID) == 0) { 346 return false; 347 } 348 349 return !slot; 350 } 351 352 static void hvf_set_dirty_tracking(MemoryRegionSection *section, bool on) 353 { 354 hvf_slot *slot; 355 356 slot = hvf_find_overlap_slot( 357 section->offset_within_address_space, 358 section->offset_within_address_space + int128_get64(section->size)); 359 360 /* protect region against writes; begin tracking it */ 361 if (on) { 362 slot->flags |= HVF_SLOT_LOG; 363 hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size, 364 HV_MEMORY_READ); 365 /* stop tracking region*/ 366 } else { 367 slot->flags &= ~HVF_SLOT_LOG; 368 hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size, 369 HV_MEMORY_READ | HV_MEMORY_WRITE); 370 } 371 } 372 373 static void hvf_log_start(MemoryListener *listener, 374 MemoryRegionSection *section, int old, int new) 375 { 376 if (old != 0) { 377 return; 378 } 379 380 hvf_set_dirty_tracking(section, 1); 381 } 382 383 static void hvf_log_stop(MemoryListener *listener, 384 MemoryRegionSection *section, int old, int new) 385 { 386 if (new != 0) { 387 return; 388 } 389 390 hvf_set_dirty_tracking(section, 0); 391 } 392 393 static void hvf_log_sync(MemoryListener *listener, 394 MemoryRegionSection *section) 395 { 396 /* 397 * sync of dirty pages is handled elsewhere; just make sure we keep 398 * tracking the region. 399 */ 400 hvf_set_dirty_tracking(section, 1); 401 } 402 403 static void hvf_region_add(MemoryListener *listener, 404 MemoryRegionSection *section) 405 { 406 hvf_set_phys_mem(section, true); 407 } 408 409 static void hvf_region_del(MemoryListener *listener, 410 MemoryRegionSection *section) 411 { 412 hvf_set_phys_mem(section, false); 413 } 414 415 static MemoryListener hvf_memory_listener = { 416 .priority = 10, 417 .region_add = hvf_region_add, 418 .region_del = hvf_region_del, 419 .log_start = hvf_log_start, 420 .log_stop = hvf_log_stop, 421 .log_sync = hvf_log_sync, 422 }; 423 424 void hvf_reset_vcpu(CPUState *cpu) { 425 426 /* TODO: this shouldn't be needed; there is already a call to 427 * cpu_synchronize_all_post_reset in vl.c 428 */ 429 wvmcs(cpu->hvf_fd, VMCS_ENTRY_CTLS, 0); 430 wvmcs(cpu->hvf_fd, VMCS_GUEST_IA32_EFER, 0); 431 macvm_set_cr0(cpu->hvf_fd, 0x60000010); 432 433 wvmcs(cpu->hvf_fd, VMCS_CR4_MASK, CR4_VMXE_MASK); 434 wvmcs(cpu->hvf_fd, VMCS_CR4_SHADOW, 0x0); 435 wvmcs(cpu->hvf_fd, VMCS_GUEST_CR4, CR4_VMXE_MASK); 436 437 /* set VMCS guest state fields */ 438 wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_SELECTOR, 0xf000); 439 wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_LIMIT, 0xffff); 440 wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_ACCESS_RIGHTS, 0x9b); 441 wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_BASE, 0xffff0000); 442 443 wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_SELECTOR, 0); 444 wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_LIMIT, 0xffff); 445 wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_ACCESS_RIGHTS, 0x93); 446 wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_BASE, 0); 447 448 wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_SELECTOR, 0); 449 wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_LIMIT, 0xffff); 450 wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_ACCESS_RIGHTS, 0x93); 451 wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_BASE, 0); 452 453 wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_SELECTOR, 0); 454 wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_LIMIT, 0xffff); 455 wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_ACCESS_RIGHTS, 0x93); 456 wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_BASE, 0); 457 458 wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_SELECTOR, 0); 459 wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_LIMIT, 0xffff); 460 wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_ACCESS_RIGHTS, 0x93); 461 wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_BASE, 0); 462 463 wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_SELECTOR, 0); 464 wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_LIMIT, 0xffff); 465 wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_ACCESS_RIGHTS, 0x93); 466 wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_BASE, 0); 467 468 wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_SELECTOR, 0); 469 wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_LIMIT, 0); 470 wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_ACCESS_RIGHTS, 0x10000); 471 wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_BASE, 0); 472 473 wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_SELECTOR, 0); 474 wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_LIMIT, 0); 475 wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_ACCESS_RIGHTS, 0x83); 476 wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_BASE, 0); 477 478 wvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_LIMIT, 0); 479 wvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_BASE, 0); 480 481 wvmcs(cpu->hvf_fd, VMCS_GUEST_IDTR_LIMIT, 0); 482 wvmcs(cpu->hvf_fd, VMCS_GUEST_IDTR_BASE, 0); 483 484 /*wvmcs(cpu->hvf_fd, VMCS_GUEST_CR2, 0x0);*/ 485 wvmcs(cpu->hvf_fd, VMCS_GUEST_CR3, 0x0); 486 487 wreg(cpu->hvf_fd, HV_X86_RIP, 0xfff0); 488 wreg(cpu->hvf_fd, HV_X86_RDX, 0x623); 489 wreg(cpu->hvf_fd, HV_X86_RFLAGS, 0x2); 490 wreg(cpu->hvf_fd, HV_X86_RSP, 0x0); 491 wreg(cpu->hvf_fd, HV_X86_RAX, 0x0); 492 wreg(cpu->hvf_fd, HV_X86_RBX, 0x0); 493 wreg(cpu->hvf_fd, HV_X86_RCX, 0x0); 494 wreg(cpu->hvf_fd, HV_X86_RSI, 0x0); 495 wreg(cpu->hvf_fd, HV_X86_RDI, 0x0); 496 wreg(cpu->hvf_fd, HV_X86_RBP, 0x0); 497 498 for (int i = 0; i < 8; i++) { 499 wreg(cpu->hvf_fd, HV_X86_R8 + i, 0x0); 500 } 501 502 hv_vm_sync_tsc(0); 503 cpu->halted = 0; 504 hv_vcpu_invalidate_tlb(cpu->hvf_fd); 505 hv_vcpu_flush(cpu->hvf_fd); 506 } 507 508 void hvf_vcpu_destroy(CPUState *cpu) 509 { 510 hv_return_t ret = hv_vcpu_destroy((hv_vcpuid_t)cpu->hvf_fd); 511 assert_hvf_ok(ret); 512 } 513 514 static void dummy_signal(int sig) 515 { 516 } 517 518 int hvf_init_vcpu(CPUState *cpu) 519 { 520 521 X86CPU *x86cpu = X86_CPU(cpu); 522 CPUX86State *env = &x86cpu->env; 523 int r; 524 525 /* init cpu signals */ 526 sigset_t set; 527 struct sigaction sigact; 528 529 memset(&sigact, 0, sizeof(sigact)); 530 sigact.sa_handler = dummy_signal; 531 sigaction(SIG_IPI, &sigact, NULL); 532 533 pthread_sigmask(SIG_BLOCK, NULL, &set); 534 sigdelset(&set, SIG_IPI); 535 536 init_emu(); 537 init_decoder(); 538 539 hvf_state->hvf_caps = g_new0(struct hvf_vcpu_caps, 1); 540 env->hvf_emul = g_new0(HVFX86EmulatorState, 1); 541 542 r = hv_vcpu_create((hv_vcpuid_t *)&cpu->hvf_fd, HV_VCPU_DEFAULT); 543 cpu->vcpu_dirty = 1; 544 assert_hvf_ok(r); 545 546 if (hv_vmx_read_capability(HV_VMX_CAP_PINBASED, 547 &hvf_state->hvf_caps->vmx_cap_pinbased)) { 548 abort(); 549 } 550 if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED, 551 &hvf_state->hvf_caps->vmx_cap_procbased)) { 552 abort(); 553 } 554 if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED2, 555 &hvf_state->hvf_caps->vmx_cap_procbased2)) { 556 abort(); 557 } 558 if (hv_vmx_read_capability(HV_VMX_CAP_ENTRY, 559 &hvf_state->hvf_caps->vmx_cap_entry)) { 560 abort(); 561 } 562 563 /* set VMCS control fields */ 564 wvmcs(cpu->hvf_fd, VMCS_PIN_BASED_CTLS, 565 cap2ctrl(hvf_state->hvf_caps->vmx_cap_pinbased, 566 VMCS_PIN_BASED_CTLS_EXTINT | 567 VMCS_PIN_BASED_CTLS_NMI | 568 VMCS_PIN_BASED_CTLS_VNMI)); 569 wvmcs(cpu->hvf_fd, VMCS_PRI_PROC_BASED_CTLS, 570 cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased, 571 VMCS_PRI_PROC_BASED_CTLS_HLT | 572 VMCS_PRI_PROC_BASED_CTLS_MWAIT | 573 VMCS_PRI_PROC_BASED_CTLS_TSC_OFFSET | 574 VMCS_PRI_PROC_BASED_CTLS_TPR_SHADOW) | 575 VMCS_PRI_PROC_BASED_CTLS_SEC_CONTROL); 576 wvmcs(cpu->hvf_fd, VMCS_SEC_PROC_BASED_CTLS, 577 cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased2, 578 VMCS_PRI_PROC_BASED2_CTLS_APIC_ACCESSES)); 579 580 wvmcs(cpu->hvf_fd, VMCS_ENTRY_CTLS, cap2ctrl(hvf_state->hvf_caps->vmx_cap_entry, 581 0)); 582 wvmcs(cpu->hvf_fd, VMCS_EXCEPTION_BITMAP, 0); /* Double fault */ 583 584 wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0); 585 586 hvf_reset_vcpu(cpu); 587 588 x86cpu = X86_CPU(cpu); 589 x86cpu->env.xsave_buf = qemu_memalign(4096, 4096); 590 591 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_STAR, 1); 592 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_LSTAR, 1); 593 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_CSTAR, 1); 594 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FMASK, 1); 595 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FSBASE, 1); 596 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_GSBASE, 1); 597 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_KERNELGSBASE, 1); 598 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_TSC_AUX, 1); 599 /*hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_TSC, 1);*/ 600 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_CS, 1); 601 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_EIP, 1); 602 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_ESP, 1); 603 604 return 0; 605 } 606 607 void hvf_disable(int shouldDisable) 608 { 609 hvf_disabled = shouldDisable; 610 } 611 612 static void hvf_store_events(CPUState *cpu, uint32_t ins_len, uint64_t idtvec_info) 613 { 614 X86CPU *x86_cpu = X86_CPU(cpu); 615 CPUX86State *env = &x86_cpu->env; 616 617 env->exception_injected = -1; 618 env->interrupt_injected = -1; 619 env->nmi_injected = false; 620 if (idtvec_info & VMCS_IDT_VEC_VALID) { 621 switch (idtvec_info & VMCS_IDT_VEC_TYPE) { 622 case VMCS_IDT_VEC_HWINTR: 623 case VMCS_IDT_VEC_SWINTR: 624 env->interrupt_injected = idtvec_info & VMCS_IDT_VEC_VECNUM; 625 break; 626 case VMCS_IDT_VEC_NMI: 627 env->nmi_injected = true; 628 break; 629 case VMCS_IDT_VEC_HWEXCEPTION: 630 case VMCS_IDT_VEC_SWEXCEPTION: 631 env->exception_injected = idtvec_info & VMCS_IDT_VEC_VECNUM; 632 break; 633 case VMCS_IDT_VEC_PRIV_SWEXCEPTION: 634 default: 635 abort(); 636 } 637 if ((idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWEXCEPTION || 638 (idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWINTR) { 639 env->ins_len = ins_len; 640 } 641 if (idtvec_info & VMCS_INTR_DEL_ERRCODE) { 642 env->has_error_code = true; 643 env->error_code = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_ERROR); 644 } 645 } 646 if ((rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) & 647 VMCS_INTERRUPTIBILITY_NMI_BLOCKING)) { 648 env->hflags2 |= HF2_NMI_MASK; 649 } else { 650 env->hflags2 &= ~HF2_NMI_MASK; 651 } 652 if (rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) & 653 (VMCS_INTERRUPTIBILITY_STI_BLOCKING | 654 VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING)) { 655 env->hflags |= HF_INHIBIT_IRQ_MASK; 656 } else { 657 env->hflags &= ~HF_INHIBIT_IRQ_MASK; 658 } 659 } 660 661 int hvf_vcpu_exec(CPUState *cpu) 662 { 663 X86CPU *x86_cpu = X86_CPU(cpu); 664 CPUX86State *env = &x86_cpu->env; 665 int ret = 0; 666 uint64_t rip = 0; 667 668 cpu->halted = 0; 669 670 if (hvf_process_events(cpu)) { 671 return EXCP_HLT; 672 } 673 674 do { 675 if (cpu->vcpu_dirty) { 676 hvf_put_registers(cpu); 677 cpu->vcpu_dirty = false; 678 } 679 680 if (hvf_inject_interrupts(cpu)) { 681 return EXCP_INTERRUPT; 682 } 683 vmx_update_tpr(cpu); 684 685 qemu_mutex_unlock_iothread(); 686 if (!cpu_is_bsp(X86_CPU(cpu)) && cpu->halted) { 687 qemu_mutex_lock_iothread(); 688 return EXCP_HLT; 689 } 690 691 hv_return_t r = hv_vcpu_run(cpu->hvf_fd); 692 assert_hvf_ok(r); 693 694 /* handle VMEXIT */ 695 uint64_t exit_reason = rvmcs(cpu->hvf_fd, VMCS_EXIT_REASON); 696 uint64_t exit_qual = rvmcs(cpu->hvf_fd, VMCS_EXIT_QUALIFICATION); 697 uint32_t ins_len = (uint32_t)rvmcs(cpu->hvf_fd, 698 VMCS_EXIT_INSTRUCTION_LENGTH); 699 700 uint64_t idtvec_info = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO); 701 702 hvf_store_events(cpu, ins_len, idtvec_info); 703 rip = rreg(cpu->hvf_fd, HV_X86_RIP); 704 RFLAGS(env) = rreg(cpu->hvf_fd, HV_X86_RFLAGS); 705 env->eflags = RFLAGS(env); 706 707 qemu_mutex_lock_iothread(); 708 709 update_apic_tpr(cpu); 710 current_cpu = cpu; 711 712 ret = 0; 713 switch (exit_reason) { 714 case EXIT_REASON_HLT: { 715 macvm_set_rip(cpu, rip + ins_len); 716 if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) && 717 (EFLAGS(env) & IF_MASK)) 718 && !(cpu->interrupt_request & CPU_INTERRUPT_NMI) && 719 !(idtvec_info & VMCS_IDT_VEC_VALID)) { 720 cpu->halted = 1; 721 ret = EXCP_HLT; 722 } 723 ret = EXCP_INTERRUPT; 724 break; 725 } 726 case EXIT_REASON_MWAIT: { 727 ret = EXCP_INTERRUPT; 728 break; 729 } 730 /* Need to check if MMIO or unmmaped fault */ 731 case EXIT_REASON_EPT_FAULT: 732 { 733 hvf_slot *slot; 734 uint64_t gpa = rvmcs(cpu->hvf_fd, VMCS_GUEST_PHYSICAL_ADDRESS); 735 736 if (((idtvec_info & VMCS_IDT_VEC_VALID) == 0) && 737 ((exit_qual & EXIT_QUAL_NMIUDTI) != 0)) { 738 vmx_set_nmi_blocking(cpu); 739 } 740 741 slot = hvf_find_overlap_slot(gpa, gpa); 742 /* mmio */ 743 if (ept_emulation_fault(slot, gpa, exit_qual)) { 744 struct x86_decode decode; 745 746 load_regs(cpu); 747 env->hvf_emul->fetch_rip = rip; 748 749 decode_instruction(env, &decode); 750 exec_instruction(env, &decode); 751 store_regs(cpu); 752 break; 753 } 754 break; 755 } 756 case EXIT_REASON_INOUT: 757 { 758 uint32_t in = (exit_qual & 8) != 0; 759 uint32_t size = (exit_qual & 7) + 1; 760 uint32_t string = (exit_qual & 16) != 0; 761 uint32_t port = exit_qual >> 16; 762 /*uint32_t rep = (exit_qual & 0x20) != 0;*/ 763 764 if (!string && in) { 765 uint64_t val = 0; 766 load_regs(cpu); 767 hvf_handle_io(env, port, &val, 0, size, 1); 768 if (size == 1) { 769 AL(env) = val; 770 } else if (size == 2) { 771 AX(env) = val; 772 } else if (size == 4) { 773 RAX(env) = (uint32_t)val; 774 } else { 775 RAX(env) = (uint64_t)val; 776 } 777 RIP(env) += ins_len; 778 store_regs(cpu); 779 break; 780 } else if (!string && !in) { 781 RAX(env) = rreg(cpu->hvf_fd, HV_X86_RAX); 782 hvf_handle_io(env, port, &RAX(env), 1, size, 1); 783 macvm_set_rip(cpu, rip + ins_len); 784 break; 785 } 786 struct x86_decode decode; 787 788 load_regs(cpu); 789 env->hvf_emul->fetch_rip = rip; 790 791 decode_instruction(env, &decode); 792 assert(ins_len == decode.len); 793 exec_instruction(env, &decode); 794 store_regs(cpu); 795 796 break; 797 } 798 case EXIT_REASON_CPUID: { 799 uint32_t rax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX); 800 uint32_t rbx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RBX); 801 uint32_t rcx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX); 802 uint32_t rdx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX); 803 804 cpu_x86_cpuid(env, rax, rcx, &rax, &rbx, &rcx, &rdx); 805 806 wreg(cpu->hvf_fd, HV_X86_RAX, rax); 807 wreg(cpu->hvf_fd, HV_X86_RBX, rbx); 808 wreg(cpu->hvf_fd, HV_X86_RCX, rcx); 809 wreg(cpu->hvf_fd, HV_X86_RDX, rdx); 810 811 macvm_set_rip(cpu, rip + ins_len); 812 break; 813 } 814 case EXIT_REASON_XSETBV: { 815 X86CPU *x86_cpu = X86_CPU(cpu); 816 CPUX86State *env = &x86_cpu->env; 817 uint32_t eax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX); 818 uint32_t ecx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX); 819 uint32_t edx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX); 820 821 if (ecx) { 822 macvm_set_rip(cpu, rip + ins_len); 823 break; 824 } 825 env->xcr0 = ((uint64_t)edx << 32) | eax; 826 wreg(cpu->hvf_fd, HV_X86_XCR0, env->xcr0 | 1); 827 macvm_set_rip(cpu, rip + ins_len); 828 break; 829 } 830 case EXIT_REASON_INTR_WINDOW: 831 vmx_clear_int_window_exiting(cpu); 832 ret = EXCP_INTERRUPT; 833 break; 834 case EXIT_REASON_NMI_WINDOW: 835 vmx_clear_nmi_window_exiting(cpu); 836 ret = EXCP_INTERRUPT; 837 break; 838 case EXIT_REASON_EXT_INTR: 839 /* force exit and allow io handling */ 840 ret = EXCP_INTERRUPT; 841 break; 842 case EXIT_REASON_RDMSR: 843 case EXIT_REASON_WRMSR: 844 { 845 load_regs(cpu); 846 if (exit_reason == EXIT_REASON_RDMSR) { 847 simulate_rdmsr(cpu); 848 } else { 849 simulate_wrmsr(cpu); 850 } 851 RIP(env) += rvmcs(cpu->hvf_fd, VMCS_EXIT_INSTRUCTION_LENGTH); 852 store_regs(cpu); 853 break; 854 } 855 case EXIT_REASON_CR_ACCESS: { 856 int cr; 857 int reg; 858 859 load_regs(cpu); 860 cr = exit_qual & 15; 861 reg = (exit_qual >> 8) & 15; 862 863 switch (cr) { 864 case 0x0: { 865 macvm_set_cr0(cpu->hvf_fd, RRX(env, reg)); 866 break; 867 } 868 case 4: { 869 macvm_set_cr4(cpu->hvf_fd, RRX(env, reg)); 870 break; 871 } 872 case 8: { 873 X86CPU *x86_cpu = X86_CPU(cpu); 874 if (exit_qual & 0x10) { 875 RRX(env, reg) = cpu_get_apic_tpr(x86_cpu->apic_state); 876 } else { 877 int tpr = RRX(env, reg); 878 cpu_set_apic_tpr(x86_cpu->apic_state, tpr); 879 ret = EXCP_INTERRUPT; 880 } 881 break; 882 } 883 default: 884 error_report("Unrecognized CR %d", cr); 885 abort(); 886 } 887 RIP(env) += ins_len; 888 store_regs(cpu); 889 break; 890 } 891 case EXIT_REASON_APIC_ACCESS: { /* TODO */ 892 struct x86_decode decode; 893 894 load_regs(cpu); 895 env->hvf_emul->fetch_rip = rip; 896 897 decode_instruction(env, &decode); 898 exec_instruction(env, &decode); 899 store_regs(cpu); 900 break; 901 } 902 case EXIT_REASON_TPR: { 903 ret = 1; 904 break; 905 } 906 case EXIT_REASON_TASK_SWITCH: { 907 uint64_t vinfo = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO); 908 x68_segment_selector sel = {.sel = exit_qual & 0xffff}; 909 vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3, 910 vinfo & VMCS_INTR_VALID, vinfo & VECTORING_INFO_VECTOR_MASK, vinfo 911 & VMCS_INTR_T_MASK); 912 break; 913 } 914 case EXIT_REASON_TRIPLE_FAULT: { 915 qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET); 916 ret = EXCP_INTERRUPT; 917 break; 918 } 919 case EXIT_REASON_RDPMC: 920 wreg(cpu->hvf_fd, HV_X86_RAX, 0); 921 wreg(cpu->hvf_fd, HV_X86_RDX, 0); 922 macvm_set_rip(cpu, rip + ins_len); 923 break; 924 case VMX_REASON_VMCALL: 925 env->exception_injected = EXCP0D_GPF; 926 env->has_error_code = true; 927 env->error_code = 0; 928 break; 929 default: 930 error_report("%llx: unhandled exit %llx", rip, exit_reason); 931 } 932 } while (ret == 0); 933 934 return ret; 935 } 936 937 static bool hvf_allowed; 938 939 static int hvf_accel_init(MachineState *ms) 940 { 941 int x; 942 hv_return_t ret; 943 HVFState *s; 944 945 hvf_disable(0); 946 ret = hv_vm_create(HV_VM_DEFAULT); 947 assert_hvf_ok(ret); 948 949 s = g_new0(HVFState, 1); 950 951 s->num_slots = 32; 952 for (x = 0; x < s->num_slots; ++x) { 953 s->slots[x].size = 0; 954 s->slots[x].slot_id = x; 955 } 956 957 hvf_state = s; 958 cpu_interrupt_handler = hvf_handle_interrupt; 959 memory_listener_register(&hvf_memory_listener, &address_space_memory); 960 return 0; 961 } 962 963 static void hvf_accel_class_init(ObjectClass *oc, void *data) 964 { 965 AccelClass *ac = ACCEL_CLASS(oc); 966 ac->name = "HVF"; 967 ac->init_machine = hvf_accel_init; 968 ac->allowed = &hvf_allowed; 969 } 970 971 static const TypeInfo hvf_accel_type = { 972 .name = TYPE_HVF_ACCEL, 973 .parent = TYPE_ACCEL, 974 .class_init = hvf_accel_class_init, 975 }; 976 977 static void hvf_type_init(void) 978 { 979 type_register_static(&hvf_accel_type); 980 } 981 982 type_init(hvf_type_init); 983