target/i386/hvf/hvf.c

   1 /* Copyright 2008 IBM Corporation
   2  *           2008 Red Hat, Inc.
   3  * Copyright 2011 Intel Corporation
   4  * Copyright 2016 Veertu, Inc.
   5  * Copyright 2017 The Android Open Source Project
   6  *
   7  * QEMU Hypervisor.framework support
   8  *
   9  * This program is free software; you can redistribute it and/or
  10  * modify it under the terms of version 2 of the GNU General Public
  11  * License as published by the Free Software Foundation.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public
  19  * License along with this program; if not, see <http://www.gnu.org/licenses/>.
  20  *
  21  * This file contain code under public domain from the hvdos project:
  22  * https://github.com/mist64/hvdos
  23  *
  24  * Parts Copyright (c) 2011 NetApp, Inc.
  25  * All rights reserved.
  26  *
  27  * Redistribution and use in source and binary forms, with or without
  28  * modification, are permitted provided that the following conditions
  29  * are met:
  30  * 1. Redistributions of source code must retain the above copyright
  31  *    notice, this list of conditions and the following disclaimer.
  32  * 2. Redistributions in binary form must reproduce the above copyright
  33  *    notice, this list of conditions and the following disclaimer in the
  34  *    documentation and/or other materials provided with the distribution.
  35  *
  36  * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
  37  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  38  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  39  * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
  40  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  41  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  42  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  43  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  44  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  45  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  46  * SUCH DAMAGE.
  47  */
  48 #include "qemu/osdep.h"
  49 #include "qemu-common.h"
  50 #include "qemu/error-report.h"
  51
  52 #include "sysemu/hvf.h"
  53 #include "hvf-i386.h"
  54 #include "vmcs.h"
  55 #include "vmx.h"
  56 #include "x86.h"
  57 #include "x86_descr.h"
  58 #include "x86_mmu.h"
  59 #include "x86_decode.h"
  60 #include "x86_emu.h"
  61 #include "x86_task.h"
  62 #include "x86hvf.h"
  63
  64 #include <Hypervisor/hv.h>
  65 #include <Hypervisor/hv_vmx.h>
  66
  67 #include "exec/address-spaces.h"
  68 #include "exec/exec-all.h"
  69 #include "exec/ioport.h"
  70 #include "hw/i386/apic_internal.h"
  71 #include "hw/boards.h"
  72 #include "qemu/main-loop.h"
  73 #include "strings.h"
  74 #include "sysemu/accel.h"
  75 #include "sysemu/sysemu.h"
  76 #include "target/i386/cpu.h"
  77
  78 pthread_rwlock_t mem_lock = PTHREAD_RWLOCK_INITIALIZER;
  79 HVFState *hvf_state;
  80 int hvf_disabled = 1;
  81
  82 static void assert_hvf_ok(hv_return_t ret)
  83 {
  84     if (ret == HV_SUCCESS) {
  85         return;
  86     }
  87
  88     switch (ret) {
  89     case HV_ERROR:
  90         error_report("Error: HV_ERROR\n");
  91         break;
  92     case HV_BUSY:
  93         error_report("Error: HV_BUSY\n");
  94         break;
  95     case HV_BAD_ARGUMENT:
  96         error_report("Error: HV_BAD_ARGUMENT\n");
  97         break;
  98     case HV_NO_RESOURCES:
  99         error_report("Error: HV_NO_RESOURCES\n");
 100         break;
 101     case HV_NO_DEVICE:
 102         error_report("Error: HV_NO_DEVICE\n");
 103         break;
 104     case HV_UNSUPPORTED:
 105         error_report("Error: HV_UNSUPPORTED\n");
 106         break;
 107     default:
 108         error_report("Unknown Error\n");
 109     }
 110
 111     abort();
 112 }
 113
 114 /* Memory slots */
 115 hvf_slot *hvf_find_overlap_slot(uint64_t start, uint64_t end)
 116 {
 117     hvf_slot *slot;
 118     int x;
 119     for (x = 0; x < hvf_state->num_slots; ++x) {
 120         slot = &hvf_state->slots[x];
 121         if (slot->size && start < (slot->start + slot->size) &&
 122             end > slot->start) {
 123             return slot;
 124         }
 125     }
 126     return NULL;
 127 }
 128
 129 struct mac_slot {
 130     int present;
 131     uint64_t size;
 132     uint64_t gpa_start;
 133     uint64_t gva;
 134 };
 135
 136 struct mac_slot mac_slots[32];
 137 #define ALIGN(x, y)  (((x) + (y) - 1) & ~((y) - 1))
 138
 139 static int do_hvf_set_memory(hvf_slot *slot)
 140 {
 141     struct mac_slot *macslot;
 142     hv_memory_flags_t flags;
 143     hv_return_t ret;
 144
 145     macslot = &mac_slots[slot->slot_id];
 146
 147     if (macslot->present) {
 148         if (macslot->size != slot->size) {
 149             macslot->present = 0;
 150             ret = hv_vm_unmap(macslot->gpa_start, macslot->size);
 151             assert_hvf_ok(ret);
 152         }
 153     }
 154
 155     if (!slot->size) {
 156         return 0;
 157     }
 158
 159     flags = HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC;
 160
 161     macslot->present = 1;
 162     macslot->gpa_start = slot->start;
 163     macslot->size = slot->size;
 164     ret = hv_vm_map((hv_uvaddr_t)slot->mem, slot->start, slot->size, flags);
 165     assert_hvf_ok(ret);
 166     return 0;
 167 }
 168
 169 void hvf_set_phys_mem(MemoryRegionSection *section, bool add)
 170 {
 171     hvf_slot *mem;
 172     MemoryRegion *area = section->mr;
 173
 174     if (!memory_region_is_ram(area)) {
 175         return;
 176     }
 177
 178     mem = hvf_find_overlap_slot(
 179             section->offset_within_address_space,
 180             section->offset_within_address_space + int128_get64(section->size));
 181
 182     if (mem && add) {
 183         if (mem->size == int128_get64(section->size) &&
 184             mem->start == section->offset_within_address_space &&
 185             mem->mem == (memory_region_get_ram_ptr(area) +
 186             section->offset_within_region)) {
 187             return; /* Same region was attempted to register, go away. */
 188         }
 189     }
 190
 191     /* Region needs to be reset. set the size to 0 and remap it. */
 192     if (mem) {
 193         mem->size = 0;
 194         if (do_hvf_set_memory(mem)) {
 195             error_report("Failed to reset overlapping slot\n");
 196             abort();
 197         }
 198     }
 199
 200     if (!add) {
 201         return;
 202     }
 203
 204     /* Now make a new slot. */
 205     int x;
 206
 207     for (x = 0; x < hvf_state->num_slots; ++x) {
 208         mem = &hvf_state->slots[x];
 209         if (!mem->size) {
 210             break;
 211         }
 212     }
 213
 214     if (x == hvf_state->num_slots) {
 215         error_report("No free slots\n");
 216         abort();
 217     }
 218
 219     mem->size = int128_get64(section->size);
 220     mem->mem = memory_region_get_ram_ptr(area) + section->offset_within_region;
 221     mem->start = section->offset_within_address_space;
 222     mem->region = area;
 223
 224     if (do_hvf_set_memory(mem)) {
 225         error_report("Error registering new memory slot\n");
 226         abort();
 227     }
 228 }
 229
 230 void vmx_update_tpr(CPUState *cpu)
 231 {
 232     /* TODO: need integrate APIC handling */
 233     X86CPU *x86_cpu = X86_CPU(cpu);
 234     int tpr = cpu_get_apic_tpr(x86_cpu->apic_state) << 4;
 235     int irr = apic_get_highest_priority_irr(x86_cpu->apic_state);
 236
 237     wreg(cpu->hvf_fd, HV_X86_TPR, tpr);
 238     if (irr == -1) {
 239         wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0);
 240     } else {
 241         wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, (irr > tpr) ? tpr >> 4 :
 242               irr >> 4);
 243     }
 244 }
 245
 246 void update_apic_tpr(CPUState *cpu)
 247 {
 248     X86CPU *x86_cpu = X86_CPU(cpu);
 249     int tpr = rreg(cpu->hvf_fd, HV_X86_TPR) >> 4;
 250     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
 251 }
 252
 253 #define VECTORING_INFO_VECTOR_MASK     0xff
 254
 255 static void hvf_handle_interrupt(CPUState * cpu, int mask)
 256 {
 257     cpu->interrupt_request |= mask;
 258     if (!qemu_cpu_is_self(cpu)) {
 259         qemu_cpu_kick(cpu);
 260     }
 261 }
 262
 263 void hvf_handle_io(CPUArchState *env, uint16_t port, void *buffer,
 264                   int direction, int size, int count)
 265 {
 266     int i;
 267     uint8_t *ptr = buffer;
 268
 269     for (i = 0; i < count; i++) {
 270         address_space_rw(&address_space_io, port, MEMTXATTRS_UNSPECIFIED,
 271                          ptr, size,
 272                          direction);
 273         ptr += size;
 274     }
 275 }
 276
 277 /* TODO: synchronize vcpu state */
 278 static void do_hvf_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
 279 {
 280     CPUState *cpu_state = cpu;
 281     if (cpu_state->vcpu_dirty == 0) {
 282         hvf_get_registers(cpu_state);
 283     }
 284
 285     cpu_state->vcpu_dirty = 1;
 286 }
 287
 288 void hvf_cpu_synchronize_state(CPUState *cpu_state)
 289 {
 290     if (cpu_state->vcpu_dirty == 0) {
 291         run_on_cpu(cpu_state, do_hvf_cpu_synchronize_state, RUN_ON_CPU_NULL);
 292     }
 293 }
 294
 295 static void do_hvf_cpu_synchronize_post_reset(CPUState *cpu, run_on_cpu_data arg)
 296 {
 297     CPUState *cpu_state = cpu;
 298     hvf_put_registers(cpu_state);
 299     cpu_state->vcpu_dirty = false;
 300 }
 301
 302 void hvf_cpu_synchronize_post_reset(CPUState *cpu_state)
 303 {
 304     run_on_cpu(cpu_state, do_hvf_cpu_synchronize_post_reset, RUN_ON_CPU_NULL);
 305 }
 306
 307 void _hvf_cpu_synchronize_post_init(CPUState *cpu, run_on_cpu_data arg)
 308 {
 309     CPUState *cpu_state = cpu;
 310     hvf_put_registers(cpu_state);
 311     cpu_state->vcpu_dirty = false;
 312 }
 313
 314 void hvf_cpu_synchronize_post_init(CPUState *cpu_state)
 315 {
 316     run_on_cpu(cpu_state, _hvf_cpu_synchronize_post_init, RUN_ON_CPU_NULL);
 317 }
 318
 319 static bool ept_emulation_fault(hvf_slot *slot, uint64_t gpa, uint64_t ept_qual)
 320 {
 321     int read, write;
 322
 323     /* EPT fault on an instruction fetch doesn't make sense here */
 324     if (ept_qual & EPT_VIOLATION_INST_FETCH) {
 325         return false;
 326     }
 327
 328     /* EPT fault must be a read fault or a write fault */
 329     read = ept_qual & EPT_VIOLATION_DATA_READ ? 1 : 0;
 330     write = ept_qual & EPT_VIOLATION_DATA_WRITE ? 1 : 0;
 331     if ((read | write) == 0) {
 332         return false;
 333     }
 334
 335     if (write && slot) {
 336         if (slot->flags & HVF_SLOT_LOG) {
 337             memory_region_set_dirty(slot->region, gpa - slot->start, 1);
 338             hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size,
 339                           HV_MEMORY_READ | HV_MEMORY_WRITE);
 340         }
 341     }
 342
 343     /*
 344      * The EPT violation must have been caused by accessing a
 345      * guest-physical address that is a translation of a guest-linear
 346      * address.
 347      */
 348     if ((ept_qual & EPT_VIOLATION_GLA_VALID) == 0 ||
 349         (ept_qual & EPT_VIOLATION_XLAT_VALID) == 0) {
 350         return false;
 351     }
 352
 353     return !slot;
 354 }
 355
 356 static void hvf_set_dirty_tracking(MemoryRegionSection *section, bool on)
 357 {
 358     hvf_slot *slot;
 359
 360     slot = hvf_find_overlap_slot(
 361             section->offset_within_address_space,
 362             section->offset_within_address_space + int128_get64(section->size));
 363
 364     /* protect region against writes; begin tracking it */
 365     if (on) {
 366         slot->flags |= HVF_SLOT_LOG;
 367         hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size,
 368                       HV_MEMORY_READ);
 369     /* stop tracking region*/
 370     } else {
 371         slot->flags &= ~HVF_SLOT_LOG;
 372         hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size,
 373                       HV_MEMORY_READ | HV_MEMORY_WRITE);
 374     }
 375 }
 376
 377 static void hvf_log_start(MemoryListener *listener,
 378                           MemoryRegionSection *section, int old, int new)
 379 {
 380     if (old != 0) {
 381         return;
 382     }
 383
 384     hvf_set_dirty_tracking(section, 1);
 385 }
 386
 387 static void hvf_log_stop(MemoryListener *listener,
 388                          MemoryRegionSection *section, int old, int new)
 389 {
 390     if (new != 0) {
 391         return;
 392     }
 393
 394     hvf_set_dirty_tracking(section, 0);
 395 }
 396
 397 static void hvf_log_sync(MemoryListener *listener,
 398                          MemoryRegionSection *section)
 399 {
 400     /*
 401      * sync of dirty pages is handled elsewhere; just make sure we keep
 402      * tracking the region.
 403      */
 404     hvf_set_dirty_tracking(section, 1);
 405 }
 406
 407 static void hvf_region_add(MemoryListener *listener,
 408                            MemoryRegionSection *section)
 409 {
 410     hvf_set_phys_mem(section, true);
 411 }
 412
 413 static void hvf_region_del(MemoryListener *listener,
 414                            MemoryRegionSection *section)
 415 {
 416     hvf_set_phys_mem(section, false);
 417 }
 418
 419 static MemoryListener hvf_memory_listener = {
 420     .priority = 10,
 421     .region_add = hvf_region_add,
 422     .region_del = hvf_region_del,
 423     .log_start = hvf_log_start,
 424     .log_stop = hvf_log_stop,
 425     .log_sync = hvf_log_sync,
 426 };
 427
 428 void hvf_reset_vcpu(CPUState *cpu) {
 429
 430     /* TODO: this shouldn't be needed; there is already a call to
 431      * cpu_synchronize_all_post_reset in vl.c
 432      */
 433     wvmcs(cpu->hvf_fd, VMCS_ENTRY_CTLS, 0);
 434     wvmcs(cpu->hvf_fd, VMCS_GUEST_IA32_EFER, 0);
 435     macvm_set_cr0(cpu->hvf_fd, 0x60000010);
 436
 437     wvmcs(cpu->hvf_fd, VMCS_CR4_MASK, CR4_VMXE_MASK);
 438     wvmcs(cpu->hvf_fd, VMCS_CR4_SHADOW, 0x0);
 439     wvmcs(cpu->hvf_fd, VMCS_GUEST_CR4, CR4_VMXE_MASK);
 440
 441     /* set VMCS guest state fields */
 442     wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_SELECTOR, 0xf000);
 443     wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_LIMIT, 0xffff);
 444     wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_ACCESS_RIGHTS, 0x9b);
 445     wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_BASE, 0xffff0000);
 446
 447     wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_SELECTOR, 0);
 448     wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_LIMIT, 0xffff);
 449     wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_ACCESS_RIGHTS, 0x93);
 450     wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_BASE, 0);
 451
 452     wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_SELECTOR, 0);
 453     wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_LIMIT, 0xffff);
 454     wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_ACCESS_RIGHTS, 0x93);
 455     wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_BASE, 0);
 456
 457     wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_SELECTOR, 0);
 458     wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_LIMIT, 0xffff);
 459     wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_ACCESS_RIGHTS, 0x93);
 460     wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_BASE, 0);
 461
 462     wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_SELECTOR, 0);
 463     wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_LIMIT, 0xffff);
 464     wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_ACCESS_RIGHTS, 0x93);
 465     wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_BASE, 0);
 466
 467     wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_SELECTOR, 0);
 468     wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_LIMIT, 0xffff);
 469     wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_ACCESS_RIGHTS, 0x93);
 470     wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_BASE, 0);
 471
 472     wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_SELECTOR, 0);
 473     wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_LIMIT, 0);
 474     wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_ACCESS_RIGHTS, 0x10000);
 475     wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_BASE, 0);
 476
 477     wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_SELECTOR, 0);
 478     wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_LIMIT, 0);
 479     wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_ACCESS_RIGHTS, 0x83);
 480     wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_BASE, 0);
 481
 482     wvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_LIMIT, 0);
 483     wvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_BASE, 0);
 484
 485     wvmcs(cpu->hvf_fd, VMCS_GUEST_IDTR_LIMIT, 0);
 486     wvmcs(cpu->hvf_fd, VMCS_GUEST_IDTR_BASE, 0);
 487
 488     /*wvmcs(cpu->hvf_fd, VMCS_GUEST_CR2, 0x0);*/
 489     wvmcs(cpu->hvf_fd, VMCS_GUEST_CR3, 0x0);
 490
 491     wreg(cpu->hvf_fd, HV_X86_RIP, 0xfff0);
 492     wreg(cpu->hvf_fd, HV_X86_RDX, 0x623);
 493     wreg(cpu->hvf_fd, HV_X86_RFLAGS, 0x2);
 494     wreg(cpu->hvf_fd, HV_X86_RSP, 0x0);
 495     wreg(cpu->hvf_fd, HV_X86_RAX, 0x0);
 496     wreg(cpu->hvf_fd, HV_X86_RBX, 0x0);
 497     wreg(cpu->hvf_fd, HV_X86_RCX, 0x0);
 498     wreg(cpu->hvf_fd, HV_X86_RSI, 0x0);
 499     wreg(cpu->hvf_fd, HV_X86_RDI, 0x0);
 500     wreg(cpu->hvf_fd, HV_X86_RBP, 0x0);
 501
 502     for (int i = 0; i < 8; i++) {
 503         wreg(cpu->hvf_fd, HV_X86_R8 + i, 0x0);
 504     }
 505
 506     hv_vm_sync_tsc(0);
 507     cpu->halted = 0;
 508     hv_vcpu_invalidate_tlb(cpu->hvf_fd);
 509     hv_vcpu_flush(cpu->hvf_fd);
 510 }
 511
 512 void hvf_vcpu_destroy(CPUState *cpu)
 513 {
 514     hv_return_t ret = hv_vcpu_destroy((hv_vcpuid_t)cpu->hvf_fd);
 515     assert_hvf_ok(ret);
 516 }
 517
 518 static void dummy_signal(int sig)
 519 {
 520 }
 521
 522 int hvf_init_vcpu(CPUState *cpu)
 523 {
 524
 525     X86CPU *x86cpu = X86_CPU(cpu);
 526     CPUX86State *env = &x86cpu->env;
 527     int r;
 528
 529     /* init cpu signals */
 530     sigset_t set;
 531     struct sigaction sigact;
 532
 533     memset(&sigact, 0, sizeof(sigact));
 534     sigact.sa_handler = dummy_signal;
 535     sigaction(SIG_IPI, &sigact, NULL);
 536
 537     pthread_sigmask(SIG_BLOCK, NULL, &set);
 538     sigdelset(&set, SIG_IPI);
 539
 540     init_emu();
 541     init_decoder();
 542
 543     hvf_state->hvf_caps = g_new0(struct hvf_vcpu_caps, 1);
 544     env->hvf_emul = g_new0(HVFX86EmulatorState, 1);
 545
 546     r = hv_vcpu_create((hv_vcpuid_t *)&cpu->hvf_fd, HV_VCPU_DEFAULT);
 547     cpu->vcpu_dirty = 1;
 548     assert_hvf_ok(r);
 549
 550     if (hv_vmx_read_capability(HV_VMX_CAP_PINBASED,
 551         &hvf_state->hvf_caps->vmx_cap_pinbased)) {
 552         abort();
 553     }
 554     if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED,
 555         &hvf_state->hvf_caps->vmx_cap_procbased)) {
 556         abort();
 557     }
 558     if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED2,
 559         &hvf_state->hvf_caps->vmx_cap_procbased2)) {
 560         abort();
 561     }
 562     if (hv_vmx_read_capability(HV_VMX_CAP_ENTRY,
 563         &hvf_state->hvf_caps->vmx_cap_entry)) {
 564         abort();
 565     }
 566
 567     /* set VMCS control fields */
 568     wvmcs(cpu->hvf_fd, VMCS_PIN_BASED_CTLS,
 569           cap2ctrl(hvf_state->hvf_caps->vmx_cap_pinbased,
 570           VMCS_PIN_BASED_CTLS_EXTINT |
 571           VMCS_PIN_BASED_CTLS_NMI |
 572           VMCS_PIN_BASED_CTLS_VNMI));
 573     wvmcs(cpu->hvf_fd, VMCS_PRI_PROC_BASED_CTLS,
 574           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased,
 575           VMCS_PRI_PROC_BASED_CTLS_HLT |
 576           VMCS_PRI_PROC_BASED_CTLS_MWAIT |
 577           VMCS_PRI_PROC_BASED_CTLS_TSC_OFFSET |
 578           VMCS_PRI_PROC_BASED_CTLS_TPR_SHADOW) |
 579           VMCS_PRI_PROC_BASED_CTLS_SEC_CONTROL);
 580     wvmcs(cpu->hvf_fd, VMCS_SEC_PROC_BASED_CTLS,
 581           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased2,
 582                    VMCS_PRI_PROC_BASED2_CTLS_APIC_ACCESSES));
 583
 584     wvmcs(cpu->hvf_fd, VMCS_ENTRY_CTLS, cap2ctrl(hvf_state->hvf_caps->vmx_cap_entry,
 585           0));
 586     wvmcs(cpu->hvf_fd, VMCS_EXCEPTION_BITMAP, 0); /* Double fault */
 587
 588     wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0);
 589
 590     hvf_reset_vcpu(cpu);
 591
 592     x86cpu = X86_CPU(cpu);
 593     x86cpu->env.kvm_xsave_buf = qemu_memalign(4096, 4096);
 594
 595     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_STAR, 1);
 596     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_LSTAR, 1);
 597     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_CSTAR, 1);
 598     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FMASK, 1);
 599     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FSBASE, 1);
 600     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_GSBASE, 1);
 601     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_KERNELGSBASE, 1);
 602     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_TSC_AUX, 1);
 603     /*hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_TSC, 1);*/
 604     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_CS, 1);
 605     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_EIP, 1);
 606     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_ESP, 1);
 607
 608     return 0;
 609 }
 610
 611 void hvf_disable(int shouldDisable)
 612 {
 613     hvf_disabled = shouldDisable;
 614 }
 615
 616 static void hvf_store_events(CPUState *cpu, uint32_t ins_len, uint64_t idtvec_info)
 617 {
 618     X86CPU *x86_cpu = X86_CPU(cpu);
 619     CPUX86State *env = &x86_cpu->env;
 620
 621     env->exception_injected = -1;
 622     env->interrupt_injected = -1;
 623     env->nmi_injected = false;
 624     if (idtvec_info & VMCS_IDT_VEC_VALID) {
 625         switch (idtvec_info & VMCS_IDT_VEC_TYPE) {
 626         case VMCS_IDT_VEC_HWINTR:
 627         case VMCS_IDT_VEC_SWINTR:
 628             env->interrupt_injected = idtvec_info & VMCS_IDT_VEC_VECNUM;
 629             break;
 630         case VMCS_IDT_VEC_NMI:
 631             env->nmi_injected = true;
 632             break;
 633         case VMCS_IDT_VEC_HWEXCEPTION:
 634         case VMCS_IDT_VEC_SWEXCEPTION:
 635             env->exception_injected = idtvec_info & VMCS_IDT_VEC_VECNUM;
 636             break;
 637         case VMCS_IDT_VEC_PRIV_SWEXCEPTION:
 638         default:
 639             abort();
 640         }
 641         if ((idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWEXCEPTION ||
 642             (idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWINTR) {
 643             env->ins_len = ins_len;
 644         }
 645         if (idtvec_info & VMCS_INTR_DEL_ERRCODE) {
 646             env->has_error_code = true;
 647             env->error_code = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_ERROR);
 648         }
 649     }
 650     if ((rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) &
 651         VMCS_INTERRUPTIBILITY_NMI_BLOCKING)) {
 652         env->hflags2 |= HF2_NMI_MASK;
 653     } else {
 654         env->hflags2 &= ~HF2_NMI_MASK;
 655     }
 656     if (rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) &
 657          (VMCS_INTERRUPTIBILITY_STI_BLOCKING |
 658          VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING)) {
 659         env->hflags |= HF_INHIBIT_IRQ_MASK;
 660     } else {
 661         env->hflags &= ~HF_INHIBIT_IRQ_MASK;
 662     }
 663 }
 664
 665 int hvf_vcpu_exec(CPUState *cpu)
 666 {
 667     X86CPU *x86_cpu = X86_CPU(cpu);
 668     CPUX86State *env = &x86_cpu->env;
 669     int ret = 0;
 670     uint64_t rip = 0;
 671
 672     cpu->halted = 0;
 673
 674     if (hvf_process_events(cpu)) {
 675         return EXCP_HLT;
 676     }
 677
 678     do {
 679         if (cpu->vcpu_dirty) {
 680             hvf_put_registers(cpu);
 681             cpu->vcpu_dirty = false;
 682         }
 683
 684         if (hvf_inject_interrupts(cpu)) {
 685             return EXCP_INTERRUPT;
 686         }
 687         vmx_update_tpr(cpu);
 688
 689         qemu_mutex_unlock_iothread();
 690         if (!cpu_is_bsp(X86_CPU(cpu)) && cpu->halted) {
 691             qemu_mutex_lock_iothread();
 692             return EXCP_HLT;
 693         }
 694
 695         hv_return_t r  = hv_vcpu_run(cpu->hvf_fd);
 696         assert_hvf_ok(r);
 697
 698         /* handle VMEXIT */
 699         uint64_t exit_reason = rvmcs(cpu->hvf_fd, VMCS_EXIT_REASON);
 700         uint64_t exit_qual = rvmcs(cpu->hvf_fd, VMCS_EXIT_QUALIFICATION);
 701         uint32_t ins_len = (uint32_t)rvmcs(cpu->hvf_fd,
 702                                            VMCS_EXIT_INSTRUCTION_LENGTH);
 703
 704         uint64_t idtvec_info = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO);
 705
 706         hvf_store_events(cpu, ins_len, idtvec_info);
 707         rip = rreg(cpu->hvf_fd, HV_X86_RIP);
 708         RFLAGS(env) = rreg(cpu->hvf_fd, HV_X86_RFLAGS);
 709         env->eflags = RFLAGS(env);
 710
 711         qemu_mutex_lock_iothread();
 712
 713         update_apic_tpr(cpu);
 714         current_cpu = cpu;
 715
 716         ret = 0;
 717         switch (exit_reason) {
 718         case EXIT_REASON_HLT: {
 719             macvm_set_rip(cpu, rip + ins_len);
 720             if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) &&
 721                 (EFLAGS(env) & IF_MASK))
 722                 && !(cpu->interrupt_request & CPU_INTERRUPT_NMI) &&
 723                 !(idtvec_info & VMCS_IDT_VEC_VALID)) {
 724                 cpu->halted = 1;
 725                 ret = EXCP_HLT;
 726             }
 727             ret = EXCP_INTERRUPT;
 728             break;
 729         }
 730         case EXIT_REASON_MWAIT: {
 731             ret = EXCP_INTERRUPT;
 732             break;
 733         }
 734             /* Need to check if MMIO or unmmaped fault */
 735         case EXIT_REASON_EPT_FAULT:
 736         {
 737             hvf_slot *slot;
 738             uint64_t gpa = rvmcs(cpu->hvf_fd, VMCS_GUEST_PHYSICAL_ADDRESS);
 739
 740             if (((idtvec_info & VMCS_IDT_VEC_VALID) == 0) &&
 741                 ((exit_qual & EXIT_QUAL_NMIUDTI) != 0)) {
 742                 vmx_set_nmi_blocking(cpu);
 743             }
 744
 745             slot = hvf_find_overlap_slot(gpa, gpa);
 746             /* mmio */
 747             if (ept_emulation_fault(slot, gpa, exit_qual)) {
 748                 struct x86_decode decode;
 749
 750                 load_regs(cpu);
 751                 env->hvf_emul->fetch_rip = rip;
 752
 753                 decode_instruction(env, &decode);
 754                 exec_instruction(env, &decode);
 755                 store_regs(cpu);
 756                 break;
 757             }
 758             break;
 759         }
 760         case EXIT_REASON_INOUT:
 761         {
 762             uint32_t in = (exit_qual & 8) != 0;
 763             uint32_t size =  (exit_qual & 7) + 1;
 764             uint32_t string =  (exit_qual & 16) != 0;
 765             uint32_t port =  exit_qual >> 16;
 766             /*uint32_t rep = (exit_qual & 0x20) != 0;*/
 767
 768             if (!string && in) {
 769                 uint64_t val = 0;
 770                 load_regs(cpu);
 771                 hvf_handle_io(env, port, &val, 0, size, 1);
 772                 if (size == 1) {
 773                     AL(env) = val;
 774                 } else if (size == 2) {
 775                     AX(env) = val;
 776                 } else if (size == 4) {
 777                     RAX(env) = (uint32_t)val;
 778                 } else {
 779                     RAX(env) = (uint64_t)val;
 780                 }
 781                 RIP(env) += ins_len;
 782                 store_regs(cpu);
 783                 break;
 784             } else if (!string && !in) {
 785                 RAX(env) = rreg(cpu->hvf_fd, HV_X86_RAX);
 786                 hvf_handle_io(env, port, &RAX(env), 1, size, 1);
 787                 macvm_set_rip(cpu, rip + ins_len);
 788                 break;
 789             }
 790             struct x86_decode decode;
 791
 792             load_regs(cpu);
 793             env->hvf_emul->fetch_rip = rip;
 794
 795             decode_instruction(env, &decode);
 796             assert(ins_len == decode.len);
 797             exec_instruction(env, &decode);
 798             store_regs(cpu);
 799
 800             break;
 801         }
 802         case EXIT_REASON_CPUID: {
 803             uint32_t rax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX);
 804             uint32_t rbx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RBX);
 805             uint32_t rcx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX);
 806             uint32_t rdx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX);
 807
 808             cpu_x86_cpuid(env, rax, rcx, &rax, &rbx, &rcx, &rdx);
 809
 810             wreg(cpu->hvf_fd, HV_X86_RAX, rax);
 811             wreg(cpu->hvf_fd, HV_X86_RBX, rbx);
 812             wreg(cpu->hvf_fd, HV_X86_RCX, rcx);
 813             wreg(cpu->hvf_fd, HV_X86_RDX, rdx);
 814
 815             macvm_set_rip(cpu, rip + ins_len);
 816             break;
 817         }
 818         case EXIT_REASON_XSETBV: {
 819             X86CPU *x86_cpu = X86_CPU(cpu);
 820             CPUX86State *env = &x86_cpu->env;
 821             uint32_t eax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX);
 822             uint32_t ecx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX);
 823             uint32_t edx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX);
 824
 825             if (ecx) {
 826                 macvm_set_rip(cpu, rip + ins_len);
 827                 break;
 828             }
 829             env->xcr0 = ((uint64_t)edx << 32) | eax;
 830             wreg(cpu->hvf_fd, HV_X86_XCR0, env->xcr0 | 1);
 831             macvm_set_rip(cpu, rip + ins_len);
 832             break;
 833         }
 834         case EXIT_REASON_INTR_WINDOW:
 835             vmx_clear_int_window_exiting(cpu);
 836             ret = EXCP_INTERRUPT;
 837             break;
 838         case EXIT_REASON_NMI_WINDOW:
 839             vmx_clear_nmi_window_exiting(cpu);
 840             ret = EXCP_INTERRUPT;
 841             break;
 842         case EXIT_REASON_EXT_INTR:
 843             /* force exit and allow io handling */
 844             ret = EXCP_INTERRUPT;
 845             break;
 846         case EXIT_REASON_RDMSR:
 847         case EXIT_REASON_WRMSR:
 848         {
 849             load_regs(cpu);
 850             if (exit_reason == EXIT_REASON_RDMSR) {
 851                 simulate_rdmsr(cpu);
 852             } else {
 853                 simulate_wrmsr(cpu);
 854             }
 855             RIP(env) += rvmcs(cpu->hvf_fd, VMCS_EXIT_INSTRUCTION_LENGTH);
 856             store_regs(cpu);
 857             break;
 858         }
 859         case EXIT_REASON_CR_ACCESS: {
 860             int cr;
 861             int reg;
 862
 863             load_regs(cpu);
 864             cr = exit_qual & 15;
 865             reg = (exit_qual >> 8) & 15;
 866
 867             switch (cr) {
 868             case 0x0: {
 869                 macvm_set_cr0(cpu->hvf_fd, RRX(env, reg));
 870                 break;
 871             }
 872             case 4: {
 873                 macvm_set_cr4(cpu->hvf_fd, RRX(env, reg));
 874                 break;
 875             }
 876             case 8: {
 877                 X86CPU *x86_cpu = X86_CPU(cpu);
 878                 if (exit_qual & 0x10) {
 879                     RRX(env, reg) = cpu_get_apic_tpr(x86_cpu->apic_state);
 880                 } else {
 881                     int tpr = RRX(env, reg);
 882                     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
 883                     ret = EXCP_INTERRUPT;
 884                 }
 885                 break;
 886             }
 887             default:
 888                 error_report("Unrecognized CR %d\n", cr);
 889                 abort();
 890             }
 891             RIP(env) += ins_len;
 892             store_regs(cpu);
 893             break;
 894         }
 895         case EXIT_REASON_APIC_ACCESS: { /* TODO */
 896             struct x86_decode decode;
 897
 898             load_regs(cpu);
 899             env->hvf_emul->fetch_rip = rip;
 900
 901             decode_instruction(env, &decode);
 902             exec_instruction(env, &decode);
 903             store_regs(cpu);
 904             break;
 905         }
 906         case EXIT_REASON_TPR: {
 907             ret = 1;
 908             break;
 909         }
 910         case EXIT_REASON_TASK_SWITCH: {
 911             uint64_t vinfo = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO);
 912             x68_segment_selector sel = {.sel = exit_qual & 0xffff};
 913             vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3,
 914              vinfo & VMCS_INTR_VALID, vinfo & VECTORING_INFO_VECTOR_MASK, vinfo
 915              & VMCS_INTR_T_MASK);
 916             break;
 917         }
 918         case EXIT_REASON_TRIPLE_FAULT: {
 919             qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
 920             ret = EXCP_INTERRUPT;
 921             break;
 922         }
 923         case EXIT_REASON_RDPMC:
 924             wreg(cpu->hvf_fd, HV_X86_RAX, 0);
 925             wreg(cpu->hvf_fd, HV_X86_RDX, 0);
 926             macvm_set_rip(cpu, rip + ins_len);
 927             break;
 928         case VMX_REASON_VMCALL:
 929             env->exception_injected = EXCP0D_GPF;
 930             env->has_error_code = true;
 931             env->error_code = 0;
 932             break;
 933         default:
 934             error_report("%llx: unhandled exit %llx\n", rip, exit_reason);
 935         }
 936     } while (ret == 0);
 937
 938     return ret;
 939 }
 940
 941 static bool hvf_allowed;
 942
 943 static int hvf_accel_init(MachineState *ms)
 944 {
 945     int x;
 946     hv_return_t ret;
 947     HVFState *s;
 948
 949     hvf_disable(0);
 950     ret = hv_vm_create(HV_VM_DEFAULT);
 951     assert_hvf_ok(ret);
 952
 953     s = g_new0(HVFState, 1);
 954
 955     s->num_slots = 32;
 956     for (x = 0; x < s->num_slots; ++x) {
 957         s->slots[x].size = 0;
 958         s->slots[x].slot_id = x;
 959     }
 960
 961     hvf_state = s;
 962     cpu_interrupt_handler = hvf_handle_interrupt;
 963     memory_listener_register(&hvf_memory_listener, &address_space_memory);
 964     return 0;
 965 }
 966
 967 static void hvf_accel_class_init(ObjectClass *oc, void *data)
 968 {
 969     AccelClass *ac = ACCEL_CLASS(oc);
 970     ac->name = "HVF";
 971     ac->init_machine = hvf_accel_init;
 972     ac->allowed = &hvf_allowed;
 973 }
 974
 975 static const TypeInfo hvf_accel_type = {
 976     .name = TYPE_HVF_ACCEL,
 977     .parent = TYPE_ACCEL,
 978     .class_init = hvf_accel_class_init,
 979 };
 980
 981 static void hvf_type_init(void)
 982 {
 983     type_register_static(&hvf_accel_type);
 984 }
 985
 986 type_init(hvf_type_init);