1 /* Copyright 2008 IBM Corporation 2 * 2008 Red Hat, Inc. 3 * Copyright 2011 Intel Corporation 4 * Copyright 2016 Veertu, Inc. 5 * Copyright 2017 The Android Open Source Project 6 * 7 * QEMU Hypervisor.framework support 8 * 9 * This program is free software; you can redistribute it and/or 10 * modify it under the terms of version 2 of the GNU General Public 11 * License as published by the Free Software Foundation. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 16 * Lesser General Public License for more details. 17 * 18 * You should have received a copy of the GNU Lesser General Public 19 * License along with this program; if not, see <http://www.gnu.org/licenses/>. 20 * 21 * This file contain code under public domain from the hvdos project: 22 * https://github.com/mist64/hvdos 23 * 24 * Parts Copyright (c) 2011 NetApp, Inc. 25 * All rights reserved. 26 * 27 * Redistribution and use in source and binary forms, with or without 28 * modification, are permitted provided that the following conditions 29 * are met: 30 * 1. Redistributions of source code must retain the above copyright 31 * notice, this list of conditions and the following disclaimer. 32 * 2. Redistributions in binary form must reproduce the above copyright 33 * notice, this list of conditions and the following disclaimer in the 34 * documentation and/or other materials provided with the distribution. 35 * 36 * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND 37 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 38 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 39 * ARE DISCLAIMED. IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE 40 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 41 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 42 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 43 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 44 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 45 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 46 * SUCH DAMAGE. 47 */ 48 #include "qemu/osdep.h" 49 #include "qemu-common.h" 50 #include "qemu/error-report.h" 51 52 #include "sysemu/hvf.h" 53 #include "hvf-i386.h" 54 #include "vmcs.h" 55 #include "vmx.h" 56 #include "x86.h" 57 #include "x86_descr.h" 58 #include "x86_mmu.h" 59 #include "x86_decode.h" 60 #include "x86_emu.h" 61 #include "x86_task.h" 62 #include "x86hvf.h" 63 64 #include <Hypervisor/hv.h> 65 #include <Hypervisor/hv_vmx.h> 66 67 #include "exec/address-spaces.h" 68 #include "exec/exec-all.h" 69 #include "exec/ioport.h" 70 #include "hw/i386/apic_internal.h" 71 #include "hw/boards.h" 72 #include "qemu/main-loop.h" 73 #include "strings.h" 74 #include "sysemu/accel.h" 75 #include "sysemu/sysemu.h" 76 #include "target/i386/cpu.h" 77 78 pthread_rwlock_t mem_lock = PTHREAD_RWLOCK_INITIALIZER; 79 HVFState *hvf_state; 80 int hvf_disabled = 1; 81 82 static void assert_hvf_ok(hv_return_t ret) 83 { 84 if (ret == HV_SUCCESS) { 85 return; 86 } 87 88 switch (ret) { 89 case HV_ERROR: 90 error_report("Error: HV_ERROR\n"); 91 break; 92 case HV_BUSY: 93 error_report("Error: HV_BUSY\n"); 94 break; 95 case HV_BAD_ARGUMENT: 96 error_report("Error: HV_BAD_ARGUMENT\n"); 97 break; 98 case HV_NO_RESOURCES: 99 error_report("Error: HV_NO_RESOURCES\n"); 100 break; 101 case HV_NO_DEVICE: 102 error_report("Error: HV_NO_DEVICE\n"); 103 break; 104 case HV_UNSUPPORTED: 105 error_report("Error: HV_UNSUPPORTED\n"); 106 break; 107 default: 108 error_report("Unknown Error\n"); 109 } 110 111 abort(); 112 } 113 114 /* Memory slots */ 115 hvf_slot *hvf_find_overlap_slot(uint64_t start, uint64_t end) 116 { 117 hvf_slot *slot; 118 int x; 119 for (x = 0; x < hvf_state->num_slots; ++x) { 120 slot = &hvf_state->slots[x]; 121 if (slot->size && start < (slot->start + slot->size) && 122 end > slot->start) { 123 return slot; 124 } 125 } 126 return NULL; 127 } 128 129 struct mac_slot { 130 int present; 131 uint64_t size; 132 uint64_t gpa_start; 133 uint64_t gva; 134 }; 135 136 struct mac_slot mac_slots[32]; 137 #define ALIGN(x, y) (((x) + (y) - 1) & ~((y) - 1)) 138 139 static int do_hvf_set_memory(hvf_slot *slot) 140 { 141 struct mac_slot *macslot; 142 hv_memory_flags_t flags; 143 hv_return_t ret; 144 145 macslot = &mac_slots[slot->slot_id]; 146 147 if (macslot->present) { 148 if (macslot->size != slot->size) { 149 macslot->present = 0; 150 ret = hv_vm_unmap(macslot->gpa_start, macslot->size); 151 assert_hvf_ok(ret); 152 } 153 } 154 155 if (!slot->size) { 156 return 0; 157 } 158 159 flags = HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC; 160 161 macslot->present = 1; 162 macslot->gpa_start = slot->start; 163 macslot->size = slot->size; 164 ret = hv_vm_map((hv_uvaddr_t)slot->mem, slot->start, slot->size, flags); 165 assert_hvf_ok(ret); 166 return 0; 167 } 168 169 void hvf_set_phys_mem(MemoryRegionSection *section, bool add) 170 { 171 hvf_slot *mem; 172 MemoryRegion *area = section->mr; 173 174 if (!memory_region_is_ram(area)) { 175 return; 176 } 177 178 mem = hvf_find_overlap_slot( 179 section->offset_within_address_space, 180 section->offset_within_address_space + int128_get64(section->size)); 181 182 if (mem && add) { 183 if (mem->size == int128_get64(section->size) && 184 mem->start == section->offset_within_address_space && 185 mem->mem == (memory_region_get_ram_ptr(area) + 186 section->offset_within_region)) { 187 return; /* Same region was attempted to register, go away. */ 188 } 189 } 190 191 /* Region needs to be reset. set the size to 0 and remap it. */ 192 if (mem) { 193 mem->size = 0; 194 if (do_hvf_set_memory(mem)) { 195 error_report("Failed to reset overlapping slot\n"); 196 abort(); 197 } 198 } 199 200 if (!add) { 201 return; 202 } 203 204 /* Now make a new slot. */ 205 int x; 206 207 for (x = 0; x < hvf_state->num_slots; ++x) { 208 mem = &hvf_state->slots[x]; 209 if (!mem->size) { 210 break; 211 } 212 } 213 214 if (x == hvf_state->num_slots) { 215 error_report("No free slots\n"); 216 abort(); 217 } 218 219 mem->size = int128_get64(section->size); 220 mem->mem = memory_region_get_ram_ptr(area) + section->offset_within_region; 221 mem->start = section->offset_within_address_space; 222 mem->region = area; 223 224 if (do_hvf_set_memory(mem)) { 225 error_report("Error registering new memory slot\n"); 226 abort(); 227 } 228 } 229 230 void vmx_update_tpr(CPUState *cpu) 231 { 232 /* TODO: need integrate APIC handling */ 233 X86CPU *x86_cpu = X86_CPU(cpu); 234 int tpr = cpu_get_apic_tpr(x86_cpu->apic_state) << 4; 235 int irr = apic_get_highest_priority_irr(x86_cpu->apic_state); 236 237 wreg(cpu->hvf_fd, HV_X86_TPR, tpr); 238 if (irr == -1) { 239 wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0); 240 } else { 241 wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, (irr > tpr) ? tpr >> 4 : 242 irr >> 4); 243 } 244 } 245 246 void update_apic_tpr(CPUState *cpu) 247 { 248 X86CPU *x86_cpu = X86_CPU(cpu); 249 int tpr = rreg(cpu->hvf_fd, HV_X86_TPR) >> 4; 250 cpu_set_apic_tpr(x86_cpu->apic_state, tpr); 251 } 252 253 #define VECTORING_INFO_VECTOR_MASK 0xff 254 255 static void hvf_handle_interrupt(CPUState * cpu, int mask) 256 { 257 cpu->interrupt_request |= mask; 258 if (!qemu_cpu_is_self(cpu)) { 259 qemu_cpu_kick(cpu); 260 } 261 } 262 263 void hvf_handle_io(CPUArchState *env, uint16_t port, void *buffer, 264 int direction, int size, int count) 265 { 266 int i; 267 uint8_t *ptr = buffer; 268 269 for (i = 0; i < count; i++) { 270 address_space_rw(&address_space_io, port, MEMTXATTRS_UNSPECIFIED, 271 ptr, size, 272 direction); 273 ptr += size; 274 } 275 } 276 277 /* TODO: synchronize vcpu state */ 278 static void do_hvf_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg) 279 { 280 CPUState *cpu_state = cpu; 281 if (cpu_state->vcpu_dirty == 0) { 282 hvf_get_registers(cpu_state); 283 } 284 285 cpu_state->vcpu_dirty = 1; 286 } 287 288 void hvf_cpu_synchronize_state(CPUState *cpu_state) 289 { 290 if (cpu_state->vcpu_dirty == 0) { 291 run_on_cpu(cpu_state, do_hvf_cpu_synchronize_state, RUN_ON_CPU_NULL); 292 } 293 } 294 295 static void do_hvf_cpu_synchronize_post_reset(CPUState *cpu, run_on_cpu_data arg) 296 { 297 CPUState *cpu_state = cpu; 298 hvf_put_registers(cpu_state); 299 cpu_state->vcpu_dirty = false; 300 } 301 302 void hvf_cpu_synchronize_post_reset(CPUState *cpu_state) 303 { 304 run_on_cpu(cpu_state, do_hvf_cpu_synchronize_post_reset, RUN_ON_CPU_NULL); 305 } 306 307 void _hvf_cpu_synchronize_post_init(CPUState *cpu, run_on_cpu_data arg) 308 { 309 CPUState *cpu_state = cpu; 310 hvf_put_registers(cpu_state); 311 cpu_state->vcpu_dirty = false; 312 } 313 314 void hvf_cpu_synchronize_post_init(CPUState *cpu_state) 315 { 316 run_on_cpu(cpu_state, _hvf_cpu_synchronize_post_init, RUN_ON_CPU_NULL); 317 } 318 319 static bool ept_emulation_fault(hvf_slot *slot, uint64_t gpa, uint64_t ept_qual) 320 { 321 int read, write; 322 323 /* EPT fault on an instruction fetch doesn't make sense here */ 324 if (ept_qual & EPT_VIOLATION_INST_FETCH) { 325 return false; 326 } 327 328 /* EPT fault must be a read fault or a write fault */ 329 read = ept_qual & EPT_VIOLATION_DATA_READ ? 1 : 0; 330 write = ept_qual & EPT_VIOLATION_DATA_WRITE ? 1 : 0; 331 if ((read | write) == 0) { 332 return false; 333 } 334 335 if (write && slot) { 336 if (slot->flags & HVF_SLOT_LOG) { 337 memory_region_set_dirty(slot->region, gpa - slot->start, 1); 338 hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size, 339 HV_MEMORY_READ | HV_MEMORY_WRITE); 340 } 341 } 342 343 /* 344 * The EPT violation must have been caused by accessing a 345 * guest-physical address that is a translation of a guest-linear 346 * address. 347 */ 348 if ((ept_qual & EPT_VIOLATION_GLA_VALID) == 0 || 349 (ept_qual & EPT_VIOLATION_XLAT_VALID) == 0) { 350 return false; 351 } 352 353 return !slot; 354 } 355 356 static void hvf_set_dirty_tracking(MemoryRegionSection *section, bool on) 357 { 358 hvf_slot *slot; 359 360 slot = hvf_find_overlap_slot( 361 section->offset_within_address_space, 362 section->offset_within_address_space + int128_get64(section->size)); 363 364 /* protect region against writes; begin tracking it */ 365 if (on) { 366 slot->flags |= HVF_SLOT_LOG; 367 hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size, 368 HV_MEMORY_READ); 369 /* stop tracking region*/ 370 } else { 371 slot->flags &= ~HVF_SLOT_LOG; 372 hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size, 373 HV_MEMORY_READ | HV_MEMORY_WRITE); 374 } 375 } 376 377 static void hvf_log_start(MemoryListener *listener, 378 MemoryRegionSection *section, int old, int new) 379 { 380 if (old != 0) { 381 return; 382 } 383 384 hvf_set_dirty_tracking(section, 1); 385 } 386 387 static void hvf_log_stop(MemoryListener *listener, 388 MemoryRegionSection *section, int old, int new) 389 { 390 if (new != 0) { 391 return; 392 } 393 394 hvf_set_dirty_tracking(section, 0); 395 } 396 397 static void hvf_log_sync(MemoryListener *listener, 398 MemoryRegionSection *section) 399 { 400 /* 401 * sync of dirty pages is handled elsewhere; just make sure we keep 402 * tracking the region. 403 */ 404 hvf_set_dirty_tracking(section, 1); 405 } 406 407 static void hvf_region_add(MemoryListener *listener, 408 MemoryRegionSection *section) 409 { 410 hvf_set_phys_mem(section, true); 411 } 412 413 static void hvf_region_del(MemoryListener *listener, 414 MemoryRegionSection *section) 415 { 416 hvf_set_phys_mem(section, false); 417 } 418 419 static MemoryListener hvf_memory_listener = { 420 .priority = 10, 421 .region_add = hvf_region_add, 422 .region_del = hvf_region_del, 423 .log_start = hvf_log_start, 424 .log_stop = hvf_log_stop, 425 .log_sync = hvf_log_sync, 426 }; 427 428 void hvf_reset_vcpu(CPUState *cpu) { 429 430 /* TODO: this shouldn't be needed; there is already a call to 431 * cpu_synchronize_all_post_reset in vl.c 432 */ 433 wvmcs(cpu->hvf_fd, VMCS_ENTRY_CTLS, 0); 434 wvmcs(cpu->hvf_fd, VMCS_GUEST_IA32_EFER, 0); 435 macvm_set_cr0(cpu->hvf_fd, 0x60000010); 436 437 wvmcs(cpu->hvf_fd, VMCS_CR4_MASK, CR4_VMXE_MASK); 438 wvmcs(cpu->hvf_fd, VMCS_CR4_SHADOW, 0x0); 439 wvmcs(cpu->hvf_fd, VMCS_GUEST_CR4, CR4_VMXE_MASK); 440 441 /* set VMCS guest state fields */ 442 wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_SELECTOR, 0xf000); 443 wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_LIMIT, 0xffff); 444 wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_ACCESS_RIGHTS, 0x9b); 445 wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_BASE, 0xffff0000); 446 447 wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_SELECTOR, 0); 448 wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_LIMIT, 0xffff); 449 wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_ACCESS_RIGHTS, 0x93); 450 wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_BASE, 0); 451 452 wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_SELECTOR, 0); 453 wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_LIMIT, 0xffff); 454 wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_ACCESS_RIGHTS, 0x93); 455 wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_BASE, 0); 456 457 wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_SELECTOR, 0); 458 wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_LIMIT, 0xffff); 459 wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_ACCESS_RIGHTS, 0x93); 460 wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_BASE, 0); 461 462 wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_SELECTOR, 0); 463 wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_LIMIT, 0xffff); 464 wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_ACCESS_RIGHTS, 0x93); 465 wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_BASE, 0); 466 467 wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_SELECTOR, 0); 468 wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_LIMIT, 0xffff); 469 wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_ACCESS_RIGHTS, 0x93); 470 wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_BASE, 0); 471 472 wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_SELECTOR, 0); 473 wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_LIMIT, 0); 474 wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_ACCESS_RIGHTS, 0x10000); 475 wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_BASE, 0); 476 477 wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_SELECTOR, 0); 478 wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_LIMIT, 0); 479 wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_ACCESS_RIGHTS, 0x83); 480 wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_BASE, 0); 481 482 wvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_LIMIT, 0); 483 wvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_BASE, 0); 484 485 wvmcs(cpu->hvf_fd, VMCS_GUEST_IDTR_LIMIT, 0); 486 wvmcs(cpu->hvf_fd, VMCS_GUEST_IDTR_BASE, 0); 487 488 /*wvmcs(cpu->hvf_fd, VMCS_GUEST_CR2, 0x0);*/ 489 wvmcs(cpu->hvf_fd, VMCS_GUEST_CR3, 0x0); 490 491 wreg(cpu->hvf_fd, HV_X86_RIP, 0xfff0); 492 wreg(cpu->hvf_fd, HV_X86_RDX, 0x623); 493 wreg(cpu->hvf_fd, HV_X86_RFLAGS, 0x2); 494 wreg(cpu->hvf_fd, HV_X86_RSP, 0x0); 495 wreg(cpu->hvf_fd, HV_X86_RAX, 0x0); 496 wreg(cpu->hvf_fd, HV_X86_RBX, 0x0); 497 wreg(cpu->hvf_fd, HV_X86_RCX, 0x0); 498 wreg(cpu->hvf_fd, HV_X86_RSI, 0x0); 499 wreg(cpu->hvf_fd, HV_X86_RDI, 0x0); 500 wreg(cpu->hvf_fd, HV_X86_RBP, 0x0); 501 502 for (int i = 0; i < 8; i++) { 503 wreg(cpu->hvf_fd, HV_X86_R8 + i, 0x0); 504 } 505 506 hv_vm_sync_tsc(0); 507 cpu->halted = 0; 508 hv_vcpu_invalidate_tlb(cpu->hvf_fd); 509 hv_vcpu_flush(cpu->hvf_fd); 510 } 511 512 void hvf_vcpu_destroy(CPUState *cpu) 513 { 514 hv_return_t ret = hv_vcpu_destroy((hv_vcpuid_t)cpu->hvf_fd); 515 assert_hvf_ok(ret); 516 } 517 518 static void dummy_signal(int sig) 519 { 520 } 521 522 int hvf_init_vcpu(CPUState *cpu) 523 { 524 525 X86CPU *x86cpu = X86_CPU(cpu); 526 CPUX86State *env = &x86cpu->env; 527 int r; 528 529 /* init cpu signals */ 530 sigset_t set; 531 struct sigaction sigact; 532 533 memset(&sigact, 0, sizeof(sigact)); 534 sigact.sa_handler = dummy_signal; 535 sigaction(SIG_IPI, &sigact, NULL); 536 537 pthread_sigmask(SIG_BLOCK, NULL, &set); 538 sigdelset(&set, SIG_IPI); 539 540 init_emu(); 541 init_decoder(); 542 543 hvf_state->hvf_caps = g_new0(struct hvf_vcpu_caps, 1); 544 env->hvf_emul = g_new0(HVFX86EmulatorState, 1); 545 546 r = hv_vcpu_create((hv_vcpuid_t *)&cpu->hvf_fd, HV_VCPU_DEFAULT); 547 cpu->vcpu_dirty = 1; 548 assert_hvf_ok(r); 549 550 if (hv_vmx_read_capability(HV_VMX_CAP_PINBASED, 551 &hvf_state->hvf_caps->vmx_cap_pinbased)) { 552 abort(); 553 } 554 if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED, 555 &hvf_state->hvf_caps->vmx_cap_procbased)) { 556 abort(); 557 } 558 if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED2, 559 &hvf_state->hvf_caps->vmx_cap_procbased2)) { 560 abort(); 561 } 562 if (hv_vmx_read_capability(HV_VMX_CAP_ENTRY, 563 &hvf_state->hvf_caps->vmx_cap_entry)) { 564 abort(); 565 } 566 567 /* set VMCS control fields */ 568 wvmcs(cpu->hvf_fd, VMCS_PIN_BASED_CTLS, 569 cap2ctrl(hvf_state->hvf_caps->vmx_cap_pinbased, 570 VMCS_PIN_BASED_CTLS_EXTINT | 571 VMCS_PIN_BASED_CTLS_NMI | 572 VMCS_PIN_BASED_CTLS_VNMI)); 573 wvmcs(cpu->hvf_fd, VMCS_PRI_PROC_BASED_CTLS, 574 cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased, 575 VMCS_PRI_PROC_BASED_CTLS_HLT | 576 VMCS_PRI_PROC_BASED_CTLS_MWAIT | 577 VMCS_PRI_PROC_BASED_CTLS_TSC_OFFSET | 578 VMCS_PRI_PROC_BASED_CTLS_TPR_SHADOW) | 579 VMCS_PRI_PROC_BASED_CTLS_SEC_CONTROL); 580 wvmcs(cpu->hvf_fd, VMCS_SEC_PROC_BASED_CTLS, 581 cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased2, 582 VMCS_PRI_PROC_BASED2_CTLS_APIC_ACCESSES)); 583 584 wvmcs(cpu->hvf_fd, VMCS_ENTRY_CTLS, cap2ctrl(hvf_state->hvf_caps->vmx_cap_entry, 585 0)); 586 wvmcs(cpu->hvf_fd, VMCS_EXCEPTION_BITMAP, 0); /* Double fault */ 587 588 wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0); 589 590 hvf_reset_vcpu(cpu); 591 592 x86cpu = X86_CPU(cpu); 593 x86cpu->env.kvm_xsave_buf = qemu_memalign(4096, 4096); 594 595 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_STAR, 1); 596 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_LSTAR, 1); 597 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_CSTAR, 1); 598 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FMASK, 1); 599 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FSBASE, 1); 600 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_GSBASE, 1); 601 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_KERNELGSBASE, 1); 602 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_TSC_AUX, 1); 603 /*hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_TSC, 1);*/ 604 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_CS, 1); 605 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_EIP, 1); 606 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_ESP, 1); 607 608 return 0; 609 } 610 611 void hvf_disable(int shouldDisable) 612 { 613 hvf_disabled = shouldDisable; 614 } 615 616 static void hvf_store_events(CPUState *cpu, uint32_t ins_len, uint64_t idtvec_info) 617 { 618 X86CPU *x86_cpu = X86_CPU(cpu); 619 CPUX86State *env = &x86_cpu->env; 620 621 env->exception_injected = -1; 622 env->interrupt_injected = -1; 623 env->nmi_injected = false; 624 if (idtvec_info & VMCS_IDT_VEC_VALID) { 625 switch (idtvec_info & VMCS_IDT_VEC_TYPE) { 626 case VMCS_IDT_VEC_HWINTR: 627 case VMCS_IDT_VEC_SWINTR: 628 env->interrupt_injected = idtvec_info & VMCS_IDT_VEC_VECNUM; 629 break; 630 case VMCS_IDT_VEC_NMI: 631 env->nmi_injected = true; 632 break; 633 case VMCS_IDT_VEC_HWEXCEPTION: 634 case VMCS_IDT_VEC_SWEXCEPTION: 635 env->exception_injected = idtvec_info & VMCS_IDT_VEC_VECNUM; 636 break; 637 case VMCS_IDT_VEC_PRIV_SWEXCEPTION: 638 default: 639 abort(); 640 } 641 if ((idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWEXCEPTION || 642 (idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWINTR) { 643 env->ins_len = ins_len; 644 } 645 if (idtvec_info & VMCS_INTR_DEL_ERRCODE) { 646 env->has_error_code = true; 647 env->error_code = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_ERROR); 648 } 649 } 650 if ((rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) & 651 VMCS_INTERRUPTIBILITY_NMI_BLOCKING)) { 652 env->hflags2 |= HF2_NMI_MASK; 653 } else { 654 env->hflags2 &= ~HF2_NMI_MASK; 655 } 656 if (rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) & 657 (VMCS_INTERRUPTIBILITY_STI_BLOCKING | 658 VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING)) { 659 env->hflags |= HF_INHIBIT_IRQ_MASK; 660 } else { 661 env->hflags &= ~HF_INHIBIT_IRQ_MASK; 662 } 663 } 664 665 int hvf_vcpu_exec(CPUState *cpu) 666 { 667 X86CPU *x86_cpu = X86_CPU(cpu); 668 CPUX86State *env = &x86_cpu->env; 669 int ret = 0; 670 uint64_t rip = 0; 671 672 cpu->halted = 0; 673 674 if (hvf_process_events(cpu)) { 675 return EXCP_HLT; 676 } 677 678 do { 679 if (cpu->vcpu_dirty) { 680 hvf_put_registers(cpu); 681 cpu->vcpu_dirty = false; 682 } 683 684 if (hvf_inject_interrupts(cpu)) { 685 return EXCP_INTERRUPT; 686 } 687 vmx_update_tpr(cpu); 688 689 qemu_mutex_unlock_iothread(); 690 if (!cpu_is_bsp(X86_CPU(cpu)) && cpu->halted) { 691 qemu_mutex_lock_iothread(); 692 return EXCP_HLT; 693 } 694 695 hv_return_t r = hv_vcpu_run(cpu->hvf_fd); 696 assert_hvf_ok(r); 697 698 /* handle VMEXIT */ 699 uint64_t exit_reason = rvmcs(cpu->hvf_fd, VMCS_EXIT_REASON); 700 uint64_t exit_qual = rvmcs(cpu->hvf_fd, VMCS_EXIT_QUALIFICATION); 701 uint32_t ins_len = (uint32_t)rvmcs(cpu->hvf_fd, 702 VMCS_EXIT_INSTRUCTION_LENGTH); 703 704 uint64_t idtvec_info = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO); 705 706 hvf_store_events(cpu, ins_len, idtvec_info); 707 rip = rreg(cpu->hvf_fd, HV_X86_RIP); 708 RFLAGS(env) = rreg(cpu->hvf_fd, HV_X86_RFLAGS); 709 env->eflags = RFLAGS(env); 710 711 qemu_mutex_lock_iothread(); 712 713 update_apic_tpr(cpu); 714 current_cpu = cpu; 715 716 ret = 0; 717 switch (exit_reason) { 718 case EXIT_REASON_HLT: { 719 macvm_set_rip(cpu, rip + ins_len); 720 if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) && 721 (EFLAGS(env) & IF_MASK)) 722 && !(cpu->interrupt_request & CPU_INTERRUPT_NMI) && 723 !(idtvec_info & VMCS_IDT_VEC_VALID)) { 724 cpu->halted = 1; 725 ret = EXCP_HLT; 726 } 727 ret = EXCP_INTERRUPT; 728 break; 729 } 730 case EXIT_REASON_MWAIT: { 731 ret = EXCP_INTERRUPT; 732 break; 733 } 734 /* Need to check if MMIO or unmmaped fault */ 735 case EXIT_REASON_EPT_FAULT: 736 { 737 hvf_slot *slot; 738 uint64_t gpa = rvmcs(cpu->hvf_fd, VMCS_GUEST_PHYSICAL_ADDRESS); 739 740 if (((idtvec_info & VMCS_IDT_VEC_VALID) == 0) && 741 ((exit_qual & EXIT_QUAL_NMIUDTI) != 0)) { 742 vmx_set_nmi_blocking(cpu); 743 } 744 745 slot = hvf_find_overlap_slot(gpa, gpa); 746 /* mmio */ 747 if (ept_emulation_fault(slot, gpa, exit_qual)) { 748 struct x86_decode decode; 749 750 load_regs(cpu); 751 env->hvf_emul->fetch_rip = rip; 752 753 decode_instruction(env, &decode); 754 exec_instruction(env, &decode); 755 store_regs(cpu); 756 break; 757 } 758 break; 759 } 760 case EXIT_REASON_INOUT: 761 { 762 uint32_t in = (exit_qual & 8) != 0; 763 uint32_t size = (exit_qual & 7) + 1; 764 uint32_t string = (exit_qual & 16) != 0; 765 uint32_t port = exit_qual >> 16; 766 /*uint32_t rep = (exit_qual & 0x20) != 0;*/ 767 768 if (!string && in) { 769 uint64_t val = 0; 770 load_regs(cpu); 771 hvf_handle_io(env, port, &val, 0, size, 1); 772 if (size == 1) { 773 AL(env) = val; 774 } else if (size == 2) { 775 AX(env) = val; 776 } else if (size == 4) { 777 RAX(env) = (uint32_t)val; 778 } else { 779 RAX(env) = (uint64_t)val; 780 } 781 RIP(env) += ins_len; 782 store_regs(cpu); 783 break; 784 } else if (!string && !in) { 785 RAX(env) = rreg(cpu->hvf_fd, HV_X86_RAX); 786 hvf_handle_io(env, port, &RAX(env), 1, size, 1); 787 macvm_set_rip(cpu, rip + ins_len); 788 break; 789 } 790 struct x86_decode decode; 791 792 load_regs(cpu); 793 env->hvf_emul->fetch_rip = rip; 794 795 decode_instruction(env, &decode); 796 assert(ins_len == decode.len); 797 exec_instruction(env, &decode); 798 store_regs(cpu); 799 800 break; 801 } 802 case EXIT_REASON_CPUID: { 803 uint32_t rax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX); 804 uint32_t rbx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RBX); 805 uint32_t rcx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX); 806 uint32_t rdx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX); 807 808 cpu_x86_cpuid(env, rax, rcx, &rax, &rbx, &rcx, &rdx); 809 810 wreg(cpu->hvf_fd, HV_X86_RAX, rax); 811 wreg(cpu->hvf_fd, HV_X86_RBX, rbx); 812 wreg(cpu->hvf_fd, HV_X86_RCX, rcx); 813 wreg(cpu->hvf_fd, HV_X86_RDX, rdx); 814 815 macvm_set_rip(cpu, rip + ins_len); 816 break; 817 } 818 case EXIT_REASON_XSETBV: { 819 X86CPU *x86_cpu = X86_CPU(cpu); 820 CPUX86State *env = &x86_cpu->env; 821 uint32_t eax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX); 822 uint32_t ecx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX); 823 uint32_t edx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX); 824 825 if (ecx) { 826 macvm_set_rip(cpu, rip + ins_len); 827 break; 828 } 829 env->xcr0 = ((uint64_t)edx << 32) | eax; 830 wreg(cpu->hvf_fd, HV_X86_XCR0, env->xcr0 | 1); 831 macvm_set_rip(cpu, rip + ins_len); 832 break; 833 } 834 case EXIT_REASON_INTR_WINDOW: 835 vmx_clear_int_window_exiting(cpu); 836 ret = EXCP_INTERRUPT; 837 break; 838 case EXIT_REASON_NMI_WINDOW: 839 vmx_clear_nmi_window_exiting(cpu); 840 ret = EXCP_INTERRUPT; 841 break; 842 case EXIT_REASON_EXT_INTR: 843 /* force exit and allow io handling */ 844 ret = EXCP_INTERRUPT; 845 break; 846 case EXIT_REASON_RDMSR: 847 case EXIT_REASON_WRMSR: 848 { 849 load_regs(cpu); 850 if (exit_reason == EXIT_REASON_RDMSR) { 851 simulate_rdmsr(cpu); 852 } else { 853 simulate_wrmsr(cpu); 854 } 855 RIP(env) += rvmcs(cpu->hvf_fd, VMCS_EXIT_INSTRUCTION_LENGTH); 856 store_regs(cpu); 857 break; 858 } 859 case EXIT_REASON_CR_ACCESS: { 860 int cr; 861 int reg; 862 863 load_regs(cpu); 864 cr = exit_qual & 15; 865 reg = (exit_qual >> 8) & 15; 866 867 switch (cr) { 868 case 0x0: { 869 macvm_set_cr0(cpu->hvf_fd, RRX(env, reg)); 870 break; 871 } 872 case 4: { 873 macvm_set_cr4(cpu->hvf_fd, RRX(env, reg)); 874 break; 875 } 876 case 8: { 877 X86CPU *x86_cpu = X86_CPU(cpu); 878 if (exit_qual & 0x10) { 879 RRX(env, reg) = cpu_get_apic_tpr(x86_cpu->apic_state); 880 } else { 881 int tpr = RRX(env, reg); 882 cpu_set_apic_tpr(x86_cpu->apic_state, tpr); 883 ret = EXCP_INTERRUPT; 884 } 885 break; 886 } 887 default: 888 error_report("Unrecognized CR %d\n", cr); 889 abort(); 890 } 891 RIP(env) += ins_len; 892 store_regs(cpu); 893 break; 894 } 895 case EXIT_REASON_APIC_ACCESS: { /* TODO */ 896 struct x86_decode decode; 897 898 load_regs(cpu); 899 env->hvf_emul->fetch_rip = rip; 900 901 decode_instruction(env, &decode); 902 exec_instruction(env, &decode); 903 store_regs(cpu); 904 break; 905 } 906 case EXIT_REASON_TPR: { 907 ret = 1; 908 break; 909 } 910 case EXIT_REASON_TASK_SWITCH: { 911 uint64_t vinfo = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO); 912 x68_segment_selector sel = {.sel = exit_qual & 0xffff}; 913 vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3, 914 vinfo & VMCS_INTR_VALID, vinfo & VECTORING_INFO_VECTOR_MASK, vinfo 915 & VMCS_INTR_T_MASK); 916 break; 917 } 918 case EXIT_REASON_TRIPLE_FAULT: { 919 qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET); 920 ret = EXCP_INTERRUPT; 921 break; 922 } 923 case EXIT_REASON_RDPMC: 924 wreg(cpu->hvf_fd, HV_X86_RAX, 0); 925 wreg(cpu->hvf_fd, HV_X86_RDX, 0); 926 macvm_set_rip(cpu, rip + ins_len); 927 break; 928 case VMX_REASON_VMCALL: 929 env->exception_injected = EXCP0D_GPF; 930 env->has_error_code = true; 931 env->error_code = 0; 932 break; 933 default: 934 error_report("%llx: unhandled exit %llx\n", rip, exit_reason); 935 } 936 } while (ret == 0); 937 938 return ret; 939 } 940 941 static bool hvf_allowed; 942 943 static int hvf_accel_init(MachineState *ms) 944 { 945 int x; 946 hv_return_t ret; 947 HVFState *s; 948 949 hvf_disable(0); 950 ret = hv_vm_create(HV_VM_DEFAULT); 951 assert_hvf_ok(ret); 952 953 s = g_new0(HVFState, 1); 954 955 s->num_slots = 32; 956 for (x = 0; x < s->num_slots; ++x) { 957 s->slots[x].size = 0; 958 s->slots[x].slot_id = x; 959 } 960 961 hvf_state = s; 962 cpu_interrupt_handler = hvf_handle_interrupt; 963 memory_listener_register(&hvf_memory_listener, &address_space_memory); 964 return 0; 965 } 966 967 static void hvf_accel_class_init(ObjectClass *oc, void *data) 968 { 969 AccelClass *ac = ACCEL_CLASS(oc); 970 ac->name = "HVF"; 971 ac->init_machine = hvf_accel_init; 972 ac->allowed = &hvf_allowed; 973 } 974 975 static const TypeInfo hvf_accel_type = { 976 .name = TYPE_HVF_ACCEL, 977 .parent = TYPE_ACCEL, 978 .class_init = hvf_accel_class_init, 979 }; 980 981 static void hvf_type_init(void) 982 { 983 type_register_static(&hvf_accel_type); 984 } 985 986 type_init(hvf_type_init); 987