xref: /openbmc/qemu/target/i386/hvf/hvf.c (revision d5938f29fea29581725426f203a74da746ca03e7)
1 /* Copyright 2008 IBM Corporation
2  *           2008 Red Hat, Inc.
3  * Copyright 2011 Intel Corporation
4  * Copyright 2016 Veertu, Inc.
5  * Copyright 2017 The Android Open Source Project
6  *
7  * QEMU Hypervisor.framework support
8  *
9  * This program is free software; you can redistribute it and/or
10  * modify it under the terms of version 2 of the GNU General Public
11  * License as published by the Free Software Foundation.
12  *
13  * This program is distributed in the hope that it will be useful,
14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
16  * General Public License for more details.
17  *
18  * You should have received a copy of the GNU General Public License
19  * along with this program; if not, see <http://www.gnu.org/licenses/>.
20  *
21  * This file contain code under public domain from the hvdos project:
22  * https://github.com/mist64/hvdos
23  *
24  * Parts Copyright (c) 2011 NetApp, Inc.
25  * All rights reserved.
26  *
27  * Redistribution and use in source and binary forms, with or without
28  * modification, are permitted provided that the following conditions
29  * are met:
30  * 1. Redistributions of source code must retain the above copyright
31  *    notice, this list of conditions and the following disclaimer.
32  * 2. Redistributions in binary form must reproduce the above copyright
33  *    notice, this list of conditions and the following disclaimer in the
34  *    documentation and/or other materials provided with the distribution.
35  *
36  * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
37  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
38  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
39  * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
40  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
41  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
42  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
43  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
44  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
45  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
46  * SUCH DAMAGE.
47  */
48 #include "qemu/osdep.h"
49 #include "qemu-common.h"
50 #include "qemu/error-report.h"
51 
52 #include "sysemu/hvf.h"
53 #include "hvf-i386.h"
54 #include "vmcs.h"
55 #include "vmx.h"
56 #include "x86.h"
57 #include "x86_descr.h"
58 #include "x86_mmu.h"
59 #include "x86_decode.h"
60 #include "x86_emu.h"
61 #include "x86_task.h"
62 #include "x86hvf.h"
63 
64 #include <Hypervisor/hv.h>
65 #include <Hypervisor/hv_vmx.h>
66 
67 #include "exec/address-spaces.h"
68 #include "hw/i386/apic_internal.h"
69 #include "qemu/main-loop.h"
70 #include "sysemu/accel.h"
71 #include "sysemu/sysemu.h"
72 #include "target/i386/cpu.h"
73 
74 HVFState *hvf_state;
75 
76 static void assert_hvf_ok(hv_return_t ret)
77 {
78     if (ret == HV_SUCCESS) {
79         return;
80     }
81 
82     switch (ret) {
83     case HV_ERROR:
84         error_report("Error: HV_ERROR");
85         break;
86     case HV_BUSY:
87         error_report("Error: HV_BUSY");
88         break;
89     case HV_BAD_ARGUMENT:
90         error_report("Error: HV_BAD_ARGUMENT");
91         break;
92     case HV_NO_RESOURCES:
93         error_report("Error: HV_NO_RESOURCES");
94         break;
95     case HV_NO_DEVICE:
96         error_report("Error: HV_NO_DEVICE");
97         break;
98     case HV_UNSUPPORTED:
99         error_report("Error: HV_UNSUPPORTED");
100         break;
101     default:
102         error_report("Unknown Error");
103     }
104 
105     abort();
106 }
107 
108 /* Memory slots */
109 hvf_slot *hvf_find_overlap_slot(uint64_t start, uint64_t end)
110 {
111     hvf_slot *slot;
112     int x;
113     for (x = 0; x < hvf_state->num_slots; ++x) {
114         slot = &hvf_state->slots[x];
115         if (slot->size && start < (slot->start + slot->size) &&
116             end > slot->start) {
117             return slot;
118         }
119     }
120     return NULL;
121 }
122 
123 struct mac_slot {
124     int present;
125     uint64_t size;
126     uint64_t gpa_start;
127     uint64_t gva;
128 };
129 
130 struct mac_slot mac_slots[32];
131 #define ALIGN(x, y)  (((x) + (y) - 1) & ~((y) - 1))
132 
133 static int do_hvf_set_memory(hvf_slot *slot)
134 {
135     struct mac_slot *macslot;
136     hv_memory_flags_t flags;
137     hv_return_t ret;
138 
139     macslot = &mac_slots[slot->slot_id];
140 
141     if (macslot->present) {
142         if (macslot->size != slot->size) {
143             macslot->present = 0;
144             ret = hv_vm_unmap(macslot->gpa_start, macslot->size);
145             assert_hvf_ok(ret);
146         }
147     }
148 
149     if (!slot->size) {
150         return 0;
151     }
152 
153     flags = HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC;
154 
155     macslot->present = 1;
156     macslot->gpa_start = slot->start;
157     macslot->size = slot->size;
158     ret = hv_vm_map((hv_uvaddr_t)slot->mem, slot->start, slot->size, flags);
159     assert_hvf_ok(ret);
160     return 0;
161 }
162 
163 void hvf_set_phys_mem(MemoryRegionSection *section, bool add)
164 {
165     hvf_slot *mem;
166     MemoryRegion *area = section->mr;
167 
168     if (!memory_region_is_ram(area)) {
169         return;
170     }
171 
172     mem = hvf_find_overlap_slot(
173             section->offset_within_address_space,
174             section->offset_within_address_space + int128_get64(section->size));
175 
176     if (mem && add) {
177         if (mem->size == int128_get64(section->size) &&
178             mem->start == section->offset_within_address_space &&
179             mem->mem == (memory_region_get_ram_ptr(area) +
180             section->offset_within_region)) {
181             return; /* Same region was attempted to register, go away. */
182         }
183     }
184 
185     /* Region needs to be reset. set the size to 0 and remap it. */
186     if (mem) {
187         mem->size = 0;
188         if (do_hvf_set_memory(mem)) {
189             error_report("Failed to reset overlapping slot");
190             abort();
191         }
192     }
193 
194     if (!add) {
195         return;
196     }
197 
198     /* Now make a new slot. */
199     int x;
200 
201     for (x = 0; x < hvf_state->num_slots; ++x) {
202         mem = &hvf_state->slots[x];
203         if (!mem->size) {
204             break;
205         }
206     }
207 
208     if (x == hvf_state->num_slots) {
209         error_report("No free slots");
210         abort();
211     }
212 
213     mem->size = int128_get64(section->size);
214     mem->mem = memory_region_get_ram_ptr(area) + section->offset_within_region;
215     mem->start = section->offset_within_address_space;
216     mem->region = area;
217 
218     if (do_hvf_set_memory(mem)) {
219         error_report("Error registering new memory slot");
220         abort();
221     }
222 }
223 
224 void vmx_update_tpr(CPUState *cpu)
225 {
226     /* TODO: need integrate APIC handling */
227     X86CPU *x86_cpu = X86_CPU(cpu);
228     int tpr = cpu_get_apic_tpr(x86_cpu->apic_state) << 4;
229     int irr = apic_get_highest_priority_irr(x86_cpu->apic_state);
230 
231     wreg(cpu->hvf_fd, HV_X86_TPR, tpr);
232     if (irr == -1) {
233         wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0);
234     } else {
235         wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, (irr > tpr) ? tpr >> 4 :
236               irr >> 4);
237     }
238 }
239 
240 void update_apic_tpr(CPUState *cpu)
241 {
242     X86CPU *x86_cpu = X86_CPU(cpu);
243     int tpr = rreg(cpu->hvf_fd, HV_X86_TPR) >> 4;
244     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
245 }
246 
247 #define VECTORING_INFO_VECTOR_MASK     0xff
248 
249 static void hvf_handle_interrupt(CPUState * cpu, int mask)
250 {
251     cpu->interrupt_request |= mask;
252     if (!qemu_cpu_is_self(cpu)) {
253         qemu_cpu_kick(cpu);
254     }
255 }
256 
257 void hvf_handle_io(CPUArchState *env, uint16_t port, void *buffer,
258                   int direction, int size, int count)
259 {
260     int i;
261     uint8_t *ptr = buffer;
262 
263     for (i = 0; i < count; i++) {
264         address_space_rw(&address_space_io, port, MEMTXATTRS_UNSPECIFIED,
265                          ptr, size,
266                          direction);
267         ptr += size;
268     }
269 }
270 
271 /* TODO: synchronize vcpu state */
272 static void do_hvf_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
273 {
274     CPUState *cpu_state = cpu;
275     if (cpu_state->vcpu_dirty == 0) {
276         hvf_get_registers(cpu_state);
277     }
278 
279     cpu_state->vcpu_dirty = 1;
280 }
281 
282 void hvf_cpu_synchronize_state(CPUState *cpu_state)
283 {
284     if (cpu_state->vcpu_dirty == 0) {
285         run_on_cpu(cpu_state, do_hvf_cpu_synchronize_state, RUN_ON_CPU_NULL);
286     }
287 }
288 
289 static void do_hvf_cpu_synchronize_post_reset(CPUState *cpu, run_on_cpu_data arg)
290 {
291     CPUState *cpu_state = cpu;
292     hvf_put_registers(cpu_state);
293     cpu_state->vcpu_dirty = false;
294 }
295 
296 void hvf_cpu_synchronize_post_reset(CPUState *cpu_state)
297 {
298     run_on_cpu(cpu_state, do_hvf_cpu_synchronize_post_reset, RUN_ON_CPU_NULL);
299 }
300 
301 void _hvf_cpu_synchronize_post_init(CPUState *cpu, run_on_cpu_data arg)
302 {
303     CPUState *cpu_state = cpu;
304     hvf_put_registers(cpu_state);
305     cpu_state->vcpu_dirty = false;
306 }
307 
308 void hvf_cpu_synchronize_post_init(CPUState *cpu_state)
309 {
310     run_on_cpu(cpu_state, _hvf_cpu_synchronize_post_init, RUN_ON_CPU_NULL);
311 }
312 
313 static bool ept_emulation_fault(hvf_slot *slot, uint64_t gpa, uint64_t ept_qual)
314 {
315     int read, write;
316 
317     /* EPT fault on an instruction fetch doesn't make sense here */
318     if (ept_qual & EPT_VIOLATION_INST_FETCH) {
319         return false;
320     }
321 
322     /* EPT fault must be a read fault or a write fault */
323     read = ept_qual & EPT_VIOLATION_DATA_READ ? 1 : 0;
324     write = ept_qual & EPT_VIOLATION_DATA_WRITE ? 1 : 0;
325     if ((read | write) == 0) {
326         return false;
327     }
328 
329     if (write && slot) {
330         if (slot->flags & HVF_SLOT_LOG) {
331             memory_region_set_dirty(slot->region, gpa - slot->start, 1);
332             hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size,
333                           HV_MEMORY_READ | HV_MEMORY_WRITE);
334         }
335     }
336 
337     /*
338      * The EPT violation must have been caused by accessing a
339      * guest-physical address that is a translation of a guest-linear
340      * address.
341      */
342     if ((ept_qual & EPT_VIOLATION_GLA_VALID) == 0 ||
343         (ept_qual & EPT_VIOLATION_XLAT_VALID) == 0) {
344         return false;
345     }
346 
347     return !slot;
348 }
349 
350 static void hvf_set_dirty_tracking(MemoryRegionSection *section, bool on)
351 {
352     hvf_slot *slot;
353 
354     slot = hvf_find_overlap_slot(
355             section->offset_within_address_space,
356             section->offset_within_address_space + int128_get64(section->size));
357 
358     /* protect region against writes; begin tracking it */
359     if (on) {
360         slot->flags |= HVF_SLOT_LOG;
361         hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size,
362                       HV_MEMORY_READ);
363     /* stop tracking region*/
364     } else {
365         slot->flags &= ~HVF_SLOT_LOG;
366         hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size,
367                       HV_MEMORY_READ | HV_MEMORY_WRITE);
368     }
369 }
370 
371 static void hvf_log_start(MemoryListener *listener,
372                           MemoryRegionSection *section, int old, int new)
373 {
374     if (old != 0) {
375         return;
376     }
377 
378     hvf_set_dirty_tracking(section, 1);
379 }
380 
381 static void hvf_log_stop(MemoryListener *listener,
382                          MemoryRegionSection *section, int old, int new)
383 {
384     if (new != 0) {
385         return;
386     }
387 
388     hvf_set_dirty_tracking(section, 0);
389 }
390 
391 static void hvf_log_sync(MemoryListener *listener,
392                          MemoryRegionSection *section)
393 {
394     /*
395      * sync of dirty pages is handled elsewhere; just make sure we keep
396      * tracking the region.
397      */
398     hvf_set_dirty_tracking(section, 1);
399 }
400 
401 static void hvf_region_add(MemoryListener *listener,
402                            MemoryRegionSection *section)
403 {
404     hvf_set_phys_mem(section, true);
405 }
406 
407 static void hvf_region_del(MemoryListener *listener,
408                            MemoryRegionSection *section)
409 {
410     hvf_set_phys_mem(section, false);
411 }
412 
413 static MemoryListener hvf_memory_listener = {
414     .priority = 10,
415     .region_add = hvf_region_add,
416     .region_del = hvf_region_del,
417     .log_start = hvf_log_start,
418     .log_stop = hvf_log_stop,
419     .log_sync = hvf_log_sync,
420 };
421 
422 void hvf_reset_vcpu(CPUState *cpu) {
423 
424     /* TODO: this shouldn't be needed; there is already a call to
425      * cpu_synchronize_all_post_reset in vl.c
426      */
427     wvmcs(cpu->hvf_fd, VMCS_ENTRY_CTLS, 0);
428     wvmcs(cpu->hvf_fd, VMCS_GUEST_IA32_EFER, 0);
429     macvm_set_cr0(cpu->hvf_fd, 0x60000010);
430 
431     wvmcs(cpu->hvf_fd, VMCS_CR4_MASK, CR4_VMXE_MASK);
432     wvmcs(cpu->hvf_fd, VMCS_CR4_SHADOW, 0x0);
433     wvmcs(cpu->hvf_fd, VMCS_GUEST_CR4, CR4_VMXE_MASK);
434 
435     /* set VMCS guest state fields */
436     wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_SELECTOR, 0xf000);
437     wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_LIMIT, 0xffff);
438     wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_ACCESS_RIGHTS, 0x9b);
439     wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_BASE, 0xffff0000);
440 
441     wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_SELECTOR, 0);
442     wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_LIMIT, 0xffff);
443     wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_ACCESS_RIGHTS, 0x93);
444     wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_BASE, 0);
445 
446     wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_SELECTOR, 0);
447     wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_LIMIT, 0xffff);
448     wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_ACCESS_RIGHTS, 0x93);
449     wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_BASE, 0);
450 
451     wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_SELECTOR, 0);
452     wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_LIMIT, 0xffff);
453     wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_ACCESS_RIGHTS, 0x93);
454     wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_BASE, 0);
455 
456     wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_SELECTOR, 0);
457     wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_LIMIT, 0xffff);
458     wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_ACCESS_RIGHTS, 0x93);
459     wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_BASE, 0);
460 
461     wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_SELECTOR, 0);
462     wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_LIMIT, 0xffff);
463     wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_ACCESS_RIGHTS, 0x93);
464     wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_BASE, 0);
465 
466     wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_SELECTOR, 0);
467     wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_LIMIT, 0);
468     wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_ACCESS_RIGHTS, 0x10000);
469     wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_BASE, 0);
470 
471     wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_SELECTOR, 0);
472     wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_LIMIT, 0);
473     wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_ACCESS_RIGHTS, 0x83);
474     wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_BASE, 0);
475 
476     wvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_LIMIT, 0);
477     wvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_BASE, 0);
478 
479     wvmcs(cpu->hvf_fd, VMCS_GUEST_IDTR_LIMIT, 0);
480     wvmcs(cpu->hvf_fd, VMCS_GUEST_IDTR_BASE, 0);
481 
482     /*wvmcs(cpu->hvf_fd, VMCS_GUEST_CR2, 0x0);*/
483     wvmcs(cpu->hvf_fd, VMCS_GUEST_CR3, 0x0);
484 
485     wreg(cpu->hvf_fd, HV_X86_RIP, 0xfff0);
486     wreg(cpu->hvf_fd, HV_X86_RDX, 0x623);
487     wreg(cpu->hvf_fd, HV_X86_RFLAGS, 0x2);
488     wreg(cpu->hvf_fd, HV_X86_RSP, 0x0);
489     wreg(cpu->hvf_fd, HV_X86_RAX, 0x0);
490     wreg(cpu->hvf_fd, HV_X86_RBX, 0x0);
491     wreg(cpu->hvf_fd, HV_X86_RCX, 0x0);
492     wreg(cpu->hvf_fd, HV_X86_RSI, 0x0);
493     wreg(cpu->hvf_fd, HV_X86_RDI, 0x0);
494     wreg(cpu->hvf_fd, HV_X86_RBP, 0x0);
495 
496     for (int i = 0; i < 8; i++) {
497         wreg(cpu->hvf_fd, HV_X86_R8 + i, 0x0);
498     }
499 
500     hv_vm_sync_tsc(0);
501     hv_vcpu_invalidate_tlb(cpu->hvf_fd);
502     hv_vcpu_flush(cpu->hvf_fd);
503 }
504 
505 void hvf_vcpu_destroy(CPUState *cpu)
506 {
507     hv_return_t ret = hv_vcpu_destroy((hv_vcpuid_t)cpu->hvf_fd);
508     assert_hvf_ok(ret);
509 }
510 
511 static void dummy_signal(int sig)
512 {
513 }
514 
515 int hvf_init_vcpu(CPUState *cpu)
516 {
517 
518     X86CPU *x86cpu = X86_CPU(cpu);
519     CPUX86State *env = &x86cpu->env;
520     int r;
521 
522     /* init cpu signals */
523     sigset_t set;
524     struct sigaction sigact;
525 
526     memset(&sigact, 0, sizeof(sigact));
527     sigact.sa_handler = dummy_signal;
528     sigaction(SIG_IPI, &sigact, NULL);
529 
530     pthread_sigmask(SIG_BLOCK, NULL, &set);
531     sigdelset(&set, SIG_IPI);
532 
533     init_emu();
534     init_decoder();
535 
536     hvf_state->hvf_caps = g_new0(struct hvf_vcpu_caps, 1);
537     env->hvf_emul = g_new0(HVFX86EmulatorState, 1);
538 
539     r = hv_vcpu_create((hv_vcpuid_t *)&cpu->hvf_fd, HV_VCPU_DEFAULT);
540     cpu->vcpu_dirty = 1;
541     assert_hvf_ok(r);
542 
543     if (hv_vmx_read_capability(HV_VMX_CAP_PINBASED,
544         &hvf_state->hvf_caps->vmx_cap_pinbased)) {
545         abort();
546     }
547     if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED,
548         &hvf_state->hvf_caps->vmx_cap_procbased)) {
549         abort();
550     }
551     if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED2,
552         &hvf_state->hvf_caps->vmx_cap_procbased2)) {
553         abort();
554     }
555     if (hv_vmx_read_capability(HV_VMX_CAP_ENTRY,
556         &hvf_state->hvf_caps->vmx_cap_entry)) {
557         abort();
558     }
559 
560     /* set VMCS control fields */
561     wvmcs(cpu->hvf_fd, VMCS_PIN_BASED_CTLS,
562           cap2ctrl(hvf_state->hvf_caps->vmx_cap_pinbased,
563           VMCS_PIN_BASED_CTLS_EXTINT |
564           VMCS_PIN_BASED_CTLS_NMI |
565           VMCS_PIN_BASED_CTLS_VNMI));
566     wvmcs(cpu->hvf_fd, VMCS_PRI_PROC_BASED_CTLS,
567           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased,
568           VMCS_PRI_PROC_BASED_CTLS_HLT |
569           VMCS_PRI_PROC_BASED_CTLS_MWAIT |
570           VMCS_PRI_PROC_BASED_CTLS_TSC_OFFSET |
571           VMCS_PRI_PROC_BASED_CTLS_TPR_SHADOW) |
572           VMCS_PRI_PROC_BASED_CTLS_SEC_CONTROL);
573     wvmcs(cpu->hvf_fd, VMCS_SEC_PROC_BASED_CTLS,
574           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased2,
575                    VMCS_PRI_PROC_BASED2_CTLS_APIC_ACCESSES));
576 
577     wvmcs(cpu->hvf_fd, VMCS_ENTRY_CTLS, cap2ctrl(hvf_state->hvf_caps->vmx_cap_entry,
578           0));
579     wvmcs(cpu->hvf_fd, VMCS_EXCEPTION_BITMAP, 0); /* Double fault */
580 
581     wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0);
582 
583     x86cpu = X86_CPU(cpu);
584     x86cpu->env.xsave_buf = qemu_memalign(4096, 4096);
585 
586     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_STAR, 1);
587     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_LSTAR, 1);
588     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_CSTAR, 1);
589     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FMASK, 1);
590     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FSBASE, 1);
591     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_GSBASE, 1);
592     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_KERNELGSBASE, 1);
593     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_TSC_AUX, 1);
594     /*hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_TSC, 1);*/
595     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_CS, 1);
596     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_EIP, 1);
597     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_ESP, 1);
598 
599     return 0;
600 }
601 
602 static void hvf_store_events(CPUState *cpu, uint32_t ins_len, uint64_t idtvec_info)
603 {
604     X86CPU *x86_cpu = X86_CPU(cpu);
605     CPUX86State *env = &x86_cpu->env;
606 
607     env->exception_nr = -1;
608     env->exception_pending = 0;
609     env->exception_injected = 0;
610     env->interrupt_injected = -1;
611     env->nmi_injected = false;
612     if (idtvec_info & VMCS_IDT_VEC_VALID) {
613         switch (idtvec_info & VMCS_IDT_VEC_TYPE) {
614         case VMCS_IDT_VEC_HWINTR:
615         case VMCS_IDT_VEC_SWINTR:
616             env->interrupt_injected = idtvec_info & VMCS_IDT_VEC_VECNUM;
617             break;
618         case VMCS_IDT_VEC_NMI:
619             env->nmi_injected = true;
620             break;
621         case VMCS_IDT_VEC_HWEXCEPTION:
622         case VMCS_IDT_VEC_SWEXCEPTION:
623             env->exception_nr = idtvec_info & VMCS_IDT_VEC_VECNUM;
624             env->exception_injected = 1;
625             break;
626         case VMCS_IDT_VEC_PRIV_SWEXCEPTION:
627         default:
628             abort();
629         }
630         if ((idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWEXCEPTION ||
631             (idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWINTR) {
632             env->ins_len = ins_len;
633         }
634         if (idtvec_info & VMCS_INTR_DEL_ERRCODE) {
635             env->has_error_code = true;
636             env->error_code = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_ERROR);
637         }
638     }
639     if ((rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) &
640         VMCS_INTERRUPTIBILITY_NMI_BLOCKING)) {
641         env->hflags2 |= HF2_NMI_MASK;
642     } else {
643         env->hflags2 &= ~HF2_NMI_MASK;
644     }
645     if (rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) &
646          (VMCS_INTERRUPTIBILITY_STI_BLOCKING |
647          VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING)) {
648         env->hflags |= HF_INHIBIT_IRQ_MASK;
649     } else {
650         env->hflags &= ~HF_INHIBIT_IRQ_MASK;
651     }
652 }
653 
654 int hvf_vcpu_exec(CPUState *cpu)
655 {
656     X86CPU *x86_cpu = X86_CPU(cpu);
657     CPUX86State *env = &x86_cpu->env;
658     int ret = 0;
659     uint64_t rip = 0;
660 
661     if (hvf_process_events(cpu)) {
662         return EXCP_HLT;
663     }
664 
665     do {
666         if (cpu->vcpu_dirty) {
667             hvf_put_registers(cpu);
668             cpu->vcpu_dirty = false;
669         }
670 
671         if (hvf_inject_interrupts(cpu)) {
672             return EXCP_INTERRUPT;
673         }
674         vmx_update_tpr(cpu);
675 
676         qemu_mutex_unlock_iothread();
677         if (!cpu_is_bsp(X86_CPU(cpu)) && cpu->halted) {
678             qemu_mutex_lock_iothread();
679             return EXCP_HLT;
680         }
681 
682         hv_return_t r  = hv_vcpu_run(cpu->hvf_fd);
683         assert_hvf_ok(r);
684 
685         /* handle VMEXIT */
686         uint64_t exit_reason = rvmcs(cpu->hvf_fd, VMCS_EXIT_REASON);
687         uint64_t exit_qual = rvmcs(cpu->hvf_fd, VMCS_EXIT_QUALIFICATION);
688         uint32_t ins_len = (uint32_t)rvmcs(cpu->hvf_fd,
689                                            VMCS_EXIT_INSTRUCTION_LENGTH);
690 
691         uint64_t idtvec_info = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO);
692 
693         hvf_store_events(cpu, ins_len, idtvec_info);
694         rip = rreg(cpu->hvf_fd, HV_X86_RIP);
695         RFLAGS(env) = rreg(cpu->hvf_fd, HV_X86_RFLAGS);
696         env->eflags = RFLAGS(env);
697 
698         qemu_mutex_lock_iothread();
699 
700         update_apic_tpr(cpu);
701         current_cpu = cpu;
702 
703         ret = 0;
704         switch (exit_reason) {
705         case EXIT_REASON_HLT: {
706             macvm_set_rip(cpu, rip + ins_len);
707             if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) &&
708                 (EFLAGS(env) & IF_MASK))
709                 && !(cpu->interrupt_request & CPU_INTERRUPT_NMI) &&
710                 !(idtvec_info & VMCS_IDT_VEC_VALID)) {
711                 cpu->halted = 1;
712                 ret = EXCP_HLT;
713                 break;
714             }
715             ret = EXCP_INTERRUPT;
716             break;
717         }
718         case EXIT_REASON_MWAIT: {
719             ret = EXCP_INTERRUPT;
720             break;
721         }
722             /* Need to check if MMIO or unmmaped fault */
723         case EXIT_REASON_EPT_FAULT:
724         {
725             hvf_slot *slot;
726             uint64_t gpa = rvmcs(cpu->hvf_fd, VMCS_GUEST_PHYSICAL_ADDRESS);
727 
728             if (((idtvec_info & VMCS_IDT_VEC_VALID) == 0) &&
729                 ((exit_qual & EXIT_QUAL_NMIUDTI) != 0)) {
730                 vmx_set_nmi_blocking(cpu);
731             }
732 
733             slot = hvf_find_overlap_slot(gpa, gpa);
734             /* mmio */
735             if (ept_emulation_fault(slot, gpa, exit_qual)) {
736                 struct x86_decode decode;
737 
738                 load_regs(cpu);
739                 env->hvf_emul->fetch_rip = rip;
740 
741                 decode_instruction(env, &decode);
742                 exec_instruction(env, &decode);
743                 store_regs(cpu);
744                 break;
745             }
746             break;
747         }
748         case EXIT_REASON_INOUT:
749         {
750             uint32_t in = (exit_qual & 8) != 0;
751             uint32_t size =  (exit_qual & 7) + 1;
752             uint32_t string =  (exit_qual & 16) != 0;
753             uint32_t port =  exit_qual >> 16;
754             /*uint32_t rep = (exit_qual & 0x20) != 0;*/
755 
756             if (!string && in) {
757                 uint64_t val = 0;
758                 load_regs(cpu);
759                 hvf_handle_io(env, port, &val, 0, size, 1);
760                 if (size == 1) {
761                     AL(env) = val;
762                 } else if (size == 2) {
763                     AX(env) = val;
764                 } else if (size == 4) {
765                     RAX(env) = (uint32_t)val;
766                 } else {
767                     RAX(env) = (uint64_t)val;
768                 }
769                 RIP(env) += ins_len;
770                 store_regs(cpu);
771                 break;
772             } else if (!string && !in) {
773                 RAX(env) = rreg(cpu->hvf_fd, HV_X86_RAX);
774                 hvf_handle_io(env, port, &RAX(env), 1, size, 1);
775                 macvm_set_rip(cpu, rip + ins_len);
776                 break;
777             }
778             struct x86_decode decode;
779 
780             load_regs(cpu);
781             env->hvf_emul->fetch_rip = rip;
782 
783             decode_instruction(env, &decode);
784             assert(ins_len == decode.len);
785             exec_instruction(env, &decode);
786             store_regs(cpu);
787 
788             break;
789         }
790         case EXIT_REASON_CPUID: {
791             uint32_t rax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX);
792             uint32_t rbx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RBX);
793             uint32_t rcx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX);
794             uint32_t rdx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX);
795 
796             cpu_x86_cpuid(env, rax, rcx, &rax, &rbx, &rcx, &rdx);
797 
798             wreg(cpu->hvf_fd, HV_X86_RAX, rax);
799             wreg(cpu->hvf_fd, HV_X86_RBX, rbx);
800             wreg(cpu->hvf_fd, HV_X86_RCX, rcx);
801             wreg(cpu->hvf_fd, HV_X86_RDX, rdx);
802 
803             macvm_set_rip(cpu, rip + ins_len);
804             break;
805         }
806         case EXIT_REASON_XSETBV: {
807             X86CPU *x86_cpu = X86_CPU(cpu);
808             CPUX86State *env = &x86_cpu->env;
809             uint32_t eax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX);
810             uint32_t ecx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX);
811             uint32_t edx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX);
812 
813             if (ecx) {
814                 macvm_set_rip(cpu, rip + ins_len);
815                 break;
816             }
817             env->xcr0 = ((uint64_t)edx << 32) | eax;
818             wreg(cpu->hvf_fd, HV_X86_XCR0, env->xcr0 | 1);
819             macvm_set_rip(cpu, rip + ins_len);
820             break;
821         }
822         case EXIT_REASON_INTR_WINDOW:
823             vmx_clear_int_window_exiting(cpu);
824             ret = EXCP_INTERRUPT;
825             break;
826         case EXIT_REASON_NMI_WINDOW:
827             vmx_clear_nmi_window_exiting(cpu);
828             ret = EXCP_INTERRUPT;
829             break;
830         case EXIT_REASON_EXT_INTR:
831             /* force exit and allow io handling */
832             ret = EXCP_INTERRUPT;
833             break;
834         case EXIT_REASON_RDMSR:
835         case EXIT_REASON_WRMSR:
836         {
837             load_regs(cpu);
838             if (exit_reason == EXIT_REASON_RDMSR) {
839                 simulate_rdmsr(cpu);
840             } else {
841                 simulate_wrmsr(cpu);
842             }
843             RIP(env) += rvmcs(cpu->hvf_fd, VMCS_EXIT_INSTRUCTION_LENGTH);
844             store_regs(cpu);
845             break;
846         }
847         case EXIT_REASON_CR_ACCESS: {
848             int cr;
849             int reg;
850 
851             load_regs(cpu);
852             cr = exit_qual & 15;
853             reg = (exit_qual >> 8) & 15;
854 
855             switch (cr) {
856             case 0x0: {
857                 macvm_set_cr0(cpu->hvf_fd, RRX(env, reg));
858                 break;
859             }
860             case 4: {
861                 macvm_set_cr4(cpu->hvf_fd, RRX(env, reg));
862                 break;
863             }
864             case 8: {
865                 X86CPU *x86_cpu = X86_CPU(cpu);
866                 if (exit_qual & 0x10) {
867                     RRX(env, reg) = cpu_get_apic_tpr(x86_cpu->apic_state);
868                 } else {
869                     int tpr = RRX(env, reg);
870                     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
871                     ret = EXCP_INTERRUPT;
872                 }
873                 break;
874             }
875             default:
876                 error_report("Unrecognized CR %d", cr);
877                 abort();
878             }
879             RIP(env) += ins_len;
880             store_regs(cpu);
881             break;
882         }
883         case EXIT_REASON_APIC_ACCESS: { /* TODO */
884             struct x86_decode decode;
885 
886             load_regs(cpu);
887             env->hvf_emul->fetch_rip = rip;
888 
889             decode_instruction(env, &decode);
890             exec_instruction(env, &decode);
891             store_regs(cpu);
892             break;
893         }
894         case EXIT_REASON_TPR: {
895             ret = 1;
896             break;
897         }
898         case EXIT_REASON_TASK_SWITCH: {
899             uint64_t vinfo = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO);
900             x68_segment_selector sel = {.sel = exit_qual & 0xffff};
901             vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3,
902              vinfo & VMCS_INTR_VALID, vinfo & VECTORING_INFO_VECTOR_MASK, vinfo
903              & VMCS_INTR_T_MASK);
904             break;
905         }
906         case EXIT_REASON_TRIPLE_FAULT: {
907             qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
908             ret = EXCP_INTERRUPT;
909             break;
910         }
911         case EXIT_REASON_RDPMC:
912             wreg(cpu->hvf_fd, HV_X86_RAX, 0);
913             wreg(cpu->hvf_fd, HV_X86_RDX, 0);
914             macvm_set_rip(cpu, rip + ins_len);
915             break;
916         case VMX_REASON_VMCALL:
917             env->exception_nr = EXCP0D_GPF;
918             env->exception_injected = 1;
919             env->has_error_code = true;
920             env->error_code = 0;
921             break;
922         default:
923             error_report("%llx: unhandled exit %llx", rip, exit_reason);
924         }
925     } while (ret == 0);
926 
927     return ret;
928 }
929 
930 bool hvf_allowed;
931 
932 static int hvf_accel_init(MachineState *ms)
933 {
934     int x;
935     hv_return_t ret;
936     HVFState *s;
937 
938     ret = hv_vm_create(HV_VM_DEFAULT);
939     assert_hvf_ok(ret);
940 
941     s = g_new0(HVFState, 1);
942 
943     s->num_slots = 32;
944     for (x = 0; x < s->num_slots; ++x) {
945         s->slots[x].size = 0;
946         s->slots[x].slot_id = x;
947     }
948 
949     hvf_state = s;
950     cpu_interrupt_handler = hvf_handle_interrupt;
951     memory_listener_register(&hvf_memory_listener, &address_space_memory);
952     return 0;
953 }
954 
955 static void hvf_accel_class_init(ObjectClass *oc, void *data)
956 {
957     AccelClass *ac = ACCEL_CLASS(oc);
958     ac->name = "HVF";
959     ac->init_machine = hvf_accel_init;
960     ac->allowed = &hvf_allowed;
961 }
962 
963 static const TypeInfo hvf_accel_type = {
964     .name = TYPE_HVF_ACCEL,
965     .parent = TYPE_ACCEL,
966     .class_init = hvf_accel_class_init,
967 };
968 
969 static void hvf_type_init(void)
970 {
971     type_register_static(&hvf_accel_type);
972 }
973 
974 type_init(hvf_type_init);
975