target/i386/hvf/hvf.c

   1 /* Copyright 2008 IBM Corporation
   2  *           2008 Red Hat, Inc.
   3  * Copyright 2011 Intel Corporation
   4  * Copyright 2016 Veertu, Inc.
   5  * Copyright 2017 The Android Open Source Project
   6  *
   7  * QEMU Hypervisor.framework support
   8  *
   9  * This program is free software; you can redistribute it and/or
  10  * modify it under the terms of version 2 of the GNU General Public
  11  * License as published by the Free Software Foundation.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public
  19  * License along with this program; if not, see <http://www.gnu.org/licenses/>.
  20  *
  21  * This file contain code under public domain from the hvdos project:
  22  * https://github.com/mist64/hvdos
  23  *
  24  * Parts Copyright (c) 2011 NetApp, Inc.
  25  * All rights reserved.
  26  *
  27  * Redistribution and use in source and binary forms, with or without
  28  * modification, are permitted provided that the following conditions
  29  * are met:
  30  * 1. Redistributions of source code must retain the above copyright
  31  *    notice, this list of conditions and the following disclaimer.
  32  * 2. Redistributions in binary form must reproduce the above copyright
  33  *    notice, this list of conditions and the following disclaimer in the
  34  *    documentation and/or other materials provided with the distribution.
  35  *
  36  * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
  37  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  38  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  39  * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
  40  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  41  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  42  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  43  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  44  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  45  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  46  * SUCH DAMAGE.
  47  */
  48 #include "qemu/osdep.h"
  49 #include "qemu-common.h"
  50 #include "qemu/error-report.h"
  51
  52 #include "sysemu/hvf.h"
  53 #include "hvf-i386.h"
  54 #include "vmcs.h"
  55 #include "vmx.h"
  56 #include "x86.h"
  57 #include "x86_descr.h"
  58 #include "x86_mmu.h"
  59 #include "x86_decode.h"
  60 #include "x86_emu.h"
  61 #include "x86_task.h"
  62 #include "x86hvf.h"
  63
  64 #include <Hypervisor/hv.h>
  65 #include <Hypervisor/hv_vmx.h>
  66
  67 #include "exec/address-spaces.h"
  68 #include "hw/i386/apic_internal.h"
  69 #include "hw/boards.h"
  70 #include "qemu/main-loop.h"
  71 #include "sysemu/accel.h"
  72 #include "sysemu/sysemu.h"
  73 #include "target/i386/cpu.h"
  74
  75 pthread_rwlock_t mem_lock = PTHREAD_RWLOCK_INITIALIZER;
  76 HVFState *hvf_state;
  77 int hvf_disabled = 1;
  78
  79 static void assert_hvf_ok(hv_return_t ret)
  80 {
  81     if (ret == HV_SUCCESS) {
  82         return;
  83     }
  84
  85     switch (ret) {
  86     case HV_ERROR:
  87         error_report("Error: HV_ERROR");
  88         break;
  89     case HV_BUSY:
  90         error_report("Error: HV_BUSY");
  91         break;
  92     case HV_BAD_ARGUMENT:
  93         error_report("Error: HV_BAD_ARGUMENT");
  94         break;
  95     case HV_NO_RESOURCES:
  96         error_report("Error: HV_NO_RESOURCES");
  97         break;
  98     case HV_NO_DEVICE:
  99         error_report("Error: HV_NO_DEVICE");
 100         break;
 101     case HV_UNSUPPORTED:
 102         error_report("Error: HV_UNSUPPORTED");
 103         break;
 104     default:
 105         error_report("Unknown Error");
 106     }
 107
 108     abort();
 109 }
 110
 111 /* Memory slots */
 112 hvf_slot *hvf_find_overlap_slot(uint64_t start, uint64_t end)
 113 {
 114     hvf_slot *slot;
 115     int x;
 116     for (x = 0; x < hvf_state->num_slots; ++x) {
 117         slot = &hvf_state->slots[x];
 118         if (slot->size && start < (slot->start + slot->size) &&
 119             end > slot->start) {
 120             return slot;
 121         }
 122     }
 123     return NULL;
 124 }
 125
 126 struct mac_slot {
 127     int present;
 128     uint64_t size;
 129     uint64_t gpa_start;
 130     uint64_t gva;
 131 };
 132
 133 struct mac_slot mac_slots[32];
 134 #define ALIGN(x, y)  (((x) + (y) - 1) & ~((y) - 1))
 135
 136 static int do_hvf_set_memory(hvf_slot *slot)
 137 {
 138     struct mac_slot *macslot;
 139     hv_memory_flags_t flags;
 140     hv_return_t ret;
 141
 142     macslot = &mac_slots[slot->slot_id];
 143
 144     if (macslot->present) {
 145         if (macslot->size != slot->size) {
 146             macslot->present = 0;
 147             ret = hv_vm_unmap(macslot->gpa_start, macslot->size);
 148             assert_hvf_ok(ret);
 149         }
 150     }
 151
 152     if (!slot->size) {
 153         return 0;
 154     }
 155
 156     flags = HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC;
 157
 158     macslot->present = 1;
 159     macslot->gpa_start = slot->start;
 160     macslot->size = slot->size;
 161     ret = hv_vm_map((hv_uvaddr_t)slot->mem, slot->start, slot->size, flags);
 162     assert_hvf_ok(ret);
 163     return 0;
 164 }
 165
 166 void hvf_set_phys_mem(MemoryRegionSection *section, bool add)
 167 {
 168     hvf_slot *mem;
 169     MemoryRegion *area = section->mr;
 170
 171     if (!memory_region_is_ram(area)) {
 172         return;
 173     }
 174
 175     mem = hvf_find_overlap_slot(
 176             section->offset_within_address_space,
 177             section->offset_within_address_space + int128_get64(section->size));
 178
 179     if (mem && add) {
 180         if (mem->size == int128_get64(section->size) &&
 181             mem->start == section->offset_within_address_space &&
 182             mem->mem == (memory_region_get_ram_ptr(area) +
 183             section->offset_within_region)) {
 184             return; /* Same region was attempted to register, go away. */
 185         }
 186     }
 187
 188     /* Region needs to be reset. set the size to 0 and remap it. */
 189     if (mem) {
 190         mem->size = 0;
 191         if (do_hvf_set_memory(mem)) {
 192             error_report("Failed to reset overlapping slot");
 193             abort();
 194         }
 195     }
 196
 197     if (!add) {
 198         return;
 199     }
 200
 201     /* Now make a new slot. */
 202     int x;
 203
 204     for (x = 0; x < hvf_state->num_slots; ++x) {
 205         mem = &hvf_state->slots[x];
 206         if (!mem->size) {
 207             break;
 208         }
 209     }
 210
 211     if (x == hvf_state->num_slots) {
 212         error_report("No free slots");
 213         abort();
 214     }
 215
 216     mem->size = int128_get64(section->size);
 217     mem->mem = memory_region_get_ram_ptr(area) + section->offset_within_region;
 218     mem->start = section->offset_within_address_space;
 219     mem->region = area;
 220
 221     if (do_hvf_set_memory(mem)) {
 222         error_report("Error registering new memory slot");
 223         abort();
 224     }
 225 }
 226
 227 void vmx_update_tpr(CPUState *cpu)
 228 {
 229     /* TODO: need integrate APIC handling */
 230     X86CPU *x86_cpu = X86_CPU(cpu);
 231     int tpr = cpu_get_apic_tpr(x86_cpu->apic_state) << 4;
 232     int irr = apic_get_highest_priority_irr(x86_cpu->apic_state);
 233
 234     wreg(cpu->hvf_fd, HV_X86_TPR, tpr);
 235     if (irr == -1) {
 236         wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0);
 237     } else {
 238         wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, (irr > tpr) ? tpr >> 4 :
 239               irr >> 4);
 240     }
 241 }
 242
 243 void update_apic_tpr(CPUState *cpu)
 244 {
 245     X86CPU *x86_cpu = X86_CPU(cpu);
 246     int tpr = rreg(cpu->hvf_fd, HV_X86_TPR) >> 4;
 247     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
 248 }
 249
 250 #define VECTORING_INFO_VECTOR_MASK     0xff
 251
 252 static void hvf_handle_interrupt(CPUState * cpu, int mask)
 253 {
 254     cpu->interrupt_request |= mask;
 255     if (!qemu_cpu_is_self(cpu)) {
 256         qemu_cpu_kick(cpu);
 257     }
 258 }
 259
 260 void hvf_handle_io(CPUArchState *env, uint16_t port, void *buffer,
 261                   int direction, int size, int count)
 262 {
 263     int i;
 264     uint8_t *ptr = buffer;
 265
 266     for (i = 0; i < count; i++) {
 267         address_space_rw(&address_space_io, port, MEMTXATTRS_UNSPECIFIED,
 268                          ptr, size,
 269                          direction);
 270         ptr += size;
 271     }
 272 }
 273
 274 /* TODO: synchronize vcpu state */
 275 static void do_hvf_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
 276 {
 277     CPUState *cpu_state = cpu;
 278     if (cpu_state->vcpu_dirty == 0) {
 279         hvf_get_registers(cpu_state);
 280     }
 281
 282     cpu_state->vcpu_dirty = 1;
 283 }
 284
 285 void hvf_cpu_synchronize_state(CPUState *cpu_state)
 286 {
 287     if (cpu_state->vcpu_dirty == 0) {
 288         run_on_cpu(cpu_state, do_hvf_cpu_synchronize_state, RUN_ON_CPU_NULL);
 289     }
 290 }
 291
 292 static void do_hvf_cpu_synchronize_post_reset(CPUState *cpu, run_on_cpu_data arg)
 293 {
 294     CPUState *cpu_state = cpu;
 295     hvf_put_registers(cpu_state);
 296     cpu_state->vcpu_dirty = false;
 297 }
 298
 299 void hvf_cpu_synchronize_post_reset(CPUState *cpu_state)
 300 {
 301     run_on_cpu(cpu_state, do_hvf_cpu_synchronize_post_reset, RUN_ON_CPU_NULL);
 302 }
 303
 304 void _hvf_cpu_synchronize_post_init(CPUState *cpu, run_on_cpu_data arg)
 305 {
 306     CPUState *cpu_state = cpu;
 307     hvf_put_registers(cpu_state);
 308     cpu_state->vcpu_dirty = false;
 309 }
 310
 311 void hvf_cpu_synchronize_post_init(CPUState *cpu_state)
 312 {
 313     run_on_cpu(cpu_state, _hvf_cpu_synchronize_post_init, RUN_ON_CPU_NULL);
 314 }
 315
 316 static bool ept_emulation_fault(hvf_slot *slot, uint64_t gpa, uint64_t ept_qual)
 317 {
 318     int read, write;
 319
 320     /* EPT fault on an instruction fetch doesn't make sense here */
 321     if (ept_qual & EPT_VIOLATION_INST_FETCH) {
 322         return false;
 323     }
 324
 325     /* EPT fault must be a read fault or a write fault */
 326     read = ept_qual & EPT_VIOLATION_DATA_READ ? 1 : 0;
 327     write = ept_qual & EPT_VIOLATION_DATA_WRITE ? 1 : 0;
 328     if ((read | write) == 0) {
 329         return false;
 330     }
 331
 332     if (write && slot) {
 333         if (slot->flags & HVF_SLOT_LOG) {
 334             memory_region_set_dirty(slot->region, gpa - slot->start, 1);
 335             hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size,
 336                           HV_MEMORY_READ | HV_MEMORY_WRITE);
 337         }
 338     }
 339
 340     /*
 341      * The EPT violation must have been caused by accessing a
 342      * guest-physical address that is a translation of a guest-linear
 343      * address.
 344      */
 345     if ((ept_qual & EPT_VIOLATION_GLA_VALID) == 0 ||
 346         (ept_qual & EPT_VIOLATION_XLAT_VALID) == 0) {
 347         return false;
 348     }
 349
 350     return !slot;
 351 }
 352
 353 static void hvf_set_dirty_tracking(MemoryRegionSection *section, bool on)
 354 {
 355     hvf_slot *slot;
 356
 357     slot = hvf_find_overlap_slot(
 358             section->offset_within_address_space,
 359             section->offset_within_address_space + int128_get64(section->size));
 360
 361     /* protect region against writes; begin tracking it */
 362     if (on) {
 363         slot->flags |= HVF_SLOT_LOG;
 364         hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size,
 365                       HV_MEMORY_READ);
 366     /* stop tracking region*/
 367     } else {
 368         slot->flags &= ~HVF_SLOT_LOG;
 369         hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size,
 370                       HV_MEMORY_READ | HV_MEMORY_WRITE);
 371     }
 372 }
 373
 374 static void hvf_log_start(MemoryListener *listener,
 375                           MemoryRegionSection *section, int old, int new)
 376 {
 377     if (old != 0) {
 378         return;
 379     }
 380
 381     hvf_set_dirty_tracking(section, 1);
 382 }
 383
 384 static void hvf_log_stop(MemoryListener *listener,
 385                          MemoryRegionSection *section, int old, int new)
 386 {
 387     if (new != 0) {
 388         return;
 389     }
 390
 391     hvf_set_dirty_tracking(section, 0);
 392 }
 393
 394 static void hvf_log_sync(MemoryListener *listener,
 395                          MemoryRegionSection *section)
 396 {
 397     /*
 398      * sync of dirty pages is handled elsewhere; just make sure we keep
 399      * tracking the region.
 400      */
 401     hvf_set_dirty_tracking(section, 1);
 402 }
 403
 404 static void hvf_region_add(MemoryListener *listener,
 405                            MemoryRegionSection *section)
 406 {
 407     hvf_set_phys_mem(section, true);
 408 }
 409
 410 static void hvf_region_del(MemoryListener *listener,
 411                            MemoryRegionSection *section)
 412 {
 413     hvf_set_phys_mem(section, false);
 414 }
 415
 416 static MemoryListener hvf_memory_listener = {
 417     .priority = 10,
 418     .region_add = hvf_region_add,
 419     .region_del = hvf_region_del,
 420     .log_start = hvf_log_start,
 421     .log_stop = hvf_log_stop,
 422     .log_sync = hvf_log_sync,
 423 };
 424
 425 void hvf_reset_vcpu(CPUState *cpu) {
 426
 427     /* TODO: this shouldn't be needed; there is already a call to
 428      * cpu_synchronize_all_post_reset in vl.c
 429      */
 430     wvmcs(cpu->hvf_fd, VMCS_ENTRY_CTLS, 0);
 431     wvmcs(cpu->hvf_fd, VMCS_GUEST_IA32_EFER, 0);
 432     macvm_set_cr0(cpu->hvf_fd, 0x60000010);
 433
 434     wvmcs(cpu->hvf_fd, VMCS_CR4_MASK, CR4_VMXE_MASK);
 435     wvmcs(cpu->hvf_fd, VMCS_CR4_SHADOW, 0x0);
 436     wvmcs(cpu->hvf_fd, VMCS_GUEST_CR4, CR4_VMXE_MASK);
 437
 438     /* set VMCS guest state fields */
 439     wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_SELECTOR, 0xf000);
 440     wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_LIMIT, 0xffff);
 441     wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_ACCESS_RIGHTS, 0x9b);
 442     wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_BASE, 0xffff0000);
 443
 444     wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_SELECTOR, 0);
 445     wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_LIMIT, 0xffff);
 446     wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_ACCESS_RIGHTS, 0x93);
 447     wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_BASE, 0);
 448
 449     wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_SELECTOR, 0);
 450     wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_LIMIT, 0xffff);
 451     wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_ACCESS_RIGHTS, 0x93);
 452     wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_BASE, 0);
 453
 454     wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_SELECTOR, 0);
 455     wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_LIMIT, 0xffff);
 456     wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_ACCESS_RIGHTS, 0x93);
 457     wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_BASE, 0);
 458
 459     wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_SELECTOR, 0);
 460     wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_LIMIT, 0xffff);
 461     wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_ACCESS_RIGHTS, 0x93);
 462     wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_BASE, 0);
 463
 464     wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_SELECTOR, 0);
 465     wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_LIMIT, 0xffff);
 466     wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_ACCESS_RIGHTS, 0x93);
 467     wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_BASE, 0);
 468
 469     wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_SELECTOR, 0);
 470     wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_LIMIT, 0);
 471     wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_ACCESS_RIGHTS, 0x10000);
 472     wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_BASE, 0);
 473
 474     wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_SELECTOR, 0);
 475     wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_LIMIT, 0);
 476     wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_ACCESS_RIGHTS, 0x83);
 477     wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_BASE, 0);
 478
 479     wvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_LIMIT, 0);
 480     wvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_BASE, 0);
 481
 482     wvmcs(cpu->hvf_fd, VMCS_GUEST_IDTR_LIMIT, 0);
 483     wvmcs(cpu->hvf_fd, VMCS_GUEST_IDTR_BASE, 0);
 484
 485     /*wvmcs(cpu->hvf_fd, VMCS_GUEST_CR2, 0x0);*/
 486     wvmcs(cpu->hvf_fd, VMCS_GUEST_CR3, 0x0);
 487
 488     wreg(cpu->hvf_fd, HV_X86_RIP, 0xfff0);
 489     wreg(cpu->hvf_fd, HV_X86_RDX, 0x623);
 490     wreg(cpu->hvf_fd, HV_X86_RFLAGS, 0x2);
 491     wreg(cpu->hvf_fd, HV_X86_RSP, 0x0);
 492     wreg(cpu->hvf_fd, HV_X86_RAX, 0x0);
 493     wreg(cpu->hvf_fd, HV_X86_RBX, 0x0);
 494     wreg(cpu->hvf_fd, HV_X86_RCX, 0x0);
 495     wreg(cpu->hvf_fd, HV_X86_RSI, 0x0);
 496     wreg(cpu->hvf_fd, HV_X86_RDI, 0x0);
 497     wreg(cpu->hvf_fd, HV_X86_RBP, 0x0);
 498
 499     for (int i = 0; i < 8; i++) {
 500         wreg(cpu->hvf_fd, HV_X86_R8 + i, 0x0);
 501     }
 502
 503     hv_vm_sync_tsc(0);
 504     cpu->halted = 0;
 505     hv_vcpu_invalidate_tlb(cpu->hvf_fd);
 506     hv_vcpu_flush(cpu->hvf_fd);
 507 }
 508
 509 void hvf_vcpu_destroy(CPUState *cpu)
 510 {
 511     hv_return_t ret = hv_vcpu_destroy((hv_vcpuid_t)cpu->hvf_fd);
 512     assert_hvf_ok(ret);
 513 }
 514
 515 static void dummy_signal(int sig)
 516 {
 517 }
 518
 519 int hvf_init_vcpu(CPUState *cpu)
 520 {
 521
 522     X86CPU *x86cpu = X86_CPU(cpu);
 523     CPUX86State *env = &x86cpu->env;
 524     int r;
 525
 526     /* init cpu signals */
 527     sigset_t set;
 528     struct sigaction sigact;
 529
 530     memset(&sigact, 0, sizeof(sigact));
 531     sigact.sa_handler = dummy_signal;
 532     sigaction(SIG_IPI, &sigact, NULL);
 533
 534     pthread_sigmask(SIG_BLOCK, NULL, &set);
 535     sigdelset(&set, SIG_IPI);
 536
 537     init_emu();
 538     init_decoder();
 539
 540     hvf_state->hvf_caps = g_new0(struct hvf_vcpu_caps, 1);
 541     env->hvf_emul = g_new0(HVFX86EmulatorState, 1);
 542
 543     r = hv_vcpu_create((hv_vcpuid_t *)&cpu->hvf_fd, HV_VCPU_DEFAULT);
 544     cpu->vcpu_dirty = 1;
 545     assert_hvf_ok(r);
 546
 547     if (hv_vmx_read_capability(HV_VMX_CAP_PINBASED,
 548         &hvf_state->hvf_caps->vmx_cap_pinbased)) {
 549         abort();
 550     }
 551     if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED,
 552         &hvf_state->hvf_caps->vmx_cap_procbased)) {
 553         abort();
 554     }
 555     if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED2,
 556         &hvf_state->hvf_caps->vmx_cap_procbased2)) {
 557         abort();
 558     }
 559     if (hv_vmx_read_capability(HV_VMX_CAP_ENTRY,
 560         &hvf_state->hvf_caps->vmx_cap_entry)) {
 561         abort();
 562     }
 563
 564     /* set VMCS control fields */
 565     wvmcs(cpu->hvf_fd, VMCS_PIN_BASED_CTLS,
 566           cap2ctrl(hvf_state->hvf_caps->vmx_cap_pinbased,
 567           VMCS_PIN_BASED_CTLS_EXTINT |
 568           VMCS_PIN_BASED_CTLS_NMI |
 569           VMCS_PIN_BASED_CTLS_VNMI));
 570     wvmcs(cpu->hvf_fd, VMCS_PRI_PROC_BASED_CTLS,
 571           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased,
 572           VMCS_PRI_PROC_BASED_CTLS_HLT |
 573           VMCS_PRI_PROC_BASED_CTLS_MWAIT |
 574           VMCS_PRI_PROC_BASED_CTLS_TSC_OFFSET |
 575           VMCS_PRI_PROC_BASED_CTLS_TPR_SHADOW) |
 576           VMCS_PRI_PROC_BASED_CTLS_SEC_CONTROL);
 577     wvmcs(cpu->hvf_fd, VMCS_SEC_PROC_BASED_CTLS,
 578           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased2,
 579                    VMCS_PRI_PROC_BASED2_CTLS_APIC_ACCESSES));
 580
 581     wvmcs(cpu->hvf_fd, VMCS_ENTRY_CTLS, cap2ctrl(hvf_state->hvf_caps->vmx_cap_entry,
 582           0));
 583     wvmcs(cpu->hvf_fd, VMCS_EXCEPTION_BITMAP, 0); /* Double fault */
 584
 585     wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0);
 586
 587     hvf_reset_vcpu(cpu);
 588
 589     x86cpu = X86_CPU(cpu);
 590     x86cpu->env.kvm_xsave_buf = qemu_memalign(4096, 4096);
 591
 592     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_STAR, 1);
 593     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_LSTAR, 1);
 594     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_CSTAR, 1);
 595     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FMASK, 1);
 596     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FSBASE, 1);
 597     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_GSBASE, 1);
 598     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_KERNELGSBASE, 1);
 599     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_TSC_AUX, 1);
 600     /*hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_TSC, 1);*/
 601     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_CS, 1);
 602     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_EIP, 1);
 603     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_ESP, 1);
 604
 605     return 0;
 606 }
 607
 608 void hvf_disable(int shouldDisable)
 609 {
 610     hvf_disabled = shouldDisable;
 611 }
 612
 613 static void hvf_store_events(CPUState *cpu, uint32_t ins_len, uint64_t idtvec_info)
 614 {
 615     X86CPU *x86_cpu = X86_CPU(cpu);
 616     CPUX86State *env = &x86_cpu->env;
 617
 618     env->exception_injected = -1;
 619     env->interrupt_injected = -1;
 620     env->nmi_injected = false;
 621     if (idtvec_info & VMCS_IDT_VEC_VALID) {
 622         switch (idtvec_info & VMCS_IDT_VEC_TYPE) {
 623         case VMCS_IDT_VEC_HWINTR:
 624         case VMCS_IDT_VEC_SWINTR:
 625             env->interrupt_injected = idtvec_info & VMCS_IDT_VEC_VECNUM;
 626             break;
 627         case VMCS_IDT_VEC_NMI:
 628             env->nmi_injected = true;
 629             break;
 630         case VMCS_IDT_VEC_HWEXCEPTION:
 631         case VMCS_IDT_VEC_SWEXCEPTION:
 632             env->exception_injected = idtvec_info & VMCS_IDT_VEC_VECNUM;
 633             break;
 634         case VMCS_IDT_VEC_PRIV_SWEXCEPTION:
 635         default:
 636             abort();
 637         }
 638         if ((idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWEXCEPTION ||
 639             (idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWINTR) {
 640             env->ins_len = ins_len;
 641         }
 642         if (idtvec_info & VMCS_INTR_DEL_ERRCODE) {
 643             env->has_error_code = true;
 644             env->error_code = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_ERROR);
 645         }
 646     }
 647     if ((rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) &
 648         VMCS_INTERRUPTIBILITY_NMI_BLOCKING)) {
 649         env->hflags2 |= HF2_NMI_MASK;
 650     } else {
 651         env->hflags2 &= ~HF2_NMI_MASK;
 652     }
 653     if (rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) &
 654          (VMCS_INTERRUPTIBILITY_STI_BLOCKING |
 655          VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING)) {
 656         env->hflags |= HF_INHIBIT_IRQ_MASK;
 657     } else {
 658         env->hflags &= ~HF_INHIBIT_IRQ_MASK;
 659     }
 660 }
 661
 662 int hvf_vcpu_exec(CPUState *cpu)
 663 {
 664     X86CPU *x86_cpu = X86_CPU(cpu);
 665     CPUX86State *env = &x86_cpu->env;
 666     int ret = 0;
 667     uint64_t rip = 0;
 668
 669     cpu->halted = 0;
 670
 671     if (hvf_process_events(cpu)) {
 672         return EXCP_HLT;
 673     }
 674
 675     do {
 676         if (cpu->vcpu_dirty) {
 677             hvf_put_registers(cpu);
 678             cpu->vcpu_dirty = false;
 679         }
 680
 681         if (hvf_inject_interrupts(cpu)) {
 682             return EXCP_INTERRUPT;
 683         }
 684         vmx_update_tpr(cpu);
 685
 686         qemu_mutex_unlock_iothread();
 687         if (!cpu_is_bsp(X86_CPU(cpu)) && cpu->halted) {
 688             qemu_mutex_lock_iothread();
 689             return EXCP_HLT;
 690         }
 691
 692         hv_return_t r  = hv_vcpu_run(cpu->hvf_fd);
 693         assert_hvf_ok(r);
 694
 695         /* handle VMEXIT */
 696         uint64_t exit_reason = rvmcs(cpu->hvf_fd, VMCS_EXIT_REASON);
 697         uint64_t exit_qual = rvmcs(cpu->hvf_fd, VMCS_EXIT_QUALIFICATION);
 698         uint32_t ins_len = (uint32_t)rvmcs(cpu->hvf_fd,
 699                                            VMCS_EXIT_INSTRUCTION_LENGTH);
 700
 701         uint64_t idtvec_info = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO);
 702
 703         hvf_store_events(cpu, ins_len, idtvec_info);
 704         rip = rreg(cpu->hvf_fd, HV_X86_RIP);
 705         RFLAGS(env) = rreg(cpu->hvf_fd, HV_X86_RFLAGS);
 706         env->eflags = RFLAGS(env);
 707
 708         qemu_mutex_lock_iothread();
 709
 710         update_apic_tpr(cpu);
 711         current_cpu = cpu;
 712
 713         ret = 0;
 714         switch (exit_reason) {
 715         case EXIT_REASON_HLT: {
 716             macvm_set_rip(cpu, rip + ins_len);
 717             if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) &&
 718                 (EFLAGS(env) & IF_MASK))
 719                 && !(cpu->interrupt_request & CPU_INTERRUPT_NMI) &&
 720                 !(idtvec_info & VMCS_IDT_VEC_VALID)) {
 721                 cpu->halted = 1;
 722                 ret = EXCP_HLT;
 723             }
 724             ret = EXCP_INTERRUPT;
 725             break;
 726         }
 727         case EXIT_REASON_MWAIT: {
 728             ret = EXCP_INTERRUPT;
 729             break;
 730         }
 731             /* Need to check if MMIO or unmmaped fault */
 732         case EXIT_REASON_EPT_FAULT:
 733         {
 734             hvf_slot *slot;
 735             uint64_t gpa = rvmcs(cpu->hvf_fd, VMCS_GUEST_PHYSICAL_ADDRESS);
 736
 737             if (((idtvec_info & VMCS_IDT_VEC_VALID) == 0) &&
 738                 ((exit_qual & EXIT_QUAL_NMIUDTI) != 0)) {
 739                 vmx_set_nmi_blocking(cpu);
 740             }
 741
 742             slot = hvf_find_overlap_slot(gpa, gpa);
 743             /* mmio */
 744             if (ept_emulation_fault(slot, gpa, exit_qual)) {
 745                 struct x86_decode decode;
 746
 747                 load_regs(cpu);
 748                 env->hvf_emul->fetch_rip = rip;
 749
 750                 decode_instruction(env, &decode);
 751                 exec_instruction(env, &decode);
 752                 store_regs(cpu);
 753                 break;
 754             }
 755             break;
 756         }
 757         case EXIT_REASON_INOUT:
 758         {
 759             uint32_t in = (exit_qual & 8) != 0;
 760             uint32_t size =  (exit_qual & 7) + 1;
 761             uint32_t string =  (exit_qual & 16) != 0;
 762             uint32_t port =  exit_qual >> 16;
 763             /*uint32_t rep = (exit_qual & 0x20) != 0;*/
 764
 765             if (!string && in) {
 766                 uint64_t val = 0;
 767                 load_regs(cpu);
 768                 hvf_handle_io(env, port, &val, 0, size, 1);
 769                 if (size == 1) {
 770                     AL(env) = val;
 771                 } else if (size == 2) {
 772                     AX(env) = val;
 773                 } else if (size == 4) {
 774                     RAX(env) = (uint32_t)val;
 775                 } else {
 776                     RAX(env) = (uint64_t)val;
 777                 }
 778                 RIP(env) += ins_len;
 779                 store_regs(cpu);
 780                 break;
 781             } else if (!string && !in) {
 782                 RAX(env) = rreg(cpu->hvf_fd, HV_X86_RAX);
 783                 hvf_handle_io(env, port, &RAX(env), 1, size, 1);
 784                 macvm_set_rip(cpu, rip + ins_len);
 785                 break;
 786             }
 787             struct x86_decode decode;
 788
 789             load_regs(cpu);
 790             env->hvf_emul->fetch_rip = rip;
 791
 792             decode_instruction(env, &decode);
 793             assert(ins_len == decode.len);
 794             exec_instruction(env, &decode);
 795             store_regs(cpu);
 796
 797             break;
 798         }
 799         case EXIT_REASON_CPUID: {
 800             uint32_t rax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX);
 801             uint32_t rbx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RBX);
 802             uint32_t rcx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX);
 803             uint32_t rdx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX);
 804
 805             cpu_x86_cpuid(env, rax, rcx, &rax, &rbx, &rcx, &rdx);
 806
 807             wreg(cpu->hvf_fd, HV_X86_RAX, rax);
 808             wreg(cpu->hvf_fd, HV_X86_RBX, rbx);
 809             wreg(cpu->hvf_fd, HV_X86_RCX, rcx);
 810             wreg(cpu->hvf_fd, HV_X86_RDX, rdx);
 811
 812             macvm_set_rip(cpu, rip + ins_len);
 813             break;
 814         }
 815         case EXIT_REASON_XSETBV: {
 816             X86CPU *x86_cpu = X86_CPU(cpu);
 817             CPUX86State *env = &x86_cpu->env;
 818             uint32_t eax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX);
 819             uint32_t ecx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX);
 820             uint32_t edx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX);
 821
 822             if (ecx) {
 823                 macvm_set_rip(cpu, rip + ins_len);
 824                 break;
 825             }
 826             env->xcr0 = ((uint64_t)edx << 32) | eax;
 827             wreg(cpu->hvf_fd, HV_X86_XCR0, env->xcr0 | 1);
 828             macvm_set_rip(cpu, rip + ins_len);
 829             break;
 830         }
 831         case EXIT_REASON_INTR_WINDOW:
 832             vmx_clear_int_window_exiting(cpu);
 833             ret = EXCP_INTERRUPT;
 834             break;
 835         case EXIT_REASON_NMI_WINDOW:
 836             vmx_clear_nmi_window_exiting(cpu);
 837             ret = EXCP_INTERRUPT;
 838             break;
 839         case EXIT_REASON_EXT_INTR:
 840             /* force exit and allow io handling */
 841             ret = EXCP_INTERRUPT;
 842             break;
 843         case EXIT_REASON_RDMSR:
 844         case EXIT_REASON_WRMSR:
 845         {
 846             load_regs(cpu);
 847             if (exit_reason == EXIT_REASON_RDMSR) {
 848                 simulate_rdmsr(cpu);
 849             } else {
 850                 simulate_wrmsr(cpu);
 851             }
 852             RIP(env) += rvmcs(cpu->hvf_fd, VMCS_EXIT_INSTRUCTION_LENGTH);
 853             store_regs(cpu);
 854             break;
 855         }
 856         case EXIT_REASON_CR_ACCESS: {
 857             int cr;
 858             int reg;
 859
 860             load_regs(cpu);
 861             cr = exit_qual & 15;
 862             reg = (exit_qual >> 8) & 15;
 863
 864             switch (cr) {
 865             case 0x0: {
 866                 macvm_set_cr0(cpu->hvf_fd, RRX(env, reg));
 867                 break;
 868             }
 869             case 4: {
 870                 macvm_set_cr4(cpu->hvf_fd, RRX(env, reg));
 871                 break;
 872             }
 873             case 8: {
 874                 X86CPU *x86_cpu = X86_CPU(cpu);
 875                 if (exit_qual & 0x10) {
 876                     RRX(env, reg) = cpu_get_apic_tpr(x86_cpu->apic_state);
 877                 } else {
 878                     int tpr = RRX(env, reg);
 879                     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
 880                     ret = EXCP_INTERRUPT;
 881                 }
 882                 break;
 883             }
 884             default:
 885                 error_report("Unrecognized CR %d", cr);
 886                 abort();
 887             }
 888             RIP(env) += ins_len;
 889             store_regs(cpu);
 890             break;
 891         }
 892         case EXIT_REASON_APIC_ACCESS: { /* TODO */
 893             struct x86_decode decode;
 894
 895             load_regs(cpu);
 896             env->hvf_emul->fetch_rip = rip;
 897
 898             decode_instruction(env, &decode);
 899             exec_instruction(env, &decode);
 900             store_regs(cpu);
 901             break;
 902         }
 903         case EXIT_REASON_TPR: {
 904             ret = 1;
 905             break;
 906         }
 907         case EXIT_REASON_TASK_SWITCH: {
 908             uint64_t vinfo = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO);
 909             x68_segment_selector sel = {.sel = exit_qual & 0xffff};
 910             vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3,
 911              vinfo & VMCS_INTR_VALID, vinfo & VECTORING_INFO_VECTOR_MASK, vinfo
 912              & VMCS_INTR_T_MASK);
 913             break;
 914         }
 915         case EXIT_REASON_TRIPLE_FAULT: {
 916             qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
 917             ret = EXCP_INTERRUPT;
 918             break;
 919         }
 920         case EXIT_REASON_RDPMC:
 921             wreg(cpu->hvf_fd, HV_X86_RAX, 0);
 922             wreg(cpu->hvf_fd, HV_X86_RDX, 0);
 923             macvm_set_rip(cpu, rip + ins_len);
 924             break;
 925         case VMX_REASON_VMCALL:
 926             env->exception_injected = EXCP0D_GPF;
 927             env->has_error_code = true;
 928             env->error_code = 0;
 929             break;
 930         default:
 931             error_report("%llx: unhandled exit %llx", rip, exit_reason);
 932         }
 933     } while (ret == 0);
 934
 935     return ret;
 936 }
 937
 938 static bool hvf_allowed;
 939
 940 static int hvf_accel_init(MachineState *ms)
 941 {
 942     int x;
 943     hv_return_t ret;
 944     HVFState *s;
 945
 946     hvf_disable(0);
 947     ret = hv_vm_create(HV_VM_DEFAULT);
 948     assert_hvf_ok(ret);
 949
 950     s = g_new0(HVFState, 1);
 951
 952     s->num_slots = 32;
 953     for (x = 0; x < s->num_slots; ++x) {
 954         s->slots[x].size = 0;
 955         s->slots[x].slot_id = x;
 956     }
 957
 958     hvf_state = s;
 959     cpu_interrupt_handler = hvf_handle_interrupt;
 960     memory_listener_register(&hvf_memory_listener, &address_space_memory);
 961     return 0;
 962 }
 963
 964 static void hvf_accel_class_init(ObjectClass *oc, void *data)
 965 {
 966     AccelClass *ac = ACCEL_CLASS(oc);
 967     ac->name = "HVF";
 968     ac->init_machine = hvf_accel_init;
 969     ac->allowed = &hvf_allowed;
 970 }
 971
 972 static const TypeInfo hvf_accel_type = {
 973     .name = TYPE_HVF_ACCEL,
 974     .parent = TYPE_ACCEL,
 975     .class_init = hvf_accel_class_init,
 976 };
 977
 978 static void hvf_type_init(void)
 979 {
 980     type_register_static(&hvf_accel_type);
 981 }
 982
 983 type_init(hvf_type_init);