target/i386/hvf/hvf.c

   1 /* Copyright 2008 IBM Corporation
   2  *           2008 Red Hat, Inc.
   3  * Copyright 2011 Intel Corporation
   4  * Copyright 2016 Veertu, Inc.
   5  * Copyright 2017 The Android Open Source Project
   6  *
   7  * QEMU Hypervisor.framework support
   8  *
   9  * This program is free software; you can redistribute it and/or
  10  * modify it under the terms of version 2 of the GNU General Public
  11  * License as published by the Free Software Foundation.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  20  *
  21  * This file contain code under public domain from the hvdos project:
  22  * https://github.com/mist64/hvdos
  23  *
  24  * Parts Copyright (c) 2011 NetApp, Inc.
  25  * All rights reserved.
  26  *
  27  * Redistribution and use in source and binary forms, with or without
  28  * modification, are permitted provided that the following conditions
  29  * are met:
  30  * 1. Redistributions of source code must retain the above copyright
  31  *    notice, this list of conditions and the following disclaimer.
  32  * 2. Redistributions in binary form must reproduce the above copyright
  33  *    notice, this list of conditions and the following disclaimer in the
  34  *    documentation and/or other materials provided with the distribution.
  35  *
  36  * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
  37  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  38  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  39  * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
  40  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  41  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  42  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  43  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  44  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  45  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  46  * SUCH DAMAGE.
  47  */
  48
  49 #include "qemu/osdep.h"
  50 #include "qemu/error-report.h"
  51 #include "qemu/memalign.h"
  52 #include "qapi/error.h"
  53 #include "migration/blocker.h"
  54
  55 #include "sysemu/hvf.h"
  56 #include "sysemu/hvf_int.h"
  57 #include "sysemu/runstate.h"
  58 #include "sysemu/cpus.h"
  59 #include "hvf-i386.h"
  60 #include "vmcs.h"
  61 #include "vmx.h"
  62 #include "x86.h"
  63 #include "x86_descr.h"
  64 #include "x86_mmu.h"
  65 #include "x86_decode.h"
  66 #include "x86_emu.h"
  67 #include "x86_task.h"
  68 #include "x86hvf.h"
  69
  70 #include <Hypervisor/hv.h>
  71 #include <Hypervisor/hv_vmx.h>
  72 #include <sys/sysctl.h>
  73
  74 #include "hw/i386/apic_internal.h"
  75 #include "qemu/main-loop.h"
  76 #include "qemu/accel.h"
  77 #include "target/i386/cpu.h"
  78
  79 static Error *invtsc_mig_blocker;
  80
  81 void vmx_update_tpr(CPUState *cpu)
  82 {
  83     /* TODO: need integrate APIC handling */
  84     X86CPU *x86_cpu = X86_CPU(cpu);
  85     int tpr = cpu_get_apic_tpr(x86_cpu->apic_state) << 4;
  86     int irr = apic_get_highest_priority_irr(x86_cpu->apic_state);
  87
  88     wreg(cpu->accel->fd, HV_X86_TPR, tpr);
  89     if (irr == -1) {
  90         wvmcs(cpu->accel->fd, VMCS_TPR_THRESHOLD, 0);
  91     } else {
  92         wvmcs(cpu->accel->fd, VMCS_TPR_THRESHOLD, (irr > tpr) ? tpr >> 4 :
  93               irr >> 4);
  94     }
  95 }
  96
  97 static void update_apic_tpr(CPUState *cpu)
  98 {
  99     X86CPU *x86_cpu = X86_CPU(cpu);
 100     int tpr = rreg(cpu->accel->fd, HV_X86_TPR) >> 4;
 101     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
 102 }
 103
 104 #define VECTORING_INFO_VECTOR_MASK     0xff
 105
 106 void hvf_handle_io(CPUArchState *env, uint16_t port, void *buffer,
 107                   int direction, int size, int count)
 108 {
 109     int i;
 110     uint8_t *ptr = buffer;
 111
 112     for (i = 0; i < count; i++) {
 113         address_space_rw(&address_space_io, port, MEMTXATTRS_UNSPECIFIED,
 114                          ptr, size,
 115                          direction);
 116         ptr += size;
 117     }
 118 }
 119
 120 static bool ept_emulation_fault(hvf_slot *slot, uint64_t gpa, uint64_t ept_qual)
 121 {
 122     int read, write;
 123
 124     /* EPT fault on an instruction fetch doesn't make sense here */
 125     if (ept_qual & EPT_VIOLATION_INST_FETCH) {
 126         return false;
 127     }
 128
 129     /* EPT fault must be a read fault or a write fault */
 130     read = ept_qual & EPT_VIOLATION_DATA_READ ? 1 : 0;
 131     write = ept_qual & EPT_VIOLATION_DATA_WRITE ? 1 : 0;
 132     if ((read | write) == 0) {
 133         return false;
 134     }
 135
 136     if (write && slot) {
 137         if (slot->flags & HVF_SLOT_LOG) {
 138             uint64_t dirty_page_start = gpa & ~(TARGET_PAGE_SIZE - 1u);
 139             memory_region_set_dirty(slot->region, gpa - slot->start, 1);
 140             hv_vm_protect(dirty_page_start, TARGET_PAGE_SIZE,
 141                           HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC);
 142         }
 143     }
 144
 145     /*
 146      * The EPT violation must have been caused by accessing a
 147      * guest-physical address that is a translation of a guest-linear
 148      * address.
 149      */
 150     if ((ept_qual & EPT_VIOLATION_GLA_VALID) == 0 ||
 151         (ept_qual & EPT_VIOLATION_XLAT_VALID) == 0) {
 152         return false;
 153     }
 154
 155     if (!slot) {
 156         return true;
 157     }
 158     if (!memory_region_is_ram(slot->region) &&
 159         !(read && memory_region_is_romd(slot->region))) {
 160         return true;
 161     }
 162     return false;
 163 }
 164
 165 void hvf_arch_vcpu_destroy(CPUState *cpu)
 166 {
 167     X86CPU *x86_cpu = X86_CPU(cpu);
 168     CPUX86State *env = &x86_cpu->env;
 169
 170     g_free(env->hvf_mmio_buf);
 171 }
 172
 173 static void init_tsc_freq(CPUX86State *env)
 174 {
 175     size_t length;
 176     uint64_t tsc_freq;
 177
 178     if (env->tsc_khz != 0) {
 179         return;
 180     }
 181
 182     length = sizeof(uint64_t);
 183     if (sysctlbyname("machdep.tsc.frequency", &tsc_freq, &length, NULL, 0)) {
 184         return;
 185     }
 186     env->tsc_khz = tsc_freq / 1000;  /* Hz to KHz */
 187 }
 188
 189 static void init_apic_bus_freq(CPUX86State *env)
 190 {
 191     size_t length;
 192     uint64_t bus_freq;
 193
 194     if (env->apic_bus_freq != 0) {
 195         return;
 196     }
 197
 198     length = sizeof(uint64_t);
 199     if (sysctlbyname("hw.busfrequency", &bus_freq, &length, NULL, 0)) {
 200         return;
 201     }
 202     env->apic_bus_freq = bus_freq;
 203 }
 204
 205 static inline bool tsc_is_known(CPUX86State *env)
 206 {
 207     return env->tsc_khz != 0;
 208 }
 209
 210 static inline bool apic_bus_freq_is_known(CPUX86State *env)
 211 {
 212     return env->apic_bus_freq != 0;
 213 }
 214
 215 void hvf_kick_vcpu_thread(CPUState *cpu)
 216 {
 217     cpus_kick_thread(cpu);
 218     hv_vcpu_interrupt(&cpu->accel->fd, 1);
 219 }
 220
 221 int hvf_arch_init(void)
 222 {
 223     return 0;
 224 }
 225
 226 hv_return_t hvf_arch_vm_create(MachineState *ms, uint32_t pa_range)
 227 {
 228     return hv_vm_create(HV_VM_DEFAULT);
 229 }
 230
 231 int hvf_arch_init_vcpu(CPUState *cpu)
 232 {
 233     X86CPU *x86cpu = X86_CPU(cpu);
 234     CPUX86State *env = &x86cpu->env;
 235     Error *local_err = NULL;
 236     int r;
 237     uint64_t reqCap;
 238
 239     init_emu();
 240     init_decoder();
 241
 242     hvf_state->hvf_caps = g_new0(struct hvf_vcpu_caps, 1);
 243     env->hvf_mmio_buf = g_new(char, 4096);
 244
 245     if (x86cpu->vmware_cpuid_freq) {
 246         init_tsc_freq(env);
 247         init_apic_bus_freq(env);
 248
 249         if (!tsc_is_known(env) || !apic_bus_freq_is_known(env)) {
 250             error_report("vmware-cpuid-freq: feature couldn't be enabled");
 251         }
 252     }
 253
 254     if ((env->features[FEAT_8000_0007_EDX] & CPUID_APM_INVTSC) &&
 255         invtsc_mig_blocker == NULL) {
 256         error_setg(&invtsc_mig_blocker,
 257                    "State blocked by non-migratable CPU device (invtsc flag)");
 258         r = migrate_add_blocker(&invtsc_mig_blocker, &local_err);
 259         if (r < 0) {
 260             error_report_err(local_err);
 261             return r;
 262         }
 263     }
 264
 265
 266     if (hv_vmx_read_capability(HV_VMX_CAP_PINBASED,
 267         &hvf_state->hvf_caps->vmx_cap_pinbased)) {
 268         abort();
 269     }
 270     if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED,
 271         &hvf_state->hvf_caps->vmx_cap_procbased)) {
 272         abort();
 273     }
 274     if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED2,
 275         &hvf_state->hvf_caps->vmx_cap_procbased2)) {
 276         abort();
 277     }
 278     if (hv_vmx_read_capability(HV_VMX_CAP_ENTRY,
 279         &hvf_state->hvf_caps->vmx_cap_entry)) {
 280         abort();
 281     }
 282
 283     /* set VMCS control fields */
 284     wvmcs(cpu->accel->fd, VMCS_PIN_BASED_CTLS,
 285           cap2ctrl(hvf_state->hvf_caps->vmx_cap_pinbased,
 286                    VMCS_PIN_BASED_CTLS_EXTINT |
 287                    VMCS_PIN_BASED_CTLS_NMI |
 288                    VMCS_PIN_BASED_CTLS_VNMI));
 289     wvmcs(cpu->accel->fd, VMCS_PRI_PROC_BASED_CTLS,
 290           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased,
 291                    VMCS_PRI_PROC_BASED_CTLS_HLT |
 292                    VMCS_PRI_PROC_BASED_CTLS_MWAIT |
 293                    VMCS_PRI_PROC_BASED_CTLS_TSC_OFFSET |
 294                    VMCS_PRI_PROC_BASED_CTLS_TPR_SHADOW) |
 295           VMCS_PRI_PROC_BASED_CTLS_SEC_CONTROL);
 296
 297     reqCap = VMCS_PRI_PROC_BASED2_CTLS_APIC_ACCESSES;
 298
 299     /* Is RDTSCP support in CPUID?  If so, enable it in the VMCS. */
 300     if (hvf_get_supported_cpuid(0x80000001, 0, R_EDX) & CPUID_EXT2_RDTSCP) {
 301         reqCap |= VMCS_PRI_PROC_BASED2_CTLS_RDTSCP;
 302     }
 303
 304     wvmcs(cpu->accel->fd, VMCS_SEC_PROC_BASED_CTLS,
 305           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased2, reqCap));
 306
 307     wvmcs(cpu->accel->fd, VMCS_ENTRY_CTLS,
 308           cap2ctrl(hvf_state->hvf_caps->vmx_cap_entry, 0));
 309     wvmcs(cpu->accel->fd, VMCS_EXCEPTION_BITMAP, 0); /* Double fault */
 310
 311     wvmcs(cpu->accel->fd, VMCS_TPR_THRESHOLD, 0);
 312
 313     x86cpu = X86_CPU(cpu);
 314     x86cpu->env.xsave_buf_len = 4096;
 315     x86cpu->env.xsave_buf = qemu_memalign(4096, x86cpu->env.xsave_buf_len);
 316
 317     /*
 318      * The allocated storage must be large enough for all of the
 319      * possible XSAVE state components.
 320      */
 321     assert(hvf_get_supported_cpuid(0xd, 0, R_ECX) <= x86cpu->env.xsave_buf_len);
 322
 323     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_STAR, 1);
 324     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_LSTAR, 1);
 325     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_CSTAR, 1);
 326     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_FMASK, 1);
 327     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_FSBASE, 1);
 328     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_GSBASE, 1);
 329     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_KERNELGSBASE, 1);
 330     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_TSC_AUX, 1);
 331     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_TSC, 1);
 332     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_SYSENTER_CS, 1);
 333     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_SYSENTER_EIP, 1);
 334     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_SYSENTER_ESP, 1);
 335
 336     return 0;
 337 }
 338
 339 static void hvf_store_events(CPUState *cpu, uint32_t ins_len, uint64_t idtvec_info)
 340 {
 341     X86CPU *x86_cpu = X86_CPU(cpu);
 342     CPUX86State *env = &x86_cpu->env;
 343
 344     env->exception_nr = -1;
 345     env->exception_pending = 0;
 346     env->exception_injected = 0;
 347     env->interrupt_injected = -1;
 348     env->nmi_injected = false;
 349     env->ins_len = 0;
 350     env->has_error_code = false;
 351     if (idtvec_info & VMCS_IDT_VEC_VALID) {
 352         switch (idtvec_info & VMCS_IDT_VEC_TYPE) {
 353         case VMCS_IDT_VEC_HWINTR:
 354         case VMCS_IDT_VEC_SWINTR:
 355             env->interrupt_injected = idtvec_info & VMCS_IDT_VEC_VECNUM;
 356             break;
 357         case VMCS_IDT_VEC_NMI:
 358             env->nmi_injected = true;
 359             break;
 360         case VMCS_IDT_VEC_HWEXCEPTION:
 361         case VMCS_IDT_VEC_SWEXCEPTION:
 362             env->exception_nr = idtvec_info & VMCS_IDT_VEC_VECNUM;
 363             env->exception_injected = 1;
 364             break;
 365         case VMCS_IDT_VEC_PRIV_SWEXCEPTION:
 366         default:
 367             abort();
 368         }
 369         if ((idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWEXCEPTION ||
 370             (idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWINTR) {
 371             env->ins_len = ins_len;
 372         }
 373         if (idtvec_info & VMCS_IDT_VEC_ERRCODE_VALID) {
 374             env->has_error_code = true;
 375             env->error_code = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_ERROR);
 376         }
 377     }
 378     if ((rvmcs(cpu->accel->fd, VMCS_GUEST_INTERRUPTIBILITY) &
 379         VMCS_INTERRUPTIBILITY_NMI_BLOCKING)) {
 380         env->hflags2 |= HF2_NMI_MASK;
 381     } else {
 382         env->hflags2 &= ~HF2_NMI_MASK;
 383     }
 384     if (rvmcs(cpu->accel->fd, VMCS_GUEST_INTERRUPTIBILITY) &
 385          (VMCS_INTERRUPTIBILITY_STI_BLOCKING |
 386          VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING)) {
 387         env->hflags |= HF_INHIBIT_IRQ_MASK;
 388     } else {
 389         env->hflags &= ~HF_INHIBIT_IRQ_MASK;
 390     }
 391 }
 392
 393 static void hvf_cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
 394                               uint32_t *eax, uint32_t *ebx,
 395                               uint32_t *ecx, uint32_t *edx)
 396 {
 397     /*
 398      * A wrapper extends cpu_x86_cpuid with 0x40000000 and 0x40000010 leafs,
 399      * leafs 0x40000001-0x4000000F are filled with zeros
 400      * Provides vmware-cpuid-freq support to hvf
 401      *
 402      * Note: leaf 0x40000000 not exposes HVF,
 403      * leaving hypervisor signature empty
 404      */
 405
 406     if (index < 0x40000000 || index > 0x40000010 ||
 407         !tsc_is_known(env) || !apic_bus_freq_is_known(env)) {
 408
 409         cpu_x86_cpuid(env, index, count, eax, ebx, ecx, edx);
 410         return;
 411     }
 412
 413     switch (index) {
 414     case 0x40000000:
 415         *eax = 0x40000010;    /* Max available cpuid leaf */
 416         *ebx = 0;             /* Leave signature empty */
 417         *ecx = 0;
 418         *edx = 0;
 419         break;
 420     case 0x40000010:
 421         *eax = env->tsc_khz;
 422         *ebx = env->apic_bus_freq / 1000; /* Hz to KHz */
 423         *ecx = 0;
 424         *edx = 0;
 425         break;
 426     default:
 427         *eax = 0;
 428         *ebx = 0;
 429         *ecx = 0;
 430         *edx = 0;
 431         break;
 432     }
 433 }
 434
 435 int hvf_vcpu_exec(CPUState *cpu)
 436 {
 437     X86CPU *x86_cpu = X86_CPU(cpu);
 438     CPUX86State *env = &x86_cpu->env;
 439     int ret = 0;
 440     uint64_t rip = 0;
 441
 442     if (hvf_process_events(cpu)) {
 443         return EXCP_HLT;
 444     }
 445
 446     do {
 447         if (cpu->accel->dirty) {
 448             hvf_put_registers(cpu);
 449             cpu->accel->dirty = false;
 450         }
 451
 452         if (hvf_inject_interrupts(cpu)) {
 453             return EXCP_INTERRUPT;
 454         }
 455         vmx_update_tpr(cpu);
 456
 457         bql_unlock();
 458         if (!cpu_is_bsp(X86_CPU(cpu)) && cpu->halted) {
 459             bql_lock();
 460             return EXCP_HLT;
 461         }
 462
 463         hv_return_t r = hv_vcpu_run_until(cpu->accel->fd, HV_DEADLINE_FOREVER);
 464         assert_hvf_ok(r);
 465
 466         /* handle VMEXIT */
 467         uint64_t exit_reason = rvmcs(cpu->accel->fd, VMCS_EXIT_REASON);
 468         uint64_t exit_qual = rvmcs(cpu->accel->fd, VMCS_EXIT_QUALIFICATION);
 469         uint32_t ins_len = (uint32_t)rvmcs(cpu->accel->fd,
 470                                            VMCS_EXIT_INSTRUCTION_LENGTH);
 471
 472         uint64_t idtvec_info = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_INFO);
 473
 474         hvf_store_events(cpu, ins_len, idtvec_info);
 475         rip = rreg(cpu->accel->fd, HV_X86_RIP);
 476         env->eflags = rreg(cpu->accel->fd, HV_X86_RFLAGS);
 477
 478         bql_lock();
 479
 480         update_apic_tpr(cpu);
 481         current_cpu = cpu;
 482
 483         ret = 0;
 484         switch (exit_reason) {
 485         case EXIT_REASON_HLT: {
 486             macvm_set_rip(cpu, rip + ins_len);
 487             if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) &&
 488                 (env->eflags & IF_MASK))
 489                 && !(cpu->interrupt_request & CPU_INTERRUPT_NMI) &&
 490                 !(idtvec_info & VMCS_IDT_VEC_VALID)) {
 491                 cpu->halted = 1;
 492                 ret = EXCP_HLT;
 493                 break;
 494             }
 495             ret = EXCP_INTERRUPT;
 496             break;
 497         }
 498         case EXIT_REASON_MWAIT: {
 499             ret = EXCP_INTERRUPT;
 500             break;
 501         }
 502         /* Need to check if MMIO or unmapped fault */
 503         case EXIT_REASON_EPT_FAULT:
 504         {
 505             hvf_slot *slot;
 506             uint64_t gpa = rvmcs(cpu->accel->fd, VMCS_GUEST_PHYSICAL_ADDRESS);
 507
 508             if (((idtvec_info & VMCS_IDT_VEC_VALID) == 0) &&
 509                 ((exit_qual & EXIT_QUAL_NMIUDTI) != 0)) {
 510                 vmx_set_nmi_blocking(cpu);
 511             }
 512
 513             slot = hvf_find_overlap_slot(gpa, 1);
 514             /* mmio */
 515             if (ept_emulation_fault(slot, gpa, exit_qual)) {
 516                 struct x86_decode decode;
 517
 518                 load_regs(cpu);
 519                 decode_instruction(env, &decode);
 520                 exec_instruction(env, &decode);
 521                 store_regs(cpu);
 522                 break;
 523             }
 524             break;
 525         }
 526         case EXIT_REASON_INOUT:
 527         {
 528             uint32_t in = (exit_qual & 8) != 0;
 529             uint32_t size =  (exit_qual & 7) + 1;
 530             uint32_t string =  (exit_qual & 16) != 0;
 531             uint32_t port =  exit_qual >> 16;
 532             /*uint32_t rep = (exit_qual & 0x20) != 0;*/
 533
 534             if (!string && in) {
 535                 uint64_t val = 0;
 536                 load_regs(cpu);
 537                 hvf_handle_io(env, port, &val, 0, size, 1);
 538                 if (size == 1) {
 539                     AL(env) = val;
 540                 } else if (size == 2) {
 541                     AX(env) = val;
 542                 } else if (size == 4) {
 543                     RAX(env) = (uint32_t)val;
 544                 } else {
 545                     RAX(env) = (uint64_t)val;
 546                 }
 547                 env->eip += ins_len;
 548                 store_regs(cpu);
 549                 break;
 550             } else if (!string && !in) {
 551                 RAX(env) = rreg(cpu->accel->fd, HV_X86_RAX);
 552                 hvf_handle_io(env, port, &RAX(env), 1, size, 1);
 553                 macvm_set_rip(cpu, rip + ins_len);
 554                 break;
 555             }
 556             struct x86_decode decode;
 557
 558             load_regs(cpu);
 559             decode_instruction(env, &decode);
 560             assert(ins_len == decode.len);
 561             exec_instruction(env, &decode);
 562             store_regs(cpu);
 563
 564             break;
 565         }
 566         case EXIT_REASON_CPUID: {
 567             uint32_t rax = (uint32_t)rreg(cpu->accel->fd, HV_X86_RAX);
 568             uint32_t rbx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RBX);
 569             uint32_t rcx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RCX);
 570             uint32_t rdx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RDX);
 571
 572             if (rax == 1) {
 573                 /* CPUID1.ecx.OSXSAVE needs to know CR4 */
 574                 env->cr[4] = rvmcs(cpu->accel->fd, VMCS_GUEST_CR4);
 575             }
 576             hvf_cpu_x86_cpuid(env, rax, rcx, &rax, &rbx, &rcx, &rdx);
 577
 578             wreg(cpu->accel->fd, HV_X86_RAX, rax);
 579             wreg(cpu->accel->fd, HV_X86_RBX, rbx);
 580             wreg(cpu->accel->fd, HV_X86_RCX, rcx);
 581             wreg(cpu->accel->fd, HV_X86_RDX, rdx);
 582
 583             macvm_set_rip(cpu, rip + ins_len);
 584             break;
 585         }
 586         case EXIT_REASON_XSETBV: {
 587             X86CPU *x86_cpu = X86_CPU(cpu);
 588             CPUX86State *env = &x86_cpu->env;
 589             uint32_t eax = (uint32_t)rreg(cpu->accel->fd, HV_X86_RAX);
 590             uint32_t ecx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RCX);
 591             uint32_t edx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RDX);
 592
 593             if (ecx) {
 594                 macvm_set_rip(cpu, rip + ins_len);
 595                 break;
 596             }
 597             env->xcr0 = ((uint64_t)edx << 32) | eax;
 598             wreg(cpu->accel->fd, HV_X86_XCR0, env->xcr0 | 1);
 599             macvm_set_rip(cpu, rip + ins_len);
 600             break;
 601         }
 602         case EXIT_REASON_INTR_WINDOW:
 603             vmx_clear_int_window_exiting(cpu);
 604             ret = EXCP_INTERRUPT;
 605             break;
 606         case EXIT_REASON_NMI_WINDOW:
 607             vmx_clear_nmi_window_exiting(cpu);
 608             ret = EXCP_INTERRUPT;
 609             break;
 610         case EXIT_REASON_EXT_INTR:
 611             /* force exit and allow io handling */
 612             ret = EXCP_INTERRUPT;
 613             break;
 614         case EXIT_REASON_RDMSR:
 615         case EXIT_REASON_WRMSR:
 616         {
 617             load_regs(cpu);
 618             if (exit_reason == EXIT_REASON_RDMSR) {
 619                 simulate_rdmsr(env);
 620             } else {
 621                 simulate_wrmsr(env);
 622             }
 623             env->eip += ins_len;
 624             store_regs(cpu);
 625             break;
 626         }
 627         case EXIT_REASON_CR_ACCESS: {
 628             int cr;
 629             int reg;
 630
 631             load_regs(cpu);
 632             cr = exit_qual & 15;
 633             reg = (exit_qual >> 8) & 15;
 634
 635             switch (cr) {
 636             case 0x0: {
 637                 macvm_set_cr0(cpu->accel->fd, RRX(env, reg));
 638                 break;
 639             }
 640             case 4: {
 641                 macvm_set_cr4(cpu->accel->fd, RRX(env, reg));
 642                 break;
 643             }
 644             case 8: {
 645                 X86CPU *x86_cpu = X86_CPU(cpu);
 646                 if (exit_qual & 0x10) {
 647                     RRX(env, reg) = cpu_get_apic_tpr(x86_cpu->apic_state);
 648                 } else {
 649                     int tpr = RRX(env, reg);
 650                     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
 651                     ret = EXCP_INTERRUPT;
 652                 }
 653                 break;
 654             }
 655             default:
 656                 error_report("Unrecognized CR %d", cr);
 657                 abort();
 658             }
 659             env->eip += ins_len;
 660             store_regs(cpu);
 661             break;
 662         }
 663         case EXIT_REASON_APIC_ACCESS: { /* TODO */
 664             struct x86_decode decode;
 665
 666             load_regs(cpu);
 667             decode_instruction(env, &decode);
 668             exec_instruction(env, &decode);
 669             store_regs(cpu);
 670             break;
 671         }
 672         case EXIT_REASON_TPR: {
 673             ret = 1;
 674             break;
 675         }
 676         case EXIT_REASON_TASK_SWITCH: {
 677             uint64_t vinfo = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_INFO);
 678             x68_segment_selector sel = {.sel = exit_qual & 0xffff};
 679             vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3,
 680              vinfo & VMCS_INTR_VALID, vinfo & VECTORING_INFO_VECTOR_MASK, vinfo
 681              & VMCS_INTR_T_MASK);
 682             break;
 683         }
 684         case EXIT_REASON_TRIPLE_FAULT: {
 685             qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
 686             ret = EXCP_INTERRUPT;
 687             break;
 688         }
 689         case EXIT_REASON_RDPMC:
 690             wreg(cpu->accel->fd, HV_X86_RAX, 0);
 691             wreg(cpu->accel->fd, HV_X86_RDX, 0);
 692             macvm_set_rip(cpu, rip + ins_len);
 693             break;
 694         case VMX_REASON_VMCALL:
 695             env->exception_nr = EXCP0D_GPF;
 696             env->exception_injected = 1;
 697             env->has_error_code = true;
 698             env->error_code = 0;
 699             break;
 700         default:
 701             error_report("%llx: unhandled exit %llx", rip, exit_reason);
 702         }
 703     } while (ret == 0);
 704
 705     return ret;
 706 }
 707
 708 int hvf_arch_insert_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp)
 709 {
 710     return -ENOSYS;
 711 }
 712
 713 int hvf_arch_remove_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp)
 714 {
 715     return -ENOSYS;
 716 }
 717
 718 int hvf_arch_insert_hw_breakpoint(vaddr addr, vaddr len, int type)
 719 {
 720     return -ENOSYS;
 721 }
 722
 723 int hvf_arch_remove_hw_breakpoint(vaddr addr, vaddr len, int type)
 724 {
 725     return -ENOSYS;
 726 }
 727
 728 void hvf_arch_remove_all_hw_breakpoints(void)
 729 {
 730 }
 731
 732 void hvf_arch_update_guest_debug(CPUState *cpu)
 733 {
 734 }
 735
 736 bool hvf_arch_supports_guest_debug(void)
 737 {
 738     return false;
 739 }