1 /* Copyright 2008 IBM Corporation 2 * 2008 Red Hat, Inc. 3 * Copyright 2011 Intel Corporation 4 * Copyright 2016 Veertu, Inc. 5 * Copyright 2017 The Android Open Source Project 6 * 7 * QEMU Hypervisor.framework support 8 * 9 * This program is free software; you can redistribute it and/or 10 * modify it under the terms of version 2 of the GNU General Public 11 * License as published by the Free Software Foundation. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 16 * General Public License for more details. 17 * 18 * You should have received a copy of the GNU General Public License 19 * along with this program; if not, see <http://www.gnu.org/licenses/>. 20 * 21 * This file contain code under public domain from the hvdos project: 22 * https://github.com/mist64/hvdos 23 * 24 * Parts Copyright (c) 2011 NetApp, Inc. 25 * All rights reserved. 26 * 27 * Redistribution and use in source and binary forms, with or without 28 * modification, are permitted provided that the following conditions 29 * are met: 30 * 1. Redistributions of source code must retain the above copyright 31 * notice, this list of conditions and the following disclaimer. 32 * 2. Redistributions in binary form must reproduce the above copyright 33 * notice, this list of conditions and the following disclaimer in the 34 * documentation and/or other materials provided with the distribution. 35 * 36 * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND 37 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 38 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 39 * ARE DISCLAIMED. IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE 40 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 41 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 42 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 43 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 44 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 45 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 46 * SUCH DAMAGE. 47 */ 48 49 #include "qemu/osdep.h" 50 #include "qemu-common.h" 51 #include "qemu/error-report.h" 52 53 #include "sysemu/hvf.h" 54 #include "sysemu/runstate.h" 55 #include "hvf-i386.h" 56 #include "vmcs.h" 57 #include "vmx.h" 58 #include "x86.h" 59 #include "x86_descr.h" 60 #include "x86_mmu.h" 61 #include "x86_decode.h" 62 #include "x86_emu.h" 63 #include "x86_task.h" 64 #include "x86hvf.h" 65 66 #include <Hypervisor/hv.h> 67 #include <Hypervisor/hv_vmx.h> 68 69 #include "exec/address-spaces.h" 70 #include "hw/i386/apic_internal.h" 71 #include "qemu/main-loop.h" 72 #include "sysemu/accel.h" 73 #include "target/i386/cpu.h" 74 75 #include "hvf-cpus.h" 76 77 HVFState *hvf_state; 78 79 static void assert_hvf_ok(hv_return_t ret) 80 { 81 if (ret == HV_SUCCESS) { 82 return; 83 } 84 85 switch (ret) { 86 case HV_ERROR: 87 error_report("Error: HV_ERROR"); 88 break; 89 case HV_BUSY: 90 error_report("Error: HV_BUSY"); 91 break; 92 case HV_BAD_ARGUMENT: 93 error_report("Error: HV_BAD_ARGUMENT"); 94 break; 95 case HV_NO_RESOURCES: 96 error_report("Error: HV_NO_RESOURCES"); 97 break; 98 case HV_NO_DEVICE: 99 error_report("Error: HV_NO_DEVICE"); 100 break; 101 case HV_UNSUPPORTED: 102 error_report("Error: HV_UNSUPPORTED"); 103 break; 104 default: 105 error_report("Unknown Error"); 106 } 107 108 abort(); 109 } 110 111 /* Memory slots */ 112 hvf_slot *hvf_find_overlap_slot(uint64_t start, uint64_t size) 113 { 114 hvf_slot *slot; 115 int x; 116 for (x = 0; x < hvf_state->num_slots; ++x) { 117 slot = &hvf_state->slots[x]; 118 if (slot->size && start < (slot->start + slot->size) && 119 (start + size) > slot->start) { 120 return slot; 121 } 122 } 123 return NULL; 124 } 125 126 struct mac_slot { 127 int present; 128 uint64_t size; 129 uint64_t gpa_start; 130 uint64_t gva; 131 }; 132 133 struct mac_slot mac_slots[32]; 134 135 static int do_hvf_set_memory(hvf_slot *slot, hv_memory_flags_t flags) 136 { 137 struct mac_slot *macslot; 138 hv_return_t ret; 139 140 macslot = &mac_slots[slot->slot_id]; 141 142 if (macslot->present) { 143 if (macslot->size != slot->size) { 144 macslot->present = 0; 145 ret = hv_vm_unmap(macslot->gpa_start, macslot->size); 146 assert_hvf_ok(ret); 147 } 148 } 149 150 if (!slot->size) { 151 return 0; 152 } 153 154 macslot->present = 1; 155 macslot->gpa_start = slot->start; 156 macslot->size = slot->size; 157 ret = hv_vm_map((hv_uvaddr_t)slot->mem, slot->start, slot->size, flags); 158 assert_hvf_ok(ret); 159 return 0; 160 } 161 162 void hvf_set_phys_mem(MemoryRegionSection *section, bool add) 163 { 164 hvf_slot *mem; 165 MemoryRegion *area = section->mr; 166 bool writeable = !area->readonly && !area->rom_device; 167 hv_memory_flags_t flags; 168 169 if (!memory_region_is_ram(area)) { 170 if (writeable) { 171 return; 172 } else if (!memory_region_is_romd(area)) { 173 /* 174 * If the memory device is not in romd_mode, then we actually want 175 * to remove the hvf memory slot so all accesses will trap. 176 */ 177 add = false; 178 } 179 } 180 181 mem = hvf_find_overlap_slot( 182 section->offset_within_address_space, 183 int128_get64(section->size)); 184 185 if (mem && add) { 186 if (mem->size == int128_get64(section->size) && 187 mem->start == section->offset_within_address_space && 188 mem->mem == (memory_region_get_ram_ptr(area) + 189 section->offset_within_region)) { 190 return; /* Same region was attempted to register, go away. */ 191 } 192 } 193 194 /* Region needs to be reset. set the size to 0 and remap it. */ 195 if (mem) { 196 mem->size = 0; 197 if (do_hvf_set_memory(mem, 0)) { 198 error_report("Failed to reset overlapping slot"); 199 abort(); 200 } 201 } 202 203 if (!add) { 204 return; 205 } 206 207 if (area->readonly || 208 (!memory_region_is_ram(area) && memory_region_is_romd(area))) { 209 flags = HV_MEMORY_READ | HV_MEMORY_EXEC; 210 } else { 211 flags = HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC; 212 } 213 214 /* Now make a new slot. */ 215 int x; 216 217 for (x = 0; x < hvf_state->num_slots; ++x) { 218 mem = &hvf_state->slots[x]; 219 if (!mem->size) { 220 break; 221 } 222 } 223 224 if (x == hvf_state->num_slots) { 225 error_report("No free slots"); 226 abort(); 227 } 228 229 mem->size = int128_get64(section->size); 230 mem->mem = memory_region_get_ram_ptr(area) + section->offset_within_region; 231 mem->start = section->offset_within_address_space; 232 mem->region = area; 233 234 if (do_hvf_set_memory(mem, flags)) { 235 error_report("Error registering new memory slot"); 236 abort(); 237 } 238 } 239 240 void vmx_update_tpr(CPUState *cpu) 241 { 242 /* TODO: need integrate APIC handling */ 243 X86CPU *x86_cpu = X86_CPU(cpu); 244 int tpr = cpu_get_apic_tpr(x86_cpu->apic_state) << 4; 245 int irr = apic_get_highest_priority_irr(x86_cpu->apic_state); 246 247 wreg(cpu->hvf_fd, HV_X86_TPR, tpr); 248 if (irr == -1) { 249 wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0); 250 } else { 251 wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, (irr > tpr) ? tpr >> 4 : 252 irr >> 4); 253 } 254 } 255 256 static void update_apic_tpr(CPUState *cpu) 257 { 258 X86CPU *x86_cpu = X86_CPU(cpu); 259 int tpr = rreg(cpu->hvf_fd, HV_X86_TPR) >> 4; 260 cpu_set_apic_tpr(x86_cpu->apic_state, tpr); 261 } 262 263 #define VECTORING_INFO_VECTOR_MASK 0xff 264 265 void hvf_handle_io(CPUArchState *env, uint16_t port, void *buffer, 266 int direction, int size, int count) 267 { 268 int i; 269 uint8_t *ptr = buffer; 270 271 for (i = 0; i < count; i++) { 272 address_space_rw(&address_space_io, port, MEMTXATTRS_UNSPECIFIED, 273 ptr, size, 274 direction); 275 ptr += size; 276 } 277 } 278 279 static void do_hvf_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg) 280 { 281 if (!cpu->vcpu_dirty) { 282 hvf_get_registers(cpu); 283 cpu->vcpu_dirty = true; 284 } 285 } 286 287 void hvf_cpu_synchronize_state(CPUState *cpu) 288 { 289 if (!cpu->vcpu_dirty) { 290 run_on_cpu(cpu, do_hvf_cpu_synchronize_state, RUN_ON_CPU_NULL); 291 } 292 } 293 294 static void do_hvf_cpu_synchronize_post_reset(CPUState *cpu, 295 run_on_cpu_data arg) 296 { 297 hvf_put_registers(cpu); 298 cpu->vcpu_dirty = false; 299 } 300 301 void hvf_cpu_synchronize_post_reset(CPUState *cpu) 302 { 303 run_on_cpu(cpu, do_hvf_cpu_synchronize_post_reset, RUN_ON_CPU_NULL); 304 } 305 306 static void do_hvf_cpu_synchronize_post_init(CPUState *cpu, 307 run_on_cpu_data arg) 308 { 309 hvf_put_registers(cpu); 310 cpu->vcpu_dirty = false; 311 } 312 313 void hvf_cpu_synchronize_post_init(CPUState *cpu) 314 { 315 run_on_cpu(cpu, do_hvf_cpu_synchronize_post_init, RUN_ON_CPU_NULL); 316 } 317 318 static void do_hvf_cpu_synchronize_pre_loadvm(CPUState *cpu, 319 run_on_cpu_data arg) 320 { 321 cpu->vcpu_dirty = true; 322 } 323 324 void hvf_cpu_synchronize_pre_loadvm(CPUState *cpu) 325 { 326 run_on_cpu(cpu, do_hvf_cpu_synchronize_pre_loadvm, RUN_ON_CPU_NULL); 327 } 328 329 static bool ept_emulation_fault(hvf_slot *slot, uint64_t gpa, uint64_t ept_qual) 330 { 331 int read, write; 332 333 /* EPT fault on an instruction fetch doesn't make sense here */ 334 if (ept_qual & EPT_VIOLATION_INST_FETCH) { 335 return false; 336 } 337 338 /* EPT fault must be a read fault or a write fault */ 339 read = ept_qual & EPT_VIOLATION_DATA_READ ? 1 : 0; 340 write = ept_qual & EPT_VIOLATION_DATA_WRITE ? 1 : 0; 341 if ((read | write) == 0) { 342 return false; 343 } 344 345 if (write && slot) { 346 if (slot->flags & HVF_SLOT_LOG) { 347 memory_region_set_dirty(slot->region, gpa - slot->start, 1); 348 hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size, 349 HV_MEMORY_READ | HV_MEMORY_WRITE); 350 } 351 } 352 353 /* 354 * The EPT violation must have been caused by accessing a 355 * guest-physical address that is a translation of a guest-linear 356 * address. 357 */ 358 if ((ept_qual & EPT_VIOLATION_GLA_VALID) == 0 || 359 (ept_qual & EPT_VIOLATION_XLAT_VALID) == 0) { 360 return false; 361 } 362 363 if (!slot) { 364 return true; 365 } 366 if (!memory_region_is_ram(slot->region) && 367 !(read && memory_region_is_romd(slot->region))) { 368 return true; 369 } 370 return false; 371 } 372 373 static void hvf_set_dirty_tracking(MemoryRegionSection *section, bool on) 374 { 375 hvf_slot *slot; 376 377 slot = hvf_find_overlap_slot( 378 section->offset_within_address_space, 379 int128_get64(section->size)); 380 381 /* protect region against writes; begin tracking it */ 382 if (on) { 383 slot->flags |= HVF_SLOT_LOG; 384 hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size, 385 HV_MEMORY_READ); 386 /* stop tracking region*/ 387 } else { 388 slot->flags &= ~HVF_SLOT_LOG; 389 hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size, 390 HV_MEMORY_READ | HV_MEMORY_WRITE); 391 } 392 } 393 394 static void hvf_log_start(MemoryListener *listener, 395 MemoryRegionSection *section, int old, int new) 396 { 397 if (old != 0) { 398 return; 399 } 400 401 hvf_set_dirty_tracking(section, 1); 402 } 403 404 static void hvf_log_stop(MemoryListener *listener, 405 MemoryRegionSection *section, int old, int new) 406 { 407 if (new != 0) { 408 return; 409 } 410 411 hvf_set_dirty_tracking(section, 0); 412 } 413 414 static void hvf_log_sync(MemoryListener *listener, 415 MemoryRegionSection *section) 416 { 417 /* 418 * sync of dirty pages is handled elsewhere; just make sure we keep 419 * tracking the region. 420 */ 421 hvf_set_dirty_tracking(section, 1); 422 } 423 424 static void hvf_region_add(MemoryListener *listener, 425 MemoryRegionSection *section) 426 { 427 hvf_set_phys_mem(section, true); 428 } 429 430 static void hvf_region_del(MemoryListener *listener, 431 MemoryRegionSection *section) 432 { 433 hvf_set_phys_mem(section, false); 434 } 435 436 static MemoryListener hvf_memory_listener = { 437 .priority = 10, 438 .region_add = hvf_region_add, 439 .region_del = hvf_region_del, 440 .log_start = hvf_log_start, 441 .log_stop = hvf_log_stop, 442 .log_sync = hvf_log_sync, 443 }; 444 445 void hvf_vcpu_destroy(CPUState *cpu) 446 { 447 X86CPU *x86_cpu = X86_CPU(cpu); 448 CPUX86State *env = &x86_cpu->env; 449 450 hv_return_t ret = hv_vcpu_destroy((hv_vcpuid_t)cpu->hvf_fd); 451 g_free(env->hvf_mmio_buf); 452 assert_hvf_ok(ret); 453 } 454 455 static void dummy_signal(int sig) 456 { 457 } 458 459 int hvf_init_vcpu(CPUState *cpu) 460 { 461 462 X86CPU *x86cpu = X86_CPU(cpu); 463 CPUX86State *env = &x86cpu->env; 464 int r; 465 466 /* init cpu signals */ 467 sigset_t set; 468 struct sigaction sigact; 469 470 memset(&sigact, 0, sizeof(sigact)); 471 sigact.sa_handler = dummy_signal; 472 sigaction(SIG_IPI, &sigact, NULL); 473 474 pthread_sigmask(SIG_BLOCK, NULL, &set); 475 sigdelset(&set, SIG_IPI); 476 477 init_emu(); 478 init_decoder(); 479 480 hvf_state->hvf_caps = g_new0(struct hvf_vcpu_caps, 1); 481 env->hvf_mmio_buf = g_new(char, 4096); 482 483 r = hv_vcpu_create((hv_vcpuid_t *)&cpu->hvf_fd, HV_VCPU_DEFAULT); 484 cpu->vcpu_dirty = 1; 485 assert_hvf_ok(r); 486 487 if (hv_vmx_read_capability(HV_VMX_CAP_PINBASED, 488 &hvf_state->hvf_caps->vmx_cap_pinbased)) { 489 abort(); 490 } 491 if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED, 492 &hvf_state->hvf_caps->vmx_cap_procbased)) { 493 abort(); 494 } 495 if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED2, 496 &hvf_state->hvf_caps->vmx_cap_procbased2)) { 497 abort(); 498 } 499 if (hv_vmx_read_capability(HV_VMX_CAP_ENTRY, 500 &hvf_state->hvf_caps->vmx_cap_entry)) { 501 abort(); 502 } 503 504 /* set VMCS control fields */ 505 wvmcs(cpu->hvf_fd, VMCS_PIN_BASED_CTLS, 506 cap2ctrl(hvf_state->hvf_caps->vmx_cap_pinbased, 507 VMCS_PIN_BASED_CTLS_EXTINT | 508 VMCS_PIN_BASED_CTLS_NMI | 509 VMCS_PIN_BASED_CTLS_VNMI)); 510 wvmcs(cpu->hvf_fd, VMCS_PRI_PROC_BASED_CTLS, 511 cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased, 512 VMCS_PRI_PROC_BASED_CTLS_HLT | 513 VMCS_PRI_PROC_BASED_CTLS_MWAIT | 514 VMCS_PRI_PROC_BASED_CTLS_TSC_OFFSET | 515 VMCS_PRI_PROC_BASED_CTLS_TPR_SHADOW) | 516 VMCS_PRI_PROC_BASED_CTLS_SEC_CONTROL); 517 wvmcs(cpu->hvf_fd, VMCS_SEC_PROC_BASED_CTLS, 518 cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased2, 519 VMCS_PRI_PROC_BASED2_CTLS_APIC_ACCESSES)); 520 521 wvmcs(cpu->hvf_fd, VMCS_ENTRY_CTLS, cap2ctrl(hvf_state->hvf_caps->vmx_cap_entry, 522 0)); 523 wvmcs(cpu->hvf_fd, VMCS_EXCEPTION_BITMAP, 0); /* Double fault */ 524 525 wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0); 526 527 x86cpu = X86_CPU(cpu); 528 x86cpu->env.xsave_buf = qemu_memalign(4096, 4096); 529 530 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_STAR, 1); 531 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_LSTAR, 1); 532 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_CSTAR, 1); 533 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FMASK, 1); 534 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FSBASE, 1); 535 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_GSBASE, 1); 536 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_KERNELGSBASE, 1); 537 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_TSC_AUX, 1); 538 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_TSC, 1); 539 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_CS, 1); 540 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_EIP, 1); 541 hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_ESP, 1); 542 543 return 0; 544 } 545 546 static void hvf_store_events(CPUState *cpu, uint32_t ins_len, uint64_t idtvec_info) 547 { 548 X86CPU *x86_cpu = X86_CPU(cpu); 549 CPUX86State *env = &x86_cpu->env; 550 551 env->exception_nr = -1; 552 env->exception_pending = 0; 553 env->exception_injected = 0; 554 env->interrupt_injected = -1; 555 env->nmi_injected = false; 556 env->ins_len = 0; 557 env->has_error_code = false; 558 if (idtvec_info & VMCS_IDT_VEC_VALID) { 559 switch (idtvec_info & VMCS_IDT_VEC_TYPE) { 560 case VMCS_IDT_VEC_HWINTR: 561 case VMCS_IDT_VEC_SWINTR: 562 env->interrupt_injected = idtvec_info & VMCS_IDT_VEC_VECNUM; 563 break; 564 case VMCS_IDT_VEC_NMI: 565 env->nmi_injected = true; 566 break; 567 case VMCS_IDT_VEC_HWEXCEPTION: 568 case VMCS_IDT_VEC_SWEXCEPTION: 569 env->exception_nr = idtvec_info & VMCS_IDT_VEC_VECNUM; 570 env->exception_injected = 1; 571 break; 572 case VMCS_IDT_VEC_PRIV_SWEXCEPTION: 573 default: 574 abort(); 575 } 576 if ((idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWEXCEPTION || 577 (idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWINTR) { 578 env->ins_len = ins_len; 579 } 580 if (idtvec_info & VMCS_IDT_VEC_ERRCODE_VALID) { 581 env->has_error_code = true; 582 env->error_code = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_ERROR); 583 } 584 } 585 if ((rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) & 586 VMCS_INTERRUPTIBILITY_NMI_BLOCKING)) { 587 env->hflags2 |= HF2_NMI_MASK; 588 } else { 589 env->hflags2 &= ~HF2_NMI_MASK; 590 } 591 if (rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) & 592 (VMCS_INTERRUPTIBILITY_STI_BLOCKING | 593 VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING)) { 594 env->hflags |= HF_INHIBIT_IRQ_MASK; 595 } else { 596 env->hflags &= ~HF_INHIBIT_IRQ_MASK; 597 } 598 } 599 600 int hvf_vcpu_exec(CPUState *cpu) 601 { 602 X86CPU *x86_cpu = X86_CPU(cpu); 603 CPUX86State *env = &x86_cpu->env; 604 int ret = 0; 605 uint64_t rip = 0; 606 607 if (hvf_process_events(cpu)) { 608 return EXCP_HLT; 609 } 610 611 do { 612 if (cpu->vcpu_dirty) { 613 hvf_put_registers(cpu); 614 cpu->vcpu_dirty = false; 615 } 616 617 if (hvf_inject_interrupts(cpu)) { 618 return EXCP_INTERRUPT; 619 } 620 vmx_update_tpr(cpu); 621 622 qemu_mutex_unlock_iothread(); 623 if (!cpu_is_bsp(X86_CPU(cpu)) && cpu->halted) { 624 qemu_mutex_lock_iothread(); 625 return EXCP_HLT; 626 } 627 628 hv_return_t r = hv_vcpu_run(cpu->hvf_fd); 629 assert_hvf_ok(r); 630 631 /* handle VMEXIT */ 632 uint64_t exit_reason = rvmcs(cpu->hvf_fd, VMCS_EXIT_REASON); 633 uint64_t exit_qual = rvmcs(cpu->hvf_fd, VMCS_EXIT_QUALIFICATION); 634 uint32_t ins_len = (uint32_t)rvmcs(cpu->hvf_fd, 635 VMCS_EXIT_INSTRUCTION_LENGTH); 636 637 uint64_t idtvec_info = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO); 638 639 hvf_store_events(cpu, ins_len, idtvec_info); 640 rip = rreg(cpu->hvf_fd, HV_X86_RIP); 641 env->eflags = rreg(cpu->hvf_fd, HV_X86_RFLAGS); 642 643 qemu_mutex_lock_iothread(); 644 645 update_apic_tpr(cpu); 646 current_cpu = cpu; 647 648 ret = 0; 649 switch (exit_reason) { 650 case EXIT_REASON_HLT: { 651 macvm_set_rip(cpu, rip + ins_len); 652 if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) && 653 (env->eflags & IF_MASK)) 654 && !(cpu->interrupt_request & CPU_INTERRUPT_NMI) && 655 !(idtvec_info & VMCS_IDT_VEC_VALID)) { 656 cpu->halted = 1; 657 ret = EXCP_HLT; 658 break; 659 } 660 ret = EXCP_INTERRUPT; 661 break; 662 } 663 case EXIT_REASON_MWAIT: { 664 ret = EXCP_INTERRUPT; 665 break; 666 } 667 /* Need to check if MMIO or unmapped fault */ 668 case EXIT_REASON_EPT_FAULT: 669 { 670 hvf_slot *slot; 671 uint64_t gpa = rvmcs(cpu->hvf_fd, VMCS_GUEST_PHYSICAL_ADDRESS); 672 673 if (((idtvec_info & VMCS_IDT_VEC_VALID) == 0) && 674 ((exit_qual & EXIT_QUAL_NMIUDTI) != 0)) { 675 vmx_set_nmi_blocking(cpu); 676 } 677 678 slot = hvf_find_overlap_slot(gpa, 1); 679 /* mmio */ 680 if (ept_emulation_fault(slot, gpa, exit_qual)) { 681 struct x86_decode decode; 682 683 load_regs(cpu); 684 decode_instruction(env, &decode); 685 exec_instruction(env, &decode); 686 store_regs(cpu); 687 break; 688 } 689 break; 690 } 691 case EXIT_REASON_INOUT: 692 { 693 uint32_t in = (exit_qual & 8) != 0; 694 uint32_t size = (exit_qual & 7) + 1; 695 uint32_t string = (exit_qual & 16) != 0; 696 uint32_t port = exit_qual >> 16; 697 /*uint32_t rep = (exit_qual & 0x20) != 0;*/ 698 699 if (!string && in) { 700 uint64_t val = 0; 701 load_regs(cpu); 702 hvf_handle_io(env, port, &val, 0, size, 1); 703 if (size == 1) { 704 AL(env) = val; 705 } else if (size == 2) { 706 AX(env) = val; 707 } else if (size == 4) { 708 RAX(env) = (uint32_t)val; 709 } else { 710 RAX(env) = (uint64_t)val; 711 } 712 env->eip += ins_len; 713 store_regs(cpu); 714 break; 715 } else if (!string && !in) { 716 RAX(env) = rreg(cpu->hvf_fd, HV_X86_RAX); 717 hvf_handle_io(env, port, &RAX(env), 1, size, 1); 718 macvm_set_rip(cpu, rip + ins_len); 719 break; 720 } 721 struct x86_decode decode; 722 723 load_regs(cpu); 724 decode_instruction(env, &decode); 725 assert(ins_len == decode.len); 726 exec_instruction(env, &decode); 727 store_regs(cpu); 728 729 break; 730 } 731 case EXIT_REASON_CPUID: { 732 uint32_t rax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX); 733 uint32_t rbx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RBX); 734 uint32_t rcx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX); 735 uint32_t rdx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX); 736 737 cpu_x86_cpuid(env, rax, rcx, &rax, &rbx, &rcx, &rdx); 738 739 wreg(cpu->hvf_fd, HV_X86_RAX, rax); 740 wreg(cpu->hvf_fd, HV_X86_RBX, rbx); 741 wreg(cpu->hvf_fd, HV_X86_RCX, rcx); 742 wreg(cpu->hvf_fd, HV_X86_RDX, rdx); 743 744 macvm_set_rip(cpu, rip + ins_len); 745 break; 746 } 747 case EXIT_REASON_XSETBV: { 748 X86CPU *x86_cpu = X86_CPU(cpu); 749 CPUX86State *env = &x86_cpu->env; 750 uint32_t eax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX); 751 uint32_t ecx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX); 752 uint32_t edx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX); 753 754 if (ecx) { 755 macvm_set_rip(cpu, rip + ins_len); 756 break; 757 } 758 env->xcr0 = ((uint64_t)edx << 32) | eax; 759 wreg(cpu->hvf_fd, HV_X86_XCR0, env->xcr0 | 1); 760 macvm_set_rip(cpu, rip + ins_len); 761 break; 762 } 763 case EXIT_REASON_INTR_WINDOW: 764 vmx_clear_int_window_exiting(cpu); 765 ret = EXCP_INTERRUPT; 766 break; 767 case EXIT_REASON_NMI_WINDOW: 768 vmx_clear_nmi_window_exiting(cpu); 769 ret = EXCP_INTERRUPT; 770 break; 771 case EXIT_REASON_EXT_INTR: 772 /* force exit and allow io handling */ 773 ret = EXCP_INTERRUPT; 774 break; 775 case EXIT_REASON_RDMSR: 776 case EXIT_REASON_WRMSR: 777 { 778 load_regs(cpu); 779 if (exit_reason == EXIT_REASON_RDMSR) { 780 simulate_rdmsr(cpu); 781 } else { 782 simulate_wrmsr(cpu); 783 } 784 env->eip += ins_len; 785 store_regs(cpu); 786 break; 787 } 788 case EXIT_REASON_CR_ACCESS: { 789 int cr; 790 int reg; 791 792 load_regs(cpu); 793 cr = exit_qual & 15; 794 reg = (exit_qual >> 8) & 15; 795 796 switch (cr) { 797 case 0x0: { 798 macvm_set_cr0(cpu->hvf_fd, RRX(env, reg)); 799 break; 800 } 801 case 4: { 802 macvm_set_cr4(cpu->hvf_fd, RRX(env, reg)); 803 break; 804 } 805 case 8: { 806 X86CPU *x86_cpu = X86_CPU(cpu); 807 if (exit_qual & 0x10) { 808 RRX(env, reg) = cpu_get_apic_tpr(x86_cpu->apic_state); 809 } else { 810 int tpr = RRX(env, reg); 811 cpu_set_apic_tpr(x86_cpu->apic_state, tpr); 812 ret = EXCP_INTERRUPT; 813 } 814 break; 815 } 816 default: 817 error_report("Unrecognized CR %d", cr); 818 abort(); 819 } 820 env->eip += ins_len; 821 store_regs(cpu); 822 break; 823 } 824 case EXIT_REASON_APIC_ACCESS: { /* TODO */ 825 struct x86_decode decode; 826 827 load_regs(cpu); 828 decode_instruction(env, &decode); 829 exec_instruction(env, &decode); 830 store_regs(cpu); 831 break; 832 } 833 case EXIT_REASON_TPR: { 834 ret = 1; 835 break; 836 } 837 case EXIT_REASON_TASK_SWITCH: { 838 uint64_t vinfo = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO); 839 x68_segment_selector sel = {.sel = exit_qual & 0xffff}; 840 vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3, 841 vinfo & VMCS_INTR_VALID, vinfo & VECTORING_INFO_VECTOR_MASK, vinfo 842 & VMCS_INTR_T_MASK); 843 break; 844 } 845 case EXIT_REASON_TRIPLE_FAULT: { 846 qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET); 847 ret = EXCP_INTERRUPT; 848 break; 849 } 850 case EXIT_REASON_RDPMC: 851 wreg(cpu->hvf_fd, HV_X86_RAX, 0); 852 wreg(cpu->hvf_fd, HV_X86_RDX, 0); 853 macvm_set_rip(cpu, rip + ins_len); 854 break; 855 case VMX_REASON_VMCALL: 856 env->exception_nr = EXCP0D_GPF; 857 env->exception_injected = 1; 858 env->has_error_code = true; 859 env->error_code = 0; 860 break; 861 default: 862 error_report("%llx: unhandled exit %llx", rip, exit_reason); 863 } 864 } while (ret == 0); 865 866 return ret; 867 } 868 869 bool hvf_allowed; 870 871 static int hvf_accel_init(MachineState *ms) 872 { 873 int x; 874 hv_return_t ret; 875 HVFState *s; 876 877 ret = hv_vm_create(HV_VM_DEFAULT); 878 assert_hvf_ok(ret); 879 880 s = g_new0(HVFState, 1); 881 882 s->num_slots = 32; 883 for (x = 0; x < s->num_slots; ++x) { 884 s->slots[x].size = 0; 885 s->slots[x].slot_id = x; 886 } 887 888 hvf_state = s; 889 memory_listener_register(&hvf_memory_listener, &address_space_memory); 890 cpus_register_accel(&hvf_cpus); 891 return 0; 892 } 893 894 static void hvf_accel_class_init(ObjectClass *oc, void *data) 895 { 896 AccelClass *ac = ACCEL_CLASS(oc); 897 ac->name = "HVF"; 898 ac->init_machine = hvf_accel_init; 899 ac->allowed = &hvf_allowed; 900 } 901 902 static const TypeInfo hvf_accel_type = { 903 .name = TYPE_HVF_ACCEL, 904 .parent = TYPE_ACCEL, 905 .class_init = hvf_accel_class_init, 906 }; 907 908 static void hvf_type_init(void) 909 { 910 type_register_static(&hvf_accel_type); 911 } 912 913 type_init(hvf_type_init); 914