target/i386/hvf/hvf.c

   1 /* Copyright 2008 IBM Corporation
   2  *           2008 Red Hat, Inc.
   3  * Copyright 2011 Intel Corporation
   4  * Copyright 2016 Veertu, Inc.
   5  * Copyright 2017 The Android Open Source Project
   6  *
   7  * QEMU Hypervisor.framework support
   8  *
   9  * This program is free software; you can redistribute it and/or
  10  * modify it under the terms of version 2 of the GNU General Public
  11  * License as published by the Free Software Foundation.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  20  *
  21  * This file contain code under public domain from the hvdos project:
  22  * https://github.com/mist64/hvdos
  23  *
  24  * Parts Copyright (c) 2011 NetApp, Inc.
  25  * All rights reserved.
  26  *
  27  * Redistribution and use in source and binary forms, with or without
  28  * modification, are permitted provided that the following conditions
  29  * are met:
  30  * 1. Redistributions of source code must retain the above copyright
  31  *    notice, this list of conditions and the following disclaimer.
  32  * 2. Redistributions in binary form must reproduce the above copyright
  33  *    notice, this list of conditions and the following disclaimer in the
  34  *    documentation and/or other materials provided with the distribution.
  35  *
  36  * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
  37  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  38  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  39  * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
  40  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  41  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  42  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  43  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  44  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  45  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  46  * SUCH DAMAGE.
  47  */
  48
  49 #include "qemu/osdep.h"
  50 #include "qemu-common.h"
  51 #include "qemu/error-report.h"
  52
  53 #include "sysemu/hvf.h"
  54 #include "sysemu/runstate.h"
  55 #include "hvf-i386.h"
  56 #include "vmcs.h"
  57 #include "vmx.h"
  58 #include "x86.h"
  59 #include "x86_descr.h"
  60 #include "x86_mmu.h"
  61 #include "x86_decode.h"
  62 #include "x86_emu.h"
  63 #include "x86_task.h"
  64 #include "x86hvf.h"
  65
  66 #include <Hypervisor/hv.h>
  67 #include <Hypervisor/hv_vmx.h>
  68
  69 #include "exec/address-spaces.h"
  70 #include "hw/i386/apic_internal.h"
  71 #include "qemu/main-loop.h"
  72 #include "sysemu/accel.h"
  73 #include "target/i386/cpu.h"
  74
  75 HVFState *hvf_state;
  76
  77 static void assert_hvf_ok(hv_return_t ret)
  78 {
  79     if (ret == HV_SUCCESS) {
  80         return;
  81     }
  82
  83     switch (ret) {
  84     case HV_ERROR:
  85         error_report("Error: HV_ERROR");
  86         break;
  87     case HV_BUSY:
  88         error_report("Error: HV_BUSY");
  89         break;
  90     case HV_BAD_ARGUMENT:
  91         error_report("Error: HV_BAD_ARGUMENT");
  92         break;
  93     case HV_NO_RESOURCES:
  94         error_report("Error: HV_NO_RESOURCES");
  95         break;
  96     case HV_NO_DEVICE:
  97         error_report("Error: HV_NO_DEVICE");
  98         break;
  99     case HV_UNSUPPORTED:
 100         error_report("Error: HV_UNSUPPORTED");
 101         break;
 102     default:
 103         error_report("Unknown Error");
 104     }
 105
 106     abort();
 107 }
 108
 109 /* Memory slots */
 110 hvf_slot *hvf_find_overlap_slot(uint64_t start, uint64_t size)
 111 {
 112     hvf_slot *slot;
 113     int x;
 114     for (x = 0; x < hvf_state->num_slots; ++x) {
 115         slot = &hvf_state->slots[x];
 116         if (slot->size && start < (slot->start + slot->size) &&
 117             (start + size) > slot->start) {
 118             return slot;
 119         }
 120     }
 121     return NULL;
 122 }
 123
 124 struct mac_slot {
 125     int present;
 126     uint64_t size;
 127     uint64_t gpa_start;
 128     uint64_t gva;
 129 };
 130
 131 struct mac_slot mac_slots[32];
 132
 133 static int do_hvf_set_memory(hvf_slot *slot, hv_memory_flags_t flags)
 134 {
 135     struct mac_slot *macslot;
 136     hv_return_t ret;
 137
 138     macslot = &mac_slots[slot->slot_id];
 139
 140     if (macslot->present) {
 141         if (macslot->size != slot->size) {
 142             macslot->present = 0;
 143             ret = hv_vm_unmap(macslot->gpa_start, macslot->size);
 144             assert_hvf_ok(ret);
 145         }
 146     }
 147
 148     if (!slot->size) {
 149         return 0;
 150     }
 151
 152     macslot->present = 1;
 153     macslot->gpa_start = slot->start;
 154     macslot->size = slot->size;
 155     ret = hv_vm_map((hv_uvaddr_t)slot->mem, slot->start, slot->size, flags);
 156     assert_hvf_ok(ret);
 157     return 0;
 158 }
 159
 160 void hvf_set_phys_mem(MemoryRegionSection *section, bool add)
 161 {
 162     hvf_slot *mem;
 163     MemoryRegion *area = section->mr;
 164     bool writeable = !area->readonly && !area->rom_device;
 165     hv_memory_flags_t flags;
 166
 167     if (!memory_region_is_ram(area)) {
 168         if (writeable) {
 169             return;
 170         } else if (!memory_region_is_romd(area)) {
 171             /*
 172              * If the memory device is not in romd_mode, then we actually want
 173              * to remove the hvf memory slot so all accesses will trap.
 174              */
 175              add = false;
 176         }
 177     }
 178
 179     mem = hvf_find_overlap_slot(
 180             section->offset_within_address_space,
 181             int128_get64(section->size));
 182
 183     if (mem && add) {
 184         if (mem->size == int128_get64(section->size) &&
 185             mem->start == section->offset_within_address_space &&
 186             mem->mem == (memory_region_get_ram_ptr(area) +
 187             section->offset_within_region)) {
 188             return; /* Same region was attempted to register, go away. */
 189         }
 190     }
 191
 192     /* Region needs to be reset. set the size to 0 and remap it. */
 193     if (mem) {
 194         mem->size = 0;
 195         if (do_hvf_set_memory(mem, 0)) {
 196             error_report("Failed to reset overlapping slot");
 197             abort();
 198         }
 199     }
 200
 201     if (!add) {
 202         return;
 203     }
 204
 205     if (area->readonly ||
 206         (!memory_region_is_ram(area) && memory_region_is_romd(area))) {
 207         flags = HV_MEMORY_READ | HV_MEMORY_EXEC;
 208     } else {
 209         flags = HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC;
 210     }
 211
 212     /* Now make a new slot. */
 213     int x;
 214
 215     for (x = 0; x < hvf_state->num_slots; ++x) {
 216         mem = &hvf_state->slots[x];
 217         if (!mem->size) {
 218             break;
 219         }
 220     }
 221
 222     if (x == hvf_state->num_slots) {
 223         error_report("No free slots");
 224         abort();
 225     }
 226
 227     mem->size = int128_get64(section->size);
 228     mem->mem = memory_region_get_ram_ptr(area) + section->offset_within_region;
 229     mem->start = section->offset_within_address_space;
 230     mem->region = area;
 231
 232     if (do_hvf_set_memory(mem, flags)) {
 233         error_report("Error registering new memory slot");
 234         abort();
 235     }
 236 }
 237
 238 void vmx_update_tpr(CPUState *cpu)
 239 {
 240     /* TODO: need integrate APIC handling */
 241     X86CPU *x86_cpu = X86_CPU(cpu);
 242     int tpr = cpu_get_apic_tpr(x86_cpu->apic_state) << 4;
 243     int irr = apic_get_highest_priority_irr(x86_cpu->apic_state);
 244
 245     wreg(cpu->hvf_fd, HV_X86_TPR, tpr);
 246     if (irr == -1) {
 247         wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0);
 248     } else {
 249         wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, (irr > tpr) ? tpr >> 4 :
 250               irr >> 4);
 251     }
 252 }
 253
 254 static void update_apic_tpr(CPUState *cpu)
 255 {
 256     X86CPU *x86_cpu = X86_CPU(cpu);
 257     int tpr = rreg(cpu->hvf_fd, HV_X86_TPR) >> 4;
 258     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
 259 }
 260
 261 #define VECTORING_INFO_VECTOR_MASK     0xff
 262
 263 static void hvf_handle_interrupt(CPUState * cpu, int mask)
 264 {
 265     cpu->interrupt_request |= mask;
 266     if (!qemu_cpu_is_self(cpu)) {
 267         qemu_cpu_kick(cpu);
 268     }
 269 }
 270
 271 void hvf_handle_io(CPUArchState *env, uint16_t port, void *buffer,
 272                   int direction, int size, int count)
 273 {
 274     int i;
 275     uint8_t *ptr = buffer;
 276
 277     for (i = 0; i < count; i++) {
 278         address_space_rw(&address_space_io, port, MEMTXATTRS_UNSPECIFIED,
 279                          ptr, size,
 280                          direction);
 281         ptr += size;
 282     }
 283 }
 284
 285 /* TODO: synchronize vcpu state */
 286 static void do_hvf_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
 287 {
 288     CPUState *cpu_state = cpu;
 289     if (cpu_state->vcpu_dirty == 0) {
 290         hvf_get_registers(cpu_state);
 291     }
 292
 293     cpu_state->vcpu_dirty = 1;
 294 }
 295
 296 void hvf_cpu_synchronize_state(CPUState *cpu_state)
 297 {
 298     if (cpu_state->vcpu_dirty == 0) {
 299         run_on_cpu(cpu_state, do_hvf_cpu_synchronize_state, RUN_ON_CPU_NULL);
 300     }
 301 }
 302
 303 static void do_hvf_cpu_synchronize_post_reset(CPUState *cpu, run_on_cpu_data arg)
 304 {
 305     CPUState *cpu_state = cpu;
 306     hvf_put_registers(cpu_state);
 307     cpu_state->vcpu_dirty = false;
 308 }
 309
 310 void hvf_cpu_synchronize_post_reset(CPUState *cpu_state)
 311 {
 312     run_on_cpu(cpu_state, do_hvf_cpu_synchronize_post_reset, RUN_ON_CPU_NULL);
 313 }
 314
 315 static void do_hvf_cpu_synchronize_post_init(CPUState *cpu,
 316                                              run_on_cpu_data arg)
 317 {
 318     CPUState *cpu_state = cpu;
 319     hvf_put_registers(cpu_state);
 320     cpu_state->vcpu_dirty = false;
 321 }
 322
 323 void hvf_cpu_synchronize_post_init(CPUState *cpu_state)
 324 {
 325     run_on_cpu(cpu_state, do_hvf_cpu_synchronize_post_init, RUN_ON_CPU_NULL);
 326 }
 327
 328 static bool ept_emulation_fault(hvf_slot *slot, uint64_t gpa, uint64_t ept_qual)
 329 {
 330     int read, write;
 331
 332     /* EPT fault on an instruction fetch doesn't make sense here */
 333     if (ept_qual & EPT_VIOLATION_INST_FETCH) {
 334         return false;
 335     }
 336
 337     /* EPT fault must be a read fault or a write fault */
 338     read = ept_qual & EPT_VIOLATION_DATA_READ ? 1 : 0;
 339     write = ept_qual & EPT_VIOLATION_DATA_WRITE ? 1 : 0;
 340     if ((read | write) == 0) {
 341         return false;
 342     }
 343
 344     if (write && slot) {
 345         if (slot->flags & HVF_SLOT_LOG) {
 346             memory_region_set_dirty(slot->region, gpa - slot->start, 1);
 347             hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size,
 348                           HV_MEMORY_READ | HV_MEMORY_WRITE);
 349         }
 350     }
 351
 352     /*
 353      * The EPT violation must have been caused by accessing a
 354      * guest-physical address that is a translation of a guest-linear
 355      * address.
 356      */
 357     if ((ept_qual & EPT_VIOLATION_GLA_VALID) == 0 ||
 358         (ept_qual & EPT_VIOLATION_XLAT_VALID) == 0) {
 359         return false;
 360     }
 361
 362     if (!slot) {
 363         return true;
 364     }
 365     if (!memory_region_is_ram(slot->region) &&
 366         !(read && memory_region_is_romd(slot->region))) {
 367         return true;
 368     }
 369     return false;
 370 }
 371
 372 static void hvf_set_dirty_tracking(MemoryRegionSection *section, bool on)
 373 {
 374     hvf_slot *slot;
 375
 376     slot = hvf_find_overlap_slot(
 377             section->offset_within_address_space,
 378             int128_get64(section->size));
 379
 380     /* protect region against writes; begin tracking it */
 381     if (on) {
 382         slot->flags |= HVF_SLOT_LOG;
 383         hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size,
 384                       HV_MEMORY_READ);
 385     /* stop tracking region*/
 386     } else {
 387         slot->flags &= ~HVF_SLOT_LOG;
 388         hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size,
 389                       HV_MEMORY_READ | HV_MEMORY_WRITE);
 390     }
 391 }
 392
 393 static void hvf_log_start(MemoryListener *listener,
 394                           MemoryRegionSection *section, int old, int new)
 395 {
 396     if (old != 0) {
 397         return;
 398     }
 399
 400     hvf_set_dirty_tracking(section, 1);
 401 }
 402
 403 static void hvf_log_stop(MemoryListener *listener,
 404                          MemoryRegionSection *section, int old, int new)
 405 {
 406     if (new != 0) {
 407         return;
 408     }
 409
 410     hvf_set_dirty_tracking(section, 0);
 411 }
 412
 413 static void hvf_log_sync(MemoryListener *listener,
 414                          MemoryRegionSection *section)
 415 {
 416     /*
 417      * sync of dirty pages is handled elsewhere; just make sure we keep
 418      * tracking the region.
 419      */
 420     hvf_set_dirty_tracking(section, 1);
 421 }
 422
 423 static void hvf_region_add(MemoryListener *listener,
 424                            MemoryRegionSection *section)
 425 {
 426     hvf_set_phys_mem(section, true);
 427 }
 428
 429 static void hvf_region_del(MemoryListener *listener,
 430                            MemoryRegionSection *section)
 431 {
 432     hvf_set_phys_mem(section, false);
 433 }
 434
 435 static MemoryListener hvf_memory_listener = {
 436     .priority = 10,
 437     .region_add = hvf_region_add,
 438     .region_del = hvf_region_del,
 439     .log_start = hvf_log_start,
 440     .log_stop = hvf_log_stop,
 441     .log_sync = hvf_log_sync,
 442 };
 443
 444 void hvf_reset_vcpu(CPUState *cpu) {
 445     uint64_t pdpte[4] = {0, 0, 0, 0};
 446     int i;
 447
 448     /* TODO: this shouldn't be needed; there is already a call to
 449      * cpu_synchronize_all_post_reset in vl.c
 450      */
 451     wvmcs(cpu->hvf_fd, VMCS_ENTRY_CTLS, 0);
 452     wvmcs(cpu->hvf_fd, VMCS_GUEST_IA32_EFER, 0);
 453
 454     /* Initialize PDPTE */
 455     for (i = 0; i < 4; i++) {
 456         wvmcs(cpu->hvf_fd, VMCS_GUEST_PDPTE0 + i * 2, pdpte[i]);
 457     }
 458
 459     macvm_set_cr0(cpu->hvf_fd, 0x60000010);
 460
 461     wvmcs(cpu->hvf_fd, VMCS_CR4_MASK, CR4_VMXE_MASK);
 462     wvmcs(cpu->hvf_fd, VMCS_CR4_SHADOW, 0x0);
 463     wvmcs(cpu->hvf_fd, VMCS_GUEST_CR4, CR4_VMXE_MASK);
 464
 465     /* set VMCS guest state fields */
 466     wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_SELECTOR, 0xf000);
 467     wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_LIMIT, 0xffff);
 468     wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_ACCESS_RIGHTS, 0x9b);
 469     wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_BASE, 0xffff0000);
 470
 471     wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_SELECTOR, 0);
 472     wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_LIMIT, 0xffff);
 473     wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_ACCESS_RIGHTS, 0x93);
 474     wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_BASE, 0);
 475
 476     wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_SELECTOR, 0);
 477     wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_LIMIT, 0xffff);
 478     wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_ACCESS_RIGHTS, 0x93);
 479     wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_BASE, 0);
 480
 481     wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_SELECTOR, 0);
 482     wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_LIMIT, 0xffff);
 483     wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_ACCESS_RIGHTS, 0x93);
 484     wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_BASE, 0);
 485
 486     wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_SELECTOR, 0);
 487     wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_LIMIT, 0xffff);
 488     wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_ACCESS_RIGHTS, 0x93);
 489     wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_BASE, 0);
 490
 491     wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_SELECTOR, 0);
 492     wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_LIMIT, 0xffff);
 493     wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_ACCESS_RIGHTS, 0x93);
 494     wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_BASE, 0);
 495
 496     wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_SELECTOR, 0);
 497     wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_LIMIT, 0);
 498     wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_ACCESS_RIGHTS, 0x10000);
 499     wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_BASE, 0);
 500
 501     wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_SELECTOR, 0);
 502     wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_LIMIT, 0);
 503     wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_ACCESS_RIGHTS, 0x83);
 504     wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_BASE, 0);
 505
 506     wvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_LIMIT, 0);
 507     wvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_BASE, 0);
 508
 509     wvmcs(cpu->hvf_fd, VMCS_GUEST_IDTR_LIMIT, 0);
 510     wvmcs(cpu->hvf_fd, VMCS_GUEST_IDTR_BASE, 0);
 511
 512     /*wvmcs(cpu->hvf_fd, VMCS_GUEST_CR2, 0x0);*/
 513     wvmcs(cpu->hvf_fd, VMCS_GUEST_CR3, 0x0);
 514
 515     wreg(cpu->hvf_fd, HV_X86_RIP, 0xfff0);
 516     wreg(cpu->hvf_fd, HV_X86_RDX, 0x623);
 517     wreg(cpu->hvf_fd, HV_X86_RFLAGS, 0x2);
 518     wreg(cpu->hvf_fd, HV_X86_RSP, 0x0);
 519     wreg(cpu->hvf_fd, HV_X86_RAX, 0x0);
 520     wreg(cpu->hvf_fd, HV_X86_RBX, 0x0);
 521     wreg(cpu->hvf_fd, HV_X86_RCX, 0x0);
 522     wreg(cpu->hvf_fd, HV_X86_RSI, 0x0);
 523     wreg(cpu->hvf_fd, HV_X86_RDI, 0x0);
 524     wreg(cpu->hvf_fd, HV_X86_RBP, 0x0);
 525
 526     for (int i = 0; i < 8; i++) {
 527         wreg(cpu->hvf_fd, HV_X86_R8 + i, 0x0);
 528     }
 529
 530     hv_vcpu_invalidate_tlb(cpu->hvf_fd);
 531     hv_vcpu_flush(cpu->hvf_fd);
 532 }
 533
 534 void hvf_vcpu_destroy(CPUState *cpu)
 535 {
 536     hv_return_t ret = hv_vcpu_destroy((hv_vcpuid_t)cpu->hvf_fd);
 537     assert_hvf_ok(ret);
 538 }
 539
 540 static void dummy_signal(int sig)
 541 {
 542 }
 543
 544 int hvf_init_vcpu(CPUState *cpu)
 545 {
 546
 547     X86CPU *x86cpu = X86_CPU(cpu);
 548     CPUX86State *env = &x86cpu->env;
 549     int r;
 550
 551     /* init cpu signals */
 552     sigset_t set;
 553     struct sigaction sigact;
 554
 555     memset(&sigact, 0, sizeof(sigact));
 556     sigact.sa_handler = dummy_signal;
 557     sigaction(SIG_IPI, &sigact, NULL);
 558
 559     pthread_sigmask(SIG_BLOCK, NULL, &set);
 560     sigdelset(&set, SIG_IPI);
 561
 562     init_emu();
 563     init_decoder();
 564
 565     hvf_state->hvf_caps = g_new0(struct hvf_vcpu_caps, 1);
 566     env->hvf_emul = g_new0(HVFX86EmulatorState, 1);
 567
 568     r = hv_vcpu_create((hv_vcpuid_t *)&cpu->hvf_fd, HV_VCPU_DEFAULT);
 569     cpu->vcpu_dirty = 1;
 570     assert_hvf_ok(r);
 571
 572     if (hv_vmx_read_capability(HV_VMX_CAP_PINBASED,
 573         &hvf_state->hvf_caps->vmx_cap_pinbased)) {
 574         abort();
 575     }
 576     if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED,
 577         &hvf_state->hvf_caps->vmx_cap_procbased)) {
 578         abort();
 579     }
 580     if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED2,
 581         &hvf_state->hvf_caps->vmx_cap_procbased2)) {
 582         abort();
 583     }
 584     if (hv_vmx_read_capability(HV_VMX_CAP_ENTRY,
 585         &hvf_state->hvf_caps->vmx_cap_entry)) {
 586         abort();
 587     }
 588
 589     /* set VMCS control fields */
 590     wvmcs(cpu->hvf_fd, VMCS_PIN_BASED_CTLS,
 591           cap2ctrl(hvf_state->hvf_caps->vmx_cap_pinbased,
 592           VMCS_PIN_BASED_CTLS_EXTINT |
 593           VMCS_PIN_BASED_CTLS_NMI |
 594           VMCS_PIN_BASED_CTLS_VNMI));
 595     wvmcs(cpu->hvf_fd, VMCS_PRI_PROC_BASED_CTLS,
 596           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased,
 597           VMCS_PRI_PROC_BASED_CTLS_HLT |
 598           VMCS_PRI_PROC_BASED_CTLS_MWAIT |
 599           VMCS_PRI_PROC_BASED_CTLS_TSC_OFFSET |
 600           VMCS_PRI_PROC_BASED_CTLS_TPR_SHADOW) |
 601           VMCS_PRI_PROC_BASED_CTLS_SEC_CONTROL);
 602     wvmcs(cpu->hvf_fd, VMCS_SEC_PROC_BASED_CTLS,
 603           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased2,
 604                    VMCS_PRI_PROC_BASED2_CTLS_APIC_ACCESSES));
 605
 606     wvmcs(cpu->hvf_fd, VMCS_ENTRY_CTLS, cap2ctrl(hvf_state->hvf_caps->vmx_cap_entry,
 607           0));
 608     wvmcs(cpu->hvf_fd, VMCS_EXCEPTION_BITMAP, 0); /* Double fault */
 609
 610     wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0);
 611
 612     x86cpu = X86_CPU(cpu);
 613     x86cpu->env.xsave_buf = qemu_memalign(4096, 4096);
 614
 615     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_STAR, 1);
 616     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_LSTAR, 1);
 617     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_CSTAR, 1);
 618     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FMASK, 1);
 619     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FSBASE, 1);
 620     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_GSBASE, 1);
 621     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_KERNELGSBASE, 1);
 622     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_TSC_AUX, 1);
 623     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_TSC, 1);
 624     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_CS, 1);
 625     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_EIP, 1);
 626     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_ESP, 1);
 627
 628     return 0;
 629 }
 630
 631 static void hvf_store_events(CPUState *cpu, uint32_t ins_len, uint64_t idtvec_info)
 632 {
 633     X86CPU *x86_cpu = X86_CPU(cpu);
 634     CPUX86State *env = &x86_cpu->env;
 635
 636     env->exception_nr = -1;
 637     env->exception_pending = 0;
 638     env->exception_injected = 0;
 639     env->interrupt_injected = -1;
 640     env->nmi_injected = false;
 641     env->ins_len = 0;
 642     env->has_error_code = false;
 643     if (idtvec_info & VMCS_IDT_VEC_VALID) {
 644         switch (idtvec_info & VMCS_IDT_VEC_TYPE) {
 645         case VMCS_IDT_VEC_HWINTR:
 646         case VMCS_IDT_VEC_SWINTR:
 647             env->interrupt_injected = idtvec_info & VMCS_IDT_VEC_VECNUM;
 648             break;
 649         case VMCS_IDT_VEC_NMI:
 650             env->nmi_injected = true;
 651             break;
 652         case VMCS_IDT_VEC_HWEXCEPTION:
 653         case VMCS_IDT_VEC_SWEXCEPTION:
 654             env->exception_nr = idtvec_info & VMCS_IDT_VEC_VECNUM;
 655             env->exception_injected = 1;
 656             break;
 657         case VMCS_IDT_VEC_PRIV_SWEXCEPTION:
 658         default:
 659             abort();
 660         }
 661         if ((idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWEXCEPTION ||
 662             (idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWINTR) {
 663             env->ins_len = ins_len;
 664         }
 665         if (idtvec_info & VMCS_IDT_VEC_ERRCODE_VALID) {
 666             env->has_error_code = true;
 667             env->error_code = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_ERROR);
 668         }
 669     }
 670     if ((rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) &
 671         VMCS_INTERRUPTIBILITY_NMI_BLOCKING)) {
 672         env->hflags2 |= HF2_NMI_MASK;
 673     } else {
 674         env->hflags2 &= ~HF2_NMI_MASK;
 675     }
 676     if (rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) &
 677          (VMCS_INTERRUPTIBILITY_STI_BLOCKING |
 678          VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING)) {
 679         env->hflags |= HF_INHIBIT_IRQ_MASK;
 680     } else {
 681         env->hflags &= ~HF_INHIBIT_IRQ_MASK;
 682     }
 683 }
 684
 685 int hvf_vcpu_exec(CPUState *cpu)
 686 {
 687     X86CPU *x86_cpu = X86_CPU(cpu);
 688     CPUX86State *env = &x86_cpu->env;
 689     int ret = 0;
 690     uint64_t rip = 0;
 691
 692     if (hvf_process_events(cpu)) {
 693         return EXCP_HLT;
 694     }
 695
 696     do {
 697         if (cpu->vcpu_dirty) {
 698             hvf_put_registers(cpu);
 699             cpu->vcpu_dirty = false;
 700         }
 701
 702         if (hvf_inject_interrupts(cpu)) {
 703             return EXCP_INTERRUPT;
 704         }
 705         vmx_update_tpr(cpu);
 706
 707         qemu_mutex_unlock_iothread();
 708         if (!cpu_is_bsp(X86_CPU(cpu)) && cpu->halted) {
 709             qemu_mutex_lock_iothread();
 710             return EXCP_HLT;
 711         }
 712
 713         hv_return_t r  = hv_vcpu_run(cpu->hvf_fd);
 714         assert_hvf_ok(r);
 715
 716         /* handle VMEXIT */
 717         uint64_t exit_reason = rvmcs(cpu->hvf_fd, VMCS_EXIT_REASON);
 718         uint64_t exit_qual = rvmcs(cpu->hvf_fd, VMCS_EXIT_QUALIFICATION);
 719         uint32_t ins_len = (uint32_t)rvmcs(cpu->hvf_fd,
 720                                            VMCS_EXIT_INSTRUCTION_LENGTH);
 721
 722         uint64_t idtvec_info = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO);
 723
 724         hvf_store_events(cpu, ins_len, idtvec_info);
 725         rip = rreg(cpu->hvf_fd, HV_X86_RIP);
 726         RFLAGS(env) = rreg(cpu->hvf_fd, HV_X86_RFLAGS);
 727         env->eflags = RFLAGS(env);
 728
 729         qemu_mutex_lock_iothread();
 730
 731         update_apic_tpr(cpu);
 732         current_cpu = cpu;
 733
 734         ret = 0;
 735         switch (exit_reason) {
 736         case EXIT_REASON_HLT: {
 737             macvm_set_rip(cpu, rip + ins_len);
 738             if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) &&
 739                 (EFLAGS(env) & IF_MASK))
 740                 && !(cpu->interrupt_request & CPU_INTERRUPT_NMI) &&
 741                 !(idtvec_info & VMCS_IDT_VEC_VALID)) {
 742                 cpu->halted = 1;
 743                 ret = EXCP_HLT;
 744                 break;
 745             }
 746             ret = EXCP_INTERRUPT;
 747             break;
 748         }
 749         case EXIT_REASON_MWAIT: {
 750             ret = EXCP_INTERRUPT;
 751             break;
 752         }
 753         /* Need to check if MMIO or unmapped fault */
 754         case EXIT_REASON_EPT_FAULT:
 755         {
 756             hvf_slot *slot;
 757             uint64_t gpa = rvmcs(cpu->hvf_fd, VMCS_GUEST_PHYSICAL_ADDRESS);
 758
 759             if (((idtvec_info & VMCS_IDT_VEC_VALID) == 0) &&
 760                 ((exit_qual & EXIT_QUAL_NMIUDTI) != 0)) {
 761                 vmx_set_nmi_blocking(cpu);
 762             }
 763
 764             slot = hvf_find_overlap_slot(gpa, 1);
 765             /* mmio */
 766             if (ept_emulation_fault(slot, gpa, exit_qual)) {
 767                 struct x86_decode decode;
 768
 769                 load_regs(cpu);
 770                 env->hvf_emul->fetch_rip = rip;
 771
 772                 decode_instruction(env, &decode);
 773                 exec_instruction(env, &decode);
 774                 store_regs(cpu);
 775                 break;
 776             }
 777             break;
 778         }
 779         case EXIT_REASON_INOUT:
 780         {
 781             uint32_t in = (exit_qual & 8) != 0;
 782             uint32_t size =  (exit_qual & 7) + 1;
 783             uint32_t string =  (exit_qual & 16) != 0;
 784             uint32_t port =  exit_qual >> 16;
 785             /*uint32_t rep = (exit_qual & 0x20) != 0;*/
 786
 787             if (!string && in) {
 788                 uint64_t val = 0;
 789                 load_regs(cpu);
 790                 hvf_handle_io(env, port, &val, 0, size, 1);
 791                 if (size == 1) {
 792                     AL(env) = val;
 793                 } else if (size == 2) {
 794                     AX(env) = val;
 795                 } else if (size == 4) {
 796                     RAX(env) = (uint32_t)val;
 797                 } else {
 798                     RAX(env) = (uint64_t)val;
 799                 }
 800                 RIP(env) += ins_len;
 801                 store_regs(cpu);
 802                 break;
 803             } else if (!string && !in) {
 804                 RAX(env) = rreg(cpu->hvf_fd, HV_X86_RAX);
 805                 hvf_handle_io(env, port, &RAX(env), 1, size, 1);
 806                 macvm_set_rip(cpu, rip + ins_len);
 807                 break;
 808             }
 809             struct x86_decode decode;
 810
 811             load_regs(cpu);
 812             env->hvf_emul->fetch_rip = rip;
 813
 814             decode_instruction(env, &decode);
 815             assert(ins_len == decode.len);
 816             exec_instruction(env, &decode);
 817             store_regs(cpu);
 818
 819             break;
 820         }
 821         case EXIT_REASON_CPUID: {
 822             uint32_t rax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX);
 823             uint32_t rbx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RBX);
 824             uint32_t rcx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX);
 825             uint32_t rdx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX);
 826
 827             cpu_x86_cpuid(env, rax, rcx, &rax, &rbx, &rcx, &rdx);
 828
 829             wreg(cpu->hvf_fd, HV_X86_RAX, rax);
 830             wreg(cpu->hvf_fd, HV_X86_RBX, rbx);
 831             wreg(cpu->hvf_fd, HV_X86_RCX, rcx);
 832             wreg(cpu->hvf_fd, HV_X86_RDX, rdx);
 833
 834             macvm_set_rip(cpu, rip + ins_len);
 835             break;
 836         }
 837         case EXIT_REASON_XSETBV: {
 838             X86CPU *x86_cpu = X86_CPU(cpu);
 839             CPUX86State *env = &x86_cpu->env;
 840             uint32_t eax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX);
 841             uint32_t ecx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX);
 842             uint32_t edx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX);
 843
 844             if (ecx) {
 845                 macvm_set_rip(cpu, rip + ins_len);
 846                 break;
 847             }
 848             env->xcr0 = ((uint64_t)edx << 32) | eax;
 849             wreg(cpu->hvf_fd, HV_X86_XCR0, env->xcr0 | 1);
 850             macvm_set_rip(cpu, rip + ins_len);
 851             break;
 852         }
 853         case EXIT_REASON_INTR_WINDOW:
 854             vmx_clear_int_window_exiting(cpu);
 855             ret = EXCP_INTERRUPT;
 856             break;
 857         case EXIT_REASON_NMI_WINDOW:
 858             vmx_clear_nmi_window_exiting(cpu);
 859             ret = EXCP_INTERRUPT;
 860             break;
 861         case EXIT_REASON_EXT_INTR:
 862             /* force exit and allow io handling */
 863             ret = EXCP_INTERRUPT;
 864             break;
 865         case EXIT_REASON_RDMSR:
 866         case EXIT_REASON_WRMSR:
 867         {
 868             load_regs(cpu);
 869             if (exit_reason == EXIT_REASON_RDMSR) {
 870                 simulate_rdmsr(cpu);
 871             } else {
 872                 simulate_wrmsr(cpu);
 873             }
 874             RIP(env) += ins_len;
 875             store_regs(cpu);
 876             break;
 877         }
 878         case EXIT_REASON_CR_ACCESS: {
 879             int cr;
 880             int reg;
 881
 882             load_regs(cpu);
 883             cr = exit_qual & 15;
 884             reg = (exit_qual >> 8) & 15;
 885
 886             switch (cr) {
 887             case 0x0: {
 888                 macvm_set_cr0(cpu->hvf_fd, RRX(env, reg));
 889                 break;
 890             }
 891             case 4: {
 892                 macvm_set_cr4(cpu->hvf_fd, RRX(env, reg));
 893                 break;
 894             }
 895             case 8: {
 896                 X86CPU *x86_cpu = X86_CPU(cpu);
 897                 if (exit_qual & 0x10) {
 898                     RRX(env, reg) = cpu_get_apic_tpr(x86_cpu->apic_state);
 899                 } else {
 900                     int tpr = RRX(env, reg);
 901                     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
 902                     ret = EXCP_INTERRUPT;
 903                 }
 904                 break;
 905             }
 906             default:
 907                 error_report("Unrecognized CR %d", cr);
 908                 abort();
 909             }
 910             RIP(env) += ins_len;
 911             store_regs(cpu);
 912             break;
 913         }
 914         case EXIT_REASON_APIC_ACCESS: { /* TODO */
 915             struct x86_decode decode;
 916
 917             load_regs(cpu);
 918             env->hvf_emul->fetch_rip = rip;
 919
 920             decode_instruction(env, &decode);
 921             exec_instruction(env, &decode);
 922             store_regs(cpu);
 923             break;
 924         }
 925         case EXIT_REASON_TPR: {
 926             ret = 1;
 927             break;
 928         }
 929         case EXIT_REASON_TASK_SWITCH: {
 930             uint64_t vinfo = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO);
 931             x68_segment_selector sel = {.sel = exit_qual & 0xffff};
 932             vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3,
 933              vinfo & VMCS_INTR_VALID, vinfo & VECTORING_INFO_VECTOR_MASK, vinfo
 934              & VMCS_INTR_T_MASK);
 935             break;
 936         }
 937         case EXIT_REASON_TRIPLE_FAULT: {
 938             qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
 939             ret = EXCP_INTERRUPT;
 940             break;
 941         }
 942         case EXIT_REASON_RDPMC:
 943             wreg(cpu->hvf_fd, HV_X86_RAX, 0);
 944             wreg(cpu->hvf_fd, HV_X86_RDX, 0);
 945             macvm_set_rip(cpu, rip + ins_len);
 946             break;
 947         case VMX_REASON_VMCALL:
 948             env->exception_nr = EXCP0D_GPF;
 949             env->exception_injected = 1;
 950             env->has_error_code = true;
 951             env->error_code = 0;
 952             break;
 953         default:
 954             error_report("%llx: unhandled exit %llx", rip, exit_reason);
 955         }
 956     } while (ret == 0);
 957
 958     return ret;
 959 }
 960
 961 bool hvf_allowed;
 962
 963 static int hvf_accel_init(MachineState *ms)
 964 {
 965     int x;
 966     hv_return_t ret;
 967     HVFState *s;
 968
 969     ret = hv_vm_create(HV_VM_DEFAULT);
 970     assert_hvf_ok(ret);
 971
 972     s = g_new0(HVFState, 1);
 973
 974     s->num_slots = 32;
 975     for (x = 0; x < s->num_slots; ++x) {
 976         s->slots[x].size = 0;
 977         s->slots[x].slot_id = x;
 978     }
 979
 980     hvf_state = s;
 981     cpu_interrupt_handler = hvf_handle_interrupt;
 982     memory_listener_register(&hvf_memory_listener, &address_space_memory);
 983     return 0;
 984 }
 985
 986 static void hvf_accel_class_init(ObjectClass *oc, void *data)
 987 {
 988     AccelClass *ac = ACCEL_CLASS(oc);
 989     ac->name = "HVF";
 990     ac->init_machine = hvf_accel_init;
 991     ac->allowed = &hvf_allowed;
 992 }
 993
 994 static const TypeInfo hvf_accel_type = {
 995     .name = TYPE_HVF_ACCEL,
 996     .parent = TYPE_ACCEL,
 997     .class_init = hvf_accel_class_init,
 998 };
 999
1000 static void hvf_type_init(void)
1001 {
1002     type_register_static(&hvf_accel_type);
1003 }
1004
1005 type_init(hvf_type_init);