1 /* Copyright 2008 IBM Corporation 2 * 2008 Red Hat, Inc. 3 * Copyright 2011 Intel Corporation 4 * Copyright 2016 Veertu, Inc. 5 * Copyright 2017 The Android Open Source Project 6 * 7 * QEMU Hypervisor.framework support 8 * 9 * This program is free software; you can redistribute it and/or 10 * modify it under the terms of version 2 of the GNU General Public 11 * License as published by the Free Software Foundation. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 16 * General Public License for more details. 17 * 18 * You should have received a copy of the GNU General Public License 19 * along with this program; if not, see <http://www.gnu.org/licenses/>. 20 * 21 * This file contain code under public domain from the hvdos project: 22 * https://github.com/mist64/hvdos 23 * 24 * Parts Copyright (c) 2011 NetApp, Inc. 25 * All rights reserved. 26 * 27 * Redistribution and use in source and binary forms, with or without 28 * modification, are permitted provided that the following conditions 29 * are met: 30 * 1. Redistributions of source code must retain the above copyright 31 * notice, this list of conditions and the following disclaimer. 32 * 2. Redistributions in binary form must reproduce the above copyright 33 * notice, this list of conditions and the following disclaimer in the 34 * documentation and/or other materials provided with the distribution. 35 * 36 * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND 37 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 38 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 39 * ARE DISCLAIMED. IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE 40 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 41 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 42 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 43 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 44 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 45 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 46 * SUCH DAMAGE. 47 */ 48 49 #include "qemu/osdep.h" 50 #include "qemu/error-report.h" 51 #include "qemu/memalign.h" 52 #include "qapi/error.h" 53 #include "migration/blocker.h" 54 55 #include "system/hvf.h" 56 #include "system/hvf_int.h" 57 #include "system/runstate.h" 58 #include "system/cpus.h" 59 #include "hvf-i386.h" 60 #include "vmcs.h" 61 #include "vmx.h" 62 #include "x86.h" 63 #include "x86_descr.h" 64 #include "x86_flags.h" 65 #include "x86_mmu.h" 66 #include "x86_decode.h" 67 #include "x86_emu.h" 68 #include "x86_task.h" 69 #include "x86hvf.h" 70 71 #include <Hypervisor/hv.h> 72 #include <Hypervisor/hv_vmx.h> 73 #include <sys/sysctl.h> 74 75 #include "hw/i386/apic_internal.h" 76 #include "qemu/main-loop.h" 77 #include "qemu/accel.h" 78 #include "target/i386/cpu.h" 79 80 static Error *invtsc_mig_blocker; 81 82 void vmx_update_tpr(CPUState *cpu) 83 { 84 /* TODO: need integrate APIC handling */ 85 X86CPU *x86_cpu = X86_CPU(cpu); 86 int tpr = cpu_get_apic_tpr(x86_cpu->apic_state) << 4; 87 int irr = apic_get_highest_priority_irr(x86_cpu->apic_state); 88 89 wreg(cpu->accel->fd, HV_X86_TPR, tpr); 90 if (irr == -1) { 91 wvmcs(cpu->accel->fd, VMCS_TPR_THRESHOLD, 0); 92 } else { 93 wvmcs(cpu->accel->fd, VMCS_TPR_THRESHOLD, (irr > tpr) ? tpr >> 4 : 94 irr >> 4); 95 } 96 } 97 98 static void update_apic_tpr(CPUState *cpu) 99 { 100 X86CPU *x86_cpu = X86_CPU(cpu); 101 int tpr = rreg(cpu->accel->fd, HV_X86_TPR) >> 4; 102 cpu_set_apic_tpr(x86_cpu->apic_state, tpr); 103 } 104 105 #define VECTORING_INFO_VECTOR_MASK 0xff 106 107 void hvf_handle_io(CPUState *env, uint16_t port, void *buffer, 108 int direction, int size, int count) 109 { 110 int i; 111 uint8_t *ptr = buffer; 112 113 for (i = 0; i < count; i++) { 114 address_space_rw(&address_space_io, port, MEMTXATTRS_UNSPECIFIED, 115 ptr, size, 116 direction); 117 ptr += size; 118 } 119 } 120 121 static bool ept_emulation_fault(hvf_slot *slot, uint64_t gpa, uint64_t ept_qual) 122 { 123 int read, write; 124 125 /* EPT fault on an instruction fetch doesn't make sense here */ 126 if (ept_qual & EPT_VIOLATION_INST_FETCH) { 127 return false; 128 } 129 130 /* EPT fault must be a read fault or a write fault */ 131 read = ept_qual & EPT_VIOLATION_DATA_READ ? 1 : 0; 132 write = ept_qual & EPT_VIOLATION_DATA_WRITE ? 1 : 0; 133 if ((read | write) == 0) { 134 return false; 135 } 136 137 if (write && slot) { 138 if (slot->flags & HVF_SLOT_LOG) { 139 uint64_t dirty_page_start = gpa & ~(TARGET_PAGE_SIZE - 1u); 140 memory_region_set_dirty(slot->region, gpa - slot->start, 1); 141 hv_vm_protect(dirty_page_start, TARGET_PAGE_SIZE, 142 HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC); 143 } 144 } 145 146 /* 147 * The EPT violation must have been caused by accessing a 148 * guest-physical address that is a translation of a guest-linear 149 * address. 150 */ 151 if ((ept_qual & EPT_VIOLATION_GLA_VALID) == 0 || 152 (ept_qual & EPT_VIOLATION_XLAT_VALID) == 0) { 153 return false; 154 } 155 156 if (!slot) { 157 return true; 158 } 159 if (!memory_region_is_ram(slot->region) && 160 !(read && memory_region_is_romd(slot->region))) { 161 return true; 162 } 163 return false; 164 } 165 166 void hvf_arch_vcpu_destroy(CPUState *cpu) 167 { 168 X86CPU *x86_cpu = X86_CPU(cpu); 169 CPUX86State *env = &x86_cpu->env; 170 171 g_free(env->hvf_mmio_buf); 172 } 173 174 static void init_tsc_freq(CPUX86State *env) 175 { 176 size_t length; 177 uint64_t tsc_freq; 178 179 if (env->tsc_khz != 0) { 180 return; 181 } 182 183 length = sizeof(uint64_t); 184 if (sysctlbyname("machdep.tsc.frequency", &tsc_freq, &length, NULL, 0)) { 185 return; 186 } 187 env->tsc_khz = tsc_freq / 1000; /* Hz to KHz */ 188 } 189 190 static void init_apic_bus_freq(CPUX86State *env) 191 { 192 size_t length; 193 uint64_t bus_freq; 194 195 if (env->apic_bus_freq != 0) { 196 return; 197 } 198 199 length = sizeof(uint64_t); 200 if (sysctlbyname("hw.busfrequency", &bus_freq, &length, NULL, 0)) { 201 return; 202 } 203 env->apic_bus_freq = bus_freq; 204 } 205 206 static inline bool tsc_is_known(CPUX86State *env) 207 { 208 return env->tsc_khz != 0; 209 } 210 211 static inline bool apic_bus_freq_is_known(CPUX86State *env) 212 { 213 return env->apic_bus_freq != 0; 214 } 215 216 void hvf_kick_vcpu_thread(CPUState *cpu) 217 { 218 cpus_kick_thread(cpu); 219 hv_vcpu_interrupt(&cpu->accel->fd, 1); 220 } 221 222 int hvf_arch_init(void) 223 { 224 return 0; 225 } 226 227 hv_return_t hvf_arch_vm_create(MachineState *ms, uint32_t pa_range) 228 { 229 return hv_vm_create(HV_VM_DEFAULT); 230 } 231 232 int hvf_arch_init_vcpu(CPUState *cpu) 233 { 234 X86CPU *x86cpu = X86_CPU(cpu); 235 CPUX86State *env = &x86cpu->env; 236 Error *local_err = NULL; 237 int r; 238 uint64_t reqCap; 239 240 init_emu(); 241 init_decoder(); 242 243 if (hvf_state->hvf_caps == NULL) { 244 hvf_state->hvf_caps = g_new0(struct hvf_vcpu_caps, 1); 245 } 246 env->hvf_mmio_buf = g_new(char, 4096); 247 248 if (x86cpu->vmware_cpuid_freq) { 249 init_tsc_freq(env); 250 init_apic_bus_freq(env); 251 252 if (!tsc_is_known(env) || !apic_bus_freq_is_known(env)) { 253 error_report("vmware-cpuid-freq: feature couldn't be enabled"); 254 } 255 } 256 257 if ((env->features[FEAT_8000_0007_EDX] & CPUID_APM_INVTSC) && 258 invtsc_mig_blocker == NULL) { 259 error_setg(&invtsc_mig_blocker, 260 "State blocked by non-migratable CPU device (invtsc flag)"); 261 r = migrate_add_blocker(&invtsc_mig_blocker, &local_err); 262 if (r < 0) { 263 error_report_err(local_err); 264 return r; 265 } 266 } 267 268 269 if (hv_vmx_read_capability(HV_VMX_CAP_PINBASED, 270 &hvf_state->hvf_caps->vmx_cap_pinbased)) { 271 abort(); 272 } 273 if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED, 274 &hvf_state->hvf_caps->vmx_cap_procbased)) { 275 abort(); 276 } 277 if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED2, 278 &hvf_state->hvf_caps->vmx_cap_procbased2)) { 279 abort(); 280 } 281 if (hv_vmx_read_capability(HV_VMX_CAP_ENTRY, 282 &hvf_state->hvf_caps->vmx_cap_entry)) { 283 abort(); 284 } 285 286 /* set VMCS control fields */ 287 wvmcs(cpu->accel->fd, VMCS_PIN_BASED_CTLS, 288 cap2ctrl(hvf_state->hvf_caps->vmx_cap_pinbased, 289 VMCS_PIN_BASED_CTLS_EXTINT | 290 VMCS_PIN_BASED_CTLS_NMI | 291 VMCS_PIN_BASED_CTLS_VNMI)); 292 wvmcs(cpu->accel->fd, VMCS_PRI_PROC_BASED_CTLS, 293 cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased, 294 VMCS_PRI_PROC_BASED_CTLS_HLT | 295 VMCS_PRI_PROC_BASED_CTLS_MWAIT | 296 VMCS_PRI_PROC_BASED_CTLS_TSC_OFFSET | 297 VMCS_PRI_PROC_BASED_CTLS_TPR_SHADOW) | 298 VMCS_PRI_PROC_BASED_CTLS_SEC_CONTROL); 299 300 reqCap = VMCS_PRI_PROC_BASED2_CTLS_APIC_ACCESSES; 301 302 /* Is RDTSCP support in CPUID? If so, enable it in the VMCS. */ 303 if (hvf_get_supported_cpuid(0x80000001, 0, R_EDX) & CPUID_EXT2_RDTSCP) { 304 reqCap |= VMCS_PRI_PROC_BASED2_CTLS_RDTSCP; 305 } 306 307 wvmcs(cpu->accel->fd, VMCS_SEC_PROC_BASED_CTLS, 308 cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased2, reqCap)); 309 310 wvmcs(cpu->accel->fd, VMCS_ENTRY_CTLS, 311 cap2ctrl(hvf_state->hvf_caps->vmx_cap_entry, 0)); 312 wvmcs(cpu->accel->fd, VMCS_EXCEPTION_BITMAP, 0); /* Double fault */ 313 314 wvmcs(cpu->accel->fd, VMCS_TPR_THRESHOLD, 0); 315 316 x86cpu = X86_CPU(cpu); 317 x86cpu->env.xsave_buf_len = 4096; 318 x86cpu->env.xsave_buf = qemu_memalign(4096, x86cpu->env.xsave_buf_len); 319 320 /* 321 * The allocated storage must be large enough for all of the 322 * possible XSAVE state components. 323 */ 324 assert(hvf_get_supported_cpuid(0xd, 0, R_ECX) <= x86cpu->env.xsave_buf_len); 325 326 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_STAR, 1); 327 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_LSTAR, 1); 328 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_CSTAR, 1); 329 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_FMASK, 1); 330 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_FSBASE, 1); 331 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_GSBASE, 1); 332 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_KERNELGSBASE, 1); 333 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_TSC_AUX, 1); 334 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_TSC, 1); 335 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_SYSENTER_CS, 1); 336 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_SYSENTER_EIP, 1); 337 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_SYSENTER_ESP, 1); 338 339 return 0; 340 } 341 342 static void hvf_store_events(CPUState *cpu, uint32_t ins_len, uint64_t idtvec_info) 343 { 344 X86CPU *x86_cpu = X86_CPU(cpu); 345 CPUX86State *env = &x86_cpu->env; 346 347 env->exception_nr = -1; 348 env->exception_pending = 0; 349 env->exception_injected = 0; 350 env->interrupt_injected = -1; 351 env->nmi_injected = false; 352 env->ins_len = 0; 353 env->has_error_code = false; 354 if (idtvec_info & VMCS_IDT_VEC_VALID) { 355 switch (idtvec_info & VMCS_IDT_VEC_TYPE) { 356 case VMCS_IDT_VEC_HWINTR: 357 case VMCS_IDT_VEC_SWINTR: 358 env->interrupt_injected = idtvec_info & VMCS_IDT_VEC_VECNUM; 359 break; 360 case VMCS_IDT_VEC_NMI: 361 env->nmi_injected = true; 362 break; 363 case VMCS_IDT_VEC_HWEXCEPTION: 364 case VMCS_IDT_VEC_SWEXCEPTION: 365 env->exception_nr = idtvec_info & VMCS_IDT_VEC_VECNUM; 366 env->exception_injected = 1; 367 break; 368 case VMCS_IDT_VEC_PRIV_SWEXCEPTION: 369 default: 370 abort(); 371 } 372 if ((idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWEXCEPTION || 373 (idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWINTR) { 374 env->ins_len = ins_len; 375 } 376 if (idtvec_info & VMCS_IDT_VEC_ERRCODE_VALID) { 377 env->has_error_code = true; 378 env->error_code = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_ERROR); 379 } 380 } 381 if ((rvmcs(cpu->accel->fd, VMCS_GUEST_INTERRUPTIBILITY) & 382 VMCS_INTERRUPTIBILITY_NMI_BLOCKING)) { 383 env->hflags2 |= HF2_NMI_MASK; 384 } else { 385 env->hflags2 &= ~HF2_NMI_MASK; 386 } 387 if (rvmcs(cpu->accel->fd, VMCS_GUEST_INTERRUPTIBILITY) & 388 (VMCS_INTERRUPTIBILITY_STI_BLOCKING | 389 VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING)) { 390 env->hflags |= HF_INHIBIT_IRQ_MASK; 391 } else { 392 env->hflags &= ~HF_INHIBIT_IRQ_MASK; 393 } 394 } 395 396 static void hvf_cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count, 397 uint32_t *eax, uint32_t *ebx, 398 uint32_t *ecx, uint32_t *edx) 399 { 400 /* 401 * A wrapper extends cpu_x86_cpuid with 0x40000000 and 0x40000010 leafs, 402 * leafs 0x40000001-0x4000000F are filled with zeros 403 * Provides vmware-cpuid-freq support to hvf 404 * 405 * Note: leaf 0x40000000 not exposes HVF, 406 * leaving hypervisor signature empty 407 */ 408 409 if (index < 0x40000000 || index > 0x40000010 || 410 !tsc_is_known(env) || !apic_bus_freq_is_known(env)) { 411 412 cpu_x86_cpuid(env, index, count, eax, ebx, ecx, edx); 413 return; 414 } 415 416 switch (index) { 417 case 0x40000000: 418 *eax = 0x40000010; /* Max available cpuid leaf */ 419 *ebx = 0; /* Leave signature empty */ 420 *ecx = 0; 421 *edx = 0; 422 break; 423 case 0x40000010: 424 *eax = env->tsc_khz; 425 *ebx = env->apic_bus_freq / 1000; /* Hz to KHz */ 426 *ecx = 0; 427 *edx = 0; 428 break; 429 default: 430 *eax = 0; 431 *ebx = 0; 432 *ecx = 0; 433 *edx = 0; 434 break; 435 } 436 } 437 438 void hvf_load_regs(CPUState *cs) 439 { 440 X86CPU *cpu = X86_CPU(cs); 441 CPUX86State *env = &cpu->env; 442 443 int i = 0; 444 RRX(env, R_EAX) = rreg(cs->accel->fd, HV_X86_RAX); 445 RRX(env, R_EBX) = rreg(cs->accel->fd, HV_X86_RBX); 446 RRX(env, R_ECX) = rreg(cs->accel->fd, HV_X86_RCX); 447 RRX(env, R_EDX) = rreg(cs->accel->fd, HV_X86_RDX); 448 RRX(env, R_ESI) = rreg(cs->accel->fd, HV_X86_RSI); 449 RRX(env, R_EDI) = rreg(cs->accel->fd, HV_X86_RDI); 450 RRX(env, R_ESP) = rreg(cs->accel->fd, HV_X86_RSP); 451 RRX(env, R_EBP) = rreg(cs->accel->fd, HV_X86_RBP); 452 for (i = 8; i < 16; i++) { 453 RRX(env, i) = rreg(cs->accel->fd, HV_X86_RAX + i); 454 } 455 456 env->eflags = rreg(cs->accel->fd, HV_X86_RFLAGS); 457 rflags_to_lflags(env); 458 env->eip = rreg(cs->accel->fd, HV_X86_RIP); 459 } 460 461 void hvf_store_regs(CPUState *cs) 462 { 463 X86CPU *cpu = X86_CPU(cs); 464 CPUX86State *env = &cpu->env; 465 466 int i = 0; 467 wreg(cs->accel->fd, HV_X86_RAX, RAX(env)); 468 wreg(cs->accel->fd, HV_X86_RBX, RBX(env)); 469 wreg(cs->accel->fd, HV_X86_RCX, RCX(env)); 470 wreg(cs->accel->fd, HV_X86_RDX, RDX(env)); 471 wreg(cs->accel->fd, HV_X86_RSI, RSI(env)); 472 wreg(cs->accel->fd, HV_X86_RDI, RDI(env)); 473 wreg(cs->accel->fd, HV_X86_RBP, RBP(env)); 474 wreg(cs->accel->fd, HV_X86_RSP, RSP(env)); 475 for (i = 8; i < 16; i++) { 476 wreg(cs->accel->fd, HV_X86_RAX + i, RRX(env, i)); 477 } 478 479 lflags_to_rflags(env); 480 wreg(cs->accel->fd, HV_X86_RFLAGS, env->eflags); 481 macvm_set_rip(cs, env->eip); 482 } 483 484 void hvf_simulate_rdmsr(CPUX86State *env) 485 { 486 X86CPU *cpu = env_archcpu(env); 487 CPUState *cs = env_cpu(env); 488 uint32_t msr = ECX(env); 489 uint64_t val = 0; 490 491 switch (msr) { 492 case MSR_IA32_TSC: 493 val = rdtscp() + rvmcs(cs->accel->fd, VMCS_TSC_OFFSET); 494 break; 495 case MSR_IA32_APICBASE: 496 val = cpu_get_apic_base(cpu->apic_state); 497 break; 498 case MSR_APIC_START ... MSR_APIC_END: { 499 int ret; 500 int index = (uint32_t)env->regs[R_ECX] - MSR_APIC_START; 501 502 ret = apic_msr_read(index, &val); 503 if (ret < 0) { 504 x86_emul_raise_exception(env, EXCP0D_GPF, 0); 505 } 506 507 break; 508 } 509 case MSR_IA32_UCODE_REV: 510 val = cpu->ucode_rev; 511 break; 512 case MSR_EFER: 513 val = rvmcs(cs->accel->fd, VMCS_GUEST_IA32_EFER); 514 break; 515 case MSR_FSBASE: 516 val = rvmcs(cs->accel->fd, VMCS_GUEST_FS_BASE); 517 break; 518 case MSR_GSBASE: 519 val = rvmcs(cs->accel->fd, VMCS_GUEST_GS_BASE); 520 break; 521 case MSR_KERNELGSBASE: 522 val = rvmcs(cs->accel->fd, VMCS_HOST_FS_BASE); 523 break; 524 case MSR_STAR: 525 abort(); 526 break; 527 case MSR_LSTAR: 528 abort(); 529 break; 530 case MSR_CSTAR: 531 abort(); 532 break; 533 case MSR_IA32_MISC_ENABLE: 534 val = env->msr_ia32_misc_enable; 535 break; 536 case MSR_MTRRphysBase(0): 537 case MSR_MTRRphysBase(1): 538 case MSR_MTRRphysBase(2): 539 case MSR_MTRRphysBase(3): 540 case MSR_MTRRphysBase(4): 541 case MSR_MTRRphysBase(5): 542 case MSR_MTRRphysBase(6): 543 case MSR_MTRRphysBase(7): 544 val = env->mtrr_var[(ECX(env) - MSR_MTRRphysBase(0)) / 2].base; 545 break; 546 case MSR_MTRRphysMask(0): 547 case MSR_MTRRphysMask(1): 548 case MSR_MTRRphysMask(2): 549 case MSR_MTRRphysMask(3): 550 case MSR_MTRRphysMask(4): 551 case MSR_MTRRphysMask(5): 552 case MSR_MTRRphysMask(6): 553 case MSR_MTRRphysMask(7): 554 val = env->mtrr_var[(ECX(env) - MSR_MTRRphysMask(0)) / 2].mask; 555 break; 556 case MSR_MTRRfix64K_00000: 557 val = env->mtrr_fixed[0]; 558 break; 559 case MSR_MTRRfix16K_80000: 560 case MSR_MTRRfix16K_A0000: 561 val = env->mtrr_fixed[ECX(env) - MSR_MTRRfix16K_80000 + 1]; 562 break; 563 case MSR_MTRRfix4K_C0000: 564 case MSR_MTRRfix4K_C8000: 565 case MSR_MTRRfix4K_D0000: 566 case MSR_MTRRfix4K_D8000: 567 case MSR_MTRRfix4K_E0000: 568 case MSR_MTRRfix4K_E8000: 569 case MSR_MTRRfix4K_F0000: 570 case MSR_MTRRfix4K_F8000: 571 val = env->mtrr_fixed[ECX(env) - MSR_MTRRfix4K_C0000 + 3]; 572 break; 573 case MSR_MTRRdefType: 574 val = env->mtrr_deftype; 575 break; 576 case MSR_CORE_THREAD_COUNT: 577 val = cpu_x86_get_msr_core_thread_count(cpu); 578 break; 579 default: 580 /* fprintf(stderr, "%s: unknown msr 0x%x\n", __func__, msr); */ 581 val = 0; 582 break; 583 } 584 585 RAX(env) = (uint32_t)val; 586 RDX(env) = (uint32_t)(val >> 32); 587 } 588 589 void hvf_simulate_wrmsr(CPUX86State *env) 590 { 591 X86CPU *cpu = env_archcpu(env); 592 CPUState *cs = env_cpu(env); 593 uint32_t msr = ECX(env); 594 uint64_t data = ((uint64_t)EDX(env) << 32) | EAX(env); 595 596 switch (msr) { 597 case MSR_IA32_TSC: 598 break; 599 case MSR_IA32_APICBASE: { 600 int r; 601 602 r = cpu_set_apic_base(cpu->apic_state, data); 603 if (r < 0) { 604 x86_emul_raise_exception(env, EXCP0D_GPF, 0); 605 } 606 607 break; 608 } 609 case MSR_APIC_START ... MSR_APIC_END: { 610 int ret; 611 int index = (uint32_t)env->regs[R_ECX] - MSR_APIC_START; 612 613 ret = apic_msr_write(index, data); 614 if (ret < 0) { 615 x86_emul_raise_exception(env, EXCP0D_GPF, 0); 616 } 617 618 break; 619 } 620 case MSR_FSBASE: 621 wvmcs(cs->accel->fd, VMCS_GUEST_FS_BASE, data); 622 break; 623 case MSR_GSBASE: 624 wvmcs(cs->accel->fd, VMCS_GUEST_GS_BASE, data); 625 break; 626 case MSR_KERNELGSBASE: 627 wvmcs(cs->accel->fd, VMCS_HOST_FS_BASE, data); 628 break; 629 case MSR_STAR: 630 abort(); 631 break; 632 case MSR_LSTAR: 633 abort(); 634 break; 635 case MSR_CSTAR: 636 abort(); 637 break; 638 case MSR_EFER: 639 /*printf("new efer %llx\n", EFER(cs));*/ 640 wvmcs(cs->accel->fd, VMCS_GUEST_IA32_EFER, data); 641 if (data & MSR_EFER_NXE) { 642 hv_vcpu_invalidate_tlb(cs->accel->fd); 643 } 644 break; 645 case MSR_MTRRphysBase(0): 646 case MSR_MTRRphysBase(1): 647 case MSR_MTRRphysBase(2): 648 case MSR_MTRRphysBase(3): 649 case MSR_MTRRphysBase(4): 650 case MSR_MTRRphysBase(5): 651 case MSR_MTRRphysBase(6): 652 case MSR_MTRRphysBase(7): 653 env->mtrr_var[(ECX(env) - MSR_MTRRphysBase(0)) / 2].base = data; 654 break; 655 case MSR_MTRRphysMask(0): 656 case MSR_MTRRphysMask(1): 657 case MSR_MTRRphysMask(2): 658 case MSR_MTRRphysMask(3): 659 case MSR_MTRRphysMask(4): 660 case MSR_MTRRphysMask(5): 661 case MSR_MTRRphysMask(6): 662 case MSR_MTRRphysMask(7): 663 env->mtrr_var[(ECX(env) - MSR_MTRRphysMask(0)) / 2].mask = data; 664 break; 665 case MSR_MTRRfix64K_00000: 666 env->mtrr_fixed[ECX(env) - MSR_MTRRfix64K_00000] = data; 667 break; 668 case MSR_MTRRfix16K_80000: 669 case MSR_MTRRfix16K_A0000: 670 env->mtrr_fixed[ECX(env) - MSR_MTRRfix16K_80000 + 1] = data; 671 break; 672 case MSR_MTRRfix4K_C0000: 673 case MSR_MTRRfix4K_C8000: 674 case MSR_MTRRfix4K_D0000: 675 case MSR_MTRRfix4K_D8000: 676 case MSR_MTRRfix4K_E0000: 677 case MSR_MTRRfix4K_E8000: 678 case MSR_MTRRfix4K_F0000: 679 case MSR_MTRRfix4K_F8000: 680 env->mtrr_fixed[ECX(env) - MSR_MTRRfix4K_C0000 + 3] = data; 681 break; 682 case MSR_MTRRdefType: 683 env->mtrr_deftype = data; 684 break; 685 default: 686 break; 687 } 688 689 /* Related to support known hypervisor interface */ 690 /* if (g_hypervisor_iface) 691 g_hypervisor_iface->wrmsr_handler(cs, msr, data); 692 693 printf("write msr %llx\n", RCX(cs));*/ 694 } 695 696 int hvf_vcpu_exec(CPUState *cpu) 697 { 698 X86CPU *x86_cpu = X86_CPU(cpu); 699 CPUX86State *env = &x86_cpu->env; 700 int ret = 0; 701 uint64_t rip = 0; 702 703 if (hvf_process_events(cpu)) { 704 return EXCP_HLT; 705 } 706 707 do { 708 if (cpu->accel->dirty) { 709 hvf_put_registers(cpu); 710 cpu->accel->dirty = false; 711 } 712 713 if (hvf_inject_interrupts(cpu)) { 714 return EXCP_INTERRUPT; 715 } 716 vmx_update_tpr(cpu); 717 718 bql_unlock(); 719 if (!cpu_is_bsp(X86_CPU(cpu)) && cpu->halted) { 720 bql_lock(); 721 return EXCP_HLT; 722 } 723 724 hv_return_t r = hv_vcpu_run_until(cpu->accel->fd, HV_DEADLINE_FOREVER); 725 assert_hvf_ok(r); 726 727 /* handle VMEXIT */ 728 uint64_t exit_reason = rvmcs(cpu->accel->fd, VMCS_EXIT_REASON); 729 uint64_t exit_qual = rvmcs(cpu->accel->fd, VMCS_EXIT_QUALIFICATION); 730 uint32_t ins_len = (uint32_t)rvmcs(cpu->accel->fd, 731 VMCS_EXIT_INSTRUCTION_LENGTH); 732 733 uint64_t idtvec_info = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_INFO); 734 735 hvf_store_events(cpu, ins_len, idtvec_info); 736 rip = rreg(cpu->accel->fd, HV_X86_RIP); 737 env->eflags = rreg(cpu->accel->fd, HV_X86_RFLAGS); 738 739 bql_lock(); 740 741 update_apic_tpr(cpu); 742 current_cpu = cpu; 743 744 ret = 0; 745 switch (exit_reason) { 746 case EXIT_REASON_HLT: { 747 macvm_set_rip(cpu, rip + ins_len); 748 if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) && 749 (env->eflags & IF_MASK)) 750 && !(cpu->interrupt_request & CPU_INTERRUPT_NMI) && 751 !(idtvec_info & VMCS_IDT_VEC_VALID)) { 752 cpu->halted = 1; 753 ret = EXCP_HLT; 754 break; 755 } 756 ret = EXCP_INTERRUPT; 757 break; 758 } 759 case EXIT_REASON_MWAIT: { 760 ret = EXCP_INTERRUPT; 761 break; 762 } 763 /* Need to check if MMIO or unmapped fault */ 764 case EXIT_REASON_EPT_FAULT: 765 { 766 hvf_slot *slot; 767 uint64_t gpa = rvmcs(cpu->accel->fd, VMCS_GUEST_PHYSICAL_ADDRESS); 768 769 if (((idtvec_info & VMCS_IDT_VEC_VALID) == 0) && 770 ((exit_qual & EXIT_QUAL_NMIUDTI) != 0)) { 771 vmx_set_nmi_blocking(cpu); 772 } 773 774 slot = hvf_find_overlap_slot(gpa, 1); 775 /* mmio */ 776 if (ept_emulation_fault(slot, gpa, exit_qual)) { 777 struct x86_decode decode; 778 779 hvf_load_regs(cpu); 780 decode_instruction(env, &decode); 781 exec_instruction(env, &decode); 782 hvf_store_regs(cpu); 783 break; 784 } 785 break; 786 } 787 case EXIT_REASON_INOUT: 788 { 789 uint32_t in = (exit_qual & 8) != 0; 790 uint32_t size = (exit_qual & 7) + 1; 791 uint32_t string = (exit_qual & 16) != 0; 792 uint32_t port = exit_qual >> 16; 793 /*uint32_t rep = (exit_qual & 0x20) != 0;*/ 794 795 if (!string && in) { 796 uint64_t val = 0; 797 hvf_load_regs(cpu); 798 hvf_handle_io(env_cpu(env), port, &val, 0, size, 1); 799 if (size == 1) { 800 AL(env) = val; 801 } else if (size == 2) { 802 AX(env) = val; 803 } else if (size == 4) { 804 RAX(env) = (uint32_t)val; 805 } else { 806 RAX(env) = (uint64_t)val; 807 } 808 env->eip += ins_len; 809 hvf_store_regs(cpu); 810 break; 811 } else if (!string && !in) { 812 RAX(env) = rreg(cpu->accel->fd, HV_X86_RAX); 813 hvf_handle_io(env_cpu(env), port, &RAX(env), 1, size, 1); 814 macvm_set_rip(cpu, rip + ins_len); 815 break; 816 } 817 struct x86_decode decode; 818 819 hvf_load_regs(cpu); 820 decode_instruction(env, &decode); 821 assert(ins_len == decode.len); 822 exec_instruction(env, &decode); 823 hvf_store_regs(cpu); 824 825 break; 826 } 827 case EXIT_REASON_CPUID: { 828 uint32_t rax = (uint32_t)rreg(cpu->accel->fd, HV_X86_RAX); 829 uint32_t rbx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RBX); 830 uint32_t rcx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RCX); 831 uint32_t rdx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RDX); 832 833 if (rax == 1) { 834 /* CPUID1.ecx.OSXSAVE needs to know CR4 */ 835 env->cr[4] = rvmcs(cpu->accel->fd, VMCS_GUEST_CR4); 836 } 837 hvf_cpu_x86_cpuid(env, rax, rcx, &rax, &rbx, &rcx, &rdx); 838 839 wreg(cpu->accel->fd, HV_X86_RAX, rax); 840 wreg(cpu->accel->fd, HV_X86_RBX, rbx); 841 wreg(cpu->accel->fd, HV_X86_RCX, rcx); 842 wreg(cpu->accel->fd, HV_X86_RDX, rdx); 843 844 macvm_set_rip(cpu, rip + ins_len); 845 break; 846 } 847 case EXIT_REASON_XSETBV: { 848 uint32_t eax = (uint32_t)rreg(cpu->accel->fd, HV_X86_RAX); 849 uint32_t ecx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RCX); 850 uint32_t edx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RDX); 851 852 if (ecx) { 853 macvm_set_rip(cpu, rip + ins_len); 854 break; 855 } 856 env->xcr0 = ((uint64_t)edx << 32) | eax; 857 wreg(cpu->accel->fd, HV_X86_XCR0, env->xcr0 | 1); 858 macvm_set_rip(cpu, rip + ins_len); 859 break; 860 } 861 case EXIT_REASON_INTR_WINDOW: 862 vmx_clear_int_window_exiting(cpu); 863 ret = EXCP_INTERRUPT; 864 break; 865 case EXIT_REASON_NMI_WINDOW: 866 vmx_clear_nmi_window_exiting(cpu); 867 ret = EXCP_INTERRUPT; 868 break; 869 case EXIT_REASON_EXT_INTR: 870 /* force exit and allow io handling */ 871 ret = EXCP_INTERRUPT; 872 break; 873 case EXIT_REASON_RDMSR: 874 case EXIT_REASON_WRMSR: 875 { 876 hvf_load_regs(cpu); 877 if (exit_reason == EXIT_REASON_RDMSR) { 878 hvf_simulate_rdmsr(env); 879 } else { 880 hvf_simulate_wrmsr(env); 881 } 882 env->eip += ins_len; 883 hvf_store_regs(cpu); 884 break; 885 } 886 case EXIT_REASON_CR_ACCESS: { 887 int cr; 888 int reg; 889 890 hvf_load_regs(cpu); 891 cr = exit_qual & 15; 892 reg = (exit_qual >> 8) & 15; 893 894 switch (cr) { 895 case 0x0: { 896 macvm_set_cr0(cpu->accel->fd, RRX(env, reg)); 897 break; 898 } 899 case 4: { 900 macvm_set_cr4(cpu->accel->fd, RRX(env, reg)); 901 break; 902 } 903 case 8: { 904 if (exit_qual & 0x10) { 905 RRX(env, reg) = cpu_get_apic_tpr(x86_cpu->apic_state); 906 } else { 907 int tpr = RRX(env, reg); 908 cpu_set_apic_tpr(x86_cpu->apic_state, tpr); 909 ret = EXCP_INTERRUPT; 910 } 911 break; 912 } 913 default: 914 error_report("Unrecognized CR %d", cr); 915 abort(); 916 } 917 env->eip += ins_len; 918 hvf_store_regs(cpu); 919 break; 920 } 921 case EXIT_REASON_APIC_ACCESS: { /* TODO */ 922 struct x86_decode decode; 923 924 hvf_load_regs(cpu); 925 decode_instruction(env, &decode); 926 exec_instruction(env, &decode); 927 hvf_store_regs(cpu); 928 break; 929 } 930 case EXIT_REASON_TPR: { 931 ret = 1; 932 break; 933 } 934 case EXIT_REASON_TASK_SWITCH: { 935 uint64_t vinfo = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_INFO); 936 x86_segment_selector sel = {.sel = exit_qual & 0xffff}; 937 vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3, 938 vinfo & VMCS_INTR_VALID, vinfo & VECTORING_INFO_VECTOR_MASK, vinfo 939 & VMCS_INTR_T_MASK); 940 break; 941 } 942 case EXIT_REASON_TRIPLE_FAULT: { 943 qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET); 944 ret = EXCP_INTERRUPT; 945 break; 946 } 947 case EXIT_REASON_RDPMC: 948 wreg(cpu->accel->fd, HV_X86_RAX, 0); 949 wreg(cpu->accel->fd, HV_X86_RDX, 0); 950 macvm_set_rip(cpu, rip + ins_len); 951 break; 952 case VMX_REASON_VMCALL: 953 env->exception_nr = EXCP0D_GPF; 954 env->exception_injected = 1; 955 env->has_error_code = true; 956 env->error_code = 0; 957 break; 958 default: 959 error_report("%llx: unhandled exit %llx", rip, exit_reason); 960 } 961 } while (ret == 0); 962 963 return ret; 964 } 965 966 int hvf_arch_insert_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp) 967 { 968 return -ENOSYS; 969 } 970 971 int hvf_arch_remove_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp) 972 { 973 return -ENOSYS; 974 } 975 976 int hvf_arch_insert_hw_breakpoint(vaddr addr, vaddr len, int type) 977 { 978 return -ENOSYS; 979 } 980 981 int hvf_arch_remove_hw_breakpoint(vaddr addr, vaddr len, int type) 982 { 983 return -ENOSYS; 984 } 985 986 void hvf_arch_remove_all_hw_breakpoints(void) 987 { 988 } 989 990 void hvf_arch_update_guest_debug(CPUState *cpu) 991 { 992 } 993 994 bool hvf_arch_supports_guest_debug(void) 995 { 996 return false; 997 } 998