1 /* Copyright 2008 IBM Corporation 2 * 2008 Red Hat, Inc. 3 * Copyright 2011 Intel Corporation 4 * Copyright 2016 Veertu, Inc. 5 * Copyright 2017 The Android Open Source Project 6 * 7 * QEMU Hypervisor.framework support 8 * 9 * This program is free software; you can redistribute it and/or 10 * modify it under the terms of version 2 of the GNU General Public 11 * License as published by the Free Software Foundation. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 16 * General Public License for more details. 17 * 18 * You should have received a copy of the GNU General Public License 19 * along with this program; if not, see <http://www.gnu.org/licenses/>. 20 * 21 * This file contain code under public domain from the hvdos project: 22 * https://github.com/mist64/hvdos 23 * 24 * Parts Copyright (c) 2011 NetApp, Inc. 25 * All rights reserved. 26 * 27 * Redistribution and use in source and binary forms, with or without 28 * modification, are permitted provided that the following conditions 29 * are met: 30 * 1. Redistributions of source code must retain the above copyright 31 * notice, this list of conditions and the following disclaimer. 32 * 2. Redistributions in binary form must reproduce the above copyright 33 * notice, this list of conditions and the following disclaimer in the 34 * documentation and/or other materials provided with the distribution. 35 * 36 * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND 37 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 38 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 39 * ARE DISCLAIMED. IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE 40 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 41 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 42 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 43 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 44 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 45 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 46 * SUCH DAMAGE. 47 */ 48 49 #include "qemu/osdep.h" 50 #include "qemu/error-report.h" 51 #include "qemu/memalign.h" 52 #include "qapi/error.h" 53 #include "migration/blocker.h" 54 55 #include "system/hvf.h" 56 #include "system/hvf_int.h" 57 #include "system/runstate.h" 58 #include "system/cpus.h" 59 #include "hvf-i386.h" 60 #include "vmcs.h" 61 #include "vmx.h" 62 #include "emulate/x86.h" 63 #include "x86_descr.h" 64 #include "emulate/x86_flags.h" 65 #include "x86_mmu.h" 66 #include "emulate/x86_decode.h" 67 #include "emulate/x86_emu.h" 68 #include "x86_task.h" 69 #include "x86hvf.h" 70 71 #include <Hypervisor/hv.h> 72 #include <Hypervisor/hv_vmx.h> 73 #include <sys/sysctl.h> 74 75 #include "hw/i386/apic_internal.h" 76 #include "qemu/main-loop.h" 77 #include "qemu/accel.h" 78 #include "target/i386/cpu.h" 79 80 static Error *invtsc_mig_blocker; 81 82 void vmx_update_tpr(CPUState *cpu) 83 { 84 /* TODO: need integrate APIC handling */ 85 X86CPU *x86_cpu = X86_CPU(cpu); 86 int tpr = cpu_get_apic_tpr(x86_cpu->apic_state) << 4; 87 int irr = apic_get_highest_priority_irr(x86_cpu->apic_state); 88 89 wreg(cpu->accel->fd, HV_X86_TPR, tpr); 90 if (irr == -1) { 91 wvmcs(cpu->accel->fd, VMCS_TPR_THRESHOLD, 0); 92 } else { 93 wvmcs(cpu->accel->fd, VMCS_TPR_THRESHOLD, (irr > tpr) ? tpr >> 4 : 94 irr >> 4); 95 } 96 } 97 98 static void update_apic_tpr(CPUState *cpu) 99 { 100 X86CPU *x86_cpu = X86_CPU(cpu); 101 int tpr = rreg(cpu->accel->fd, HV_X86_TPR) >> 4; 102 cpu_set_apic_tpr(x86_cpu->apic_state, tpr); 103 } 104 105 #define VECTORING_INFO_VECTOR_MASK 0xff 106 107 void hvf_handle_io(CPUState *env, uint16_t port, void *buffer, 108 int direction, int size, int count) 109 { 110 int i; 111 uint8_t *ptr = buffer; 112 113 for (i = 0; i < count; i++) { 114 address_space_rw(&address_space_io, port, MEMTXATTRS_UNSPECIFIED, 115 ptr, size, 116 direction); 117 ptr += size; 118 } 119 } 120 121 static bool ept_emulation_fault(hvf_slot *slot, uint64_t gpa, uint64_t ept_qual) 122 { 123 int read, write; 124 125 /* EPT fault on an instruction fetch doesn't make sense here */ 126 if (ept_qual & EPT_VIOLATION_INST_FETCH) { 127 return false; 128 } 129 130 /* EPT fault must be a read fault or a write fault */ 131 read = ept_qual & EPT_VIOLATION_DATA_READ ? 1 : 0; 132 write = ept_qual & EPT_VIOLATION_DATA_WRITE ? 1 : 0; 133 if ((read | write) == 0) { 134 return false; 135 } 136 137 if (write && slot) { 138 if (slot->flags & HVF_SLOT_LOG) { 139 uint64_t dirty_page_start = gpa & ~(TARGET_PAGE_SIZE - 1u); 140 memory_region_set_dirty(slot->region, gpa - slot->start, 1); 141 hv_vm_protect(dirty_page_start, TARGET_PAGE_SIZE, 142 HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC); 143 } 144 } 145 146 /* 147 * The EPT violation must have been caused by accessing a 148 * guest-physical address that is a translation of a guest-linear 149 * address. 150 */ 151 if ((ept_qual & EPT_VIOLATION_GLA_VALID) == 0 || 152 (ept_qual & EPT_VIOLATION_XLAT_VALID) == 0) { 153 return false; 154 } 155 156 if (!slot) { 157 return true; 158 } 159 if (!memory_region_is_ram(slot->region) && 160 !(read && memory_region_is_romd(slot->region))) { 161 return true; 162 } 163 return false; 164 } 165 166 void hvf_arch_vcpu_destroy(CPUState *cpu) 167 { 168 X86CPU *x86_cpu = X86_CPU(cpu); 169 CPUX86State *env = &x86_cpu->env; 170 171 g_free(env->emu_mmio_buf); 172 } 173 174 static void init_tsc_freq(CPUX86State *env) 175 { 176 size_t length; 177 uint64_t tsc_freq; 178 179 if (env->tsc_khz != 0) { 180 return; 181 } 182 183 length = sizeof(uint64_t); 184 if (sysctlbyname("machdep.tsc.frequency", &tsc_freq, &length, NULL, 0)) { 185 return; 186 } 187 env->tsc_khz = tsc_freq / 1000; /* Hz to KHz */ 188 } 189 190 static void init_apic_bus_freq(CPUX86State *env) 191 { 192 size_t length; 193 uint64_t bus_freq; 194 195 if (env->apic_bus_freq != 0) { 196 return; 197 } 198 199 length = sizeof(uint64_t); 200 if (sysctlbyname("hw.busfrequency", &bus_freq, &length, NULL, 0)) { 201 return; 202 } 203 env->apic_bus_freq = bus_freq; 204 } 205 206 static inline bool tsc_is_known(CPUX86State *env) 207 { 208 return env->tsc_khz != 0; 209 } 210 211 static inline bool apic_bus_freq_is_known(CPUX86State *env) 212 { 213 return env->apic_bus_freq != 0; 214 } 215 216 void hvf_kick_vcpu_thread(CPUState *cpu) 217 { 218 cpus_kick_thread(cpu); 219 hv_vcpu_interrupt(&cpu->accel->fd, 1); 220 } 221 222 int hvf_arch_init(void) 223 { 224 return 0; 225 } 226 227 hv_return_t hvf_arch_vm_create(MachineState *ms, uint32_t pa_range) 228 { 229 return hv_vm_create(HV_VM_DEFAULT); 230 } 231 232 static void hvf_read_segment_descriptor(CPUState *s, struct x86_segment_descriptor *desc, 233 X86Seg seg) 234 { 235 struct vmx_segment vmx_segment; 236 vmx_read_segment_descriptor(s, &vmx_segment, seg); 237 vmx_segment_to_x86_descriptor(s, &vmx_segment, desc); 238 } 239 240 static void hvf_read_mem(CPUState *cpu, void *data, target_ulong gva, int bytes) 241 { 242 vmx_read_mem(cpu, data, gva, bytes); 243 } 244 245 static void hvf_write_mem(CPUState *cpu, void *data, target_ulong gva, int bytes) 246 { 247 vmx_write_mem(cpu, gva, data, bytes); 248 } 249 250 static const struct x86_emul_ops hvf_x86_emul_ops = { 251 .read_mem = hvf_read_mem, 252 .write_mem = hvf_write_mem, 253 .read_segment_descriptor = hvf_read_segment_descriptor, 254 .handle_io = hvf_handle_io, 255 .simulate_rdmsr = hvf_simulate_rdmsr, 256 .simulate_wrmsr = hvf_simulate_wrmsr, 257 }; 258 259 int hvf_arch_init_vcpu(CPUState *cpu) 260 { 261 X86CPU *x86cpu = X86_CPU(cpu); 262 CPUX86State *env = &x86cpu->env; 263 Error *local_err = NULL; 264 int r; 265 uint64_t reqCap; 266 267 init_emu(&hvf_x86_emul_ops); 268 init_decoder(); 269 270 if (hvf_state->hvf_caps == NULL) { 271 hvf_state->hvf_caps = g_new0(struct hvf_vcpu_caps, 1); 272 } 273 env->emu_mmio_buf = g_new(char, 4096); 274 275 if (x86cpu->vmware_cpuid_freq) { 276 init_tsc_freq(env); 277 init_apic_bus_freq(env); 278 279 if (!tsc_is_known(env) || !apic_bus_freq_is_known(env)) { 280 error_report("vmware-cpuid-freq: feature couldn't be enabled"); 281 } 282 } 283 284 if ((env->features[FEAT_8000_0007_EDX] & CPUID_APM_INVTSC) && 285 invtsc_mig_blocker == NULL) { 286 error_setg(&invtsc_mig_blocker, 287 "State blocked by non-migratable CPU device (invtsc flag)"); 288 r = migrate_add_blocker(&invtsc_mig_blocker, &local_err); 289 if (r < 0) { 290 error_report_err(local_err); 291 return r; 292 } 293 } 294 295 296 if (hv_vmx_read_capability(HV_VMX_CAP_PINBASED, 297 &hvf_state->hvf_caps->vmx_cap_pinbased)) { 298 abort(); 299 } 300 if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED, 301 &hvf_state->hvf_caps->vmx_cap_procbased)) { 302 abort(); 303 } 304 if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED2, 305 &hvf_state->hvf_caps->vmx_cap_procbased2)) { 306 abort(); 307 } 308 if (hv_vmx_read_capability(HV_VMX_CAP_ENTRY, 309 &hvf_state->hvf_caps->vmx_cap_entry)) { 310 abort(); 311 } 312 313 /* set VMCS control fields */ 314 wvmcs(cpu->accel->fd, VMCS_PIN_BASED_CTLS, 315 cap2ctrl(hvf_state->hvf_caps->vmx_cap_pinbased, 316 VMCS_PIN_BASED_CTLS_EXTINT | 317 VMCS_PIN_BASED_CTLS_NMI | 318 VMCS_PIN_BASED_CTLS_VNMI)); 319 wvmcs(cpu->accel->fd, VMCS_PRI_PROC_BASED_CTLS, 320 cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased, 321 VMCS_PRI_PROC_BASED_CTLS_HLT | 322 VMCS_PRI_PROC_BASED_CTLS_MWAIT | 323 VMCS_PRI_PROC_BASED_CTLS_TSC_OFFSET | 324 VMCS_PRI_PROC_BASED_CTLS_TPR_SHADOW) | 325 VMCS_PRI_PROC_BASED_CTLS_SEC_CONTROL); 326 327 reqCap = VMCS_PRI_PROC_BASED2_CTLS_APIC_ACCESSES; 328 329 /* Is RDTSCP support in CPUID? If so, enable it in the VMCS. */ 330 if (hvf_get_supported_cpuid(0x80000001, 0, R_EDX) & CPUID_EXT2_RDTSCP) { 331 reqCap |= VMCS_PRI_PROC_BASED2_CTLS_RDTSCP; 332 } 333 334 wvmcs(cpu->accel->fd, VMCS_SEC_PROC_BASED_CTLS, 335 cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased2, reqCap)); 336 337 wvmcs(cpu->accel->fd, VMCS_ENTRY_CTLS, 338 cap2ctrl(hvf_state->hvf_caps->vmx_cap_entry, 0)); 339 wvmcs(cpu->accel->fd, VMCS_EXCEPTION_BITMAP, 0); /* Double fault */ 340 341 wvmcs(cpu->accel->fd, VMCS_TPR_THRESHOLD, 0); 342 343 x86cpu = X86_CPU(cpu); 344 x86cpu->env.xsave_buf_len = 4096; 345 x86cpu->env.xsave_buf = qemu_memalign(4096, x86cpu->env.xsave_buf_len); 346 347 /* 348 * The allocated storage must be large enough for all of the 349 * possible XSAVE state components. 350 */ 351 assert(hvf_get_supported_cpuid(0xd, 0, R_ECX) <= x86cpu->env.xsave_buf_len); 352 353 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_STAR, 1); 354 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_LSTAR, 1); 355 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_CSTAR, 1); 356 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_FMASK, 1); 357 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_FSBASE, 1); 358 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_GSBASE, 1); 359 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_KERNELGSBASE, 1); 360 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_TSC_AUX, 1); 361 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_TSC, 1); 362 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_SYSENTER_CS, 1); 363 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_SYSENTER_EIP, 1); 364 hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_SYSENTER_ESP, 1); 365 366 return 0; 367 } 368 369 static void hvf_store_events(CPUState *cpu, uint32_t ins_len, uint64_t idtvec_info) 370 { 371 X86CPU *x86_cpu = X86_CPU(cpu); 372 CPUX86State *env = &x86_cpu->env; 373 374 env->exception_nr = -1; 375 env->exception_pending = 0; 376 env->exception_injected = 0; 377 env->interrupt_injected = -1; 378 env->nmi_injected = false; 379 env->ins_len = 0; 380 env->has_error_code = false; 381 if (idtvec_info & VMCS_IDT_VEC_VALID) { 382 switch (idtvec_info & VMCS_IDT_VEC_TYPE) { 383 case VMCS_IDT_VEC_HWINTR: 384 case VMCS_IDT_VEC_SWINTR: 385 env->interrupt_injected = idtvec_info & VMCS_IDT_VEC_VECNUM; 386 break; 387 case VMCS_IDT_VEC_NMI: 388 env->nmi_injected = true; 389 break; 390 case VMCS_IDT_VEC_HWEXCEPTION: 391 case VMCS_IDT_VEC_SWEXCEPTION: 392 env->exception_nr = idtvec_info & VMCS_IDT_VEC_VECNUM; 393 env->exception_injected = 1; 394 break; 395 case VMCS_IDT_VEC_PRIV_SWEXCEPTION: 396 default: 397 abort(); 398 } 399 if ((idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWEXCEPTION || 400 (idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWINTR) { 401 env->ins_len = ins_len; 402 } 403 if (idtvec_info & VMCS_IDT_VEC_ERRCODE_VALID) { 404 env->has_error_code = true; 405 env->error_code = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_ERROR); 406 } 407 } 408 if ((rvmcs(cpu->accel->fd, VMCS_GUEST_INTERRUPTIBILITY) & 409 VMCS_INTERRUPTIBILITY_NMI_BLOCKING)) { 410 env->hflags2 |= HF2_NMI_MASK; 411 } else { 412 env->hflags2 &= ~HF2_NMI_MASK; 413 } 414 if (rvmcs(cpu->accel->fd, VMCS_GUEST_INTERRUPTIBILITY) & 415 (VMCS_INTERRUPTIBILITY_STI_BLOCKING | 416 VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING)) { 417 env->hflags |= HF_INHIBIT_IRQ_MASK; 418 } else { 419 env->hflags &= ~HF_INHIBIT_IRQ_MASK; 420 } 421 } 422 423 static void hvf_cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count, 424 uint32_t *eax, uint32_t *ebx, 425 uint32_t *ecx, uint32_t *edx) 426 { 427 /* 428 * A wrapper extends cpu_x86_cpuid with 0x40000000 and 0x40000010 leafs, 429 * leafs 0x40000001-0x4000000F are filled with zeros 430 * Provides vmware-cpuid-freq support to hvf 431 * 432 * Note: leaf 0x40000000 not exposes HVF, 433 * leaving hypervisor signature empty 434 */ 435 436 if (index < 0x40000000 || index > 0x40000010 || 437 !tsc_is_known(env) || !apic_bus_freq_is_known(env)) { 438 439 cpu_x86_cpuid(env, index, count, eax, ebx, ecx, edx); 440 return; 441 } 442 443 switch (index) { 444 case 0x40000000: 445 *eax = 0x40000010; /* Max available cpuid leaf */ 446 *ebx = 0; /* Leave signature empty */ 447 *ecx = 0; 448 *edx = 0; 449 break; 450 case 0x40000010: 451 *eax = env->tsc_khz; 452 *ebx = env->apic_bus_freq / 1000; /* Hz to KHz */ 453 *ecx = 0; 454 *edx = 0; 455 break; 456 default: 457 *eax = 0; 458 *ebx = 0; 459 *ecx = 0; 460 *edx = 0; 461 break; 462 } 463 } 464 465 void hvf_load_regs(CPUState *cs) 466 { 467 X86CPU *cpu = X86_CPU(cs); 468 CPUX86State *env = &cpu->env; 469 470 int i = 0; 471 RRX(env, R_EAX) = rreg(cs->accel->fd, HV_X86_RAX); 472 RRX(env, R_EBX) = rreg(cs->accel->fd, HV_X86_RBX); 473 RRX(env, R_ECX) = rreg(cs->accel->fd, HV_X86_RCX); 474 RRX(env, R_EDX) = rreg(cs->accel->fd, HV_X86_RDX); 475 RRX(env, R_ESI) = rreg(cs->accel->fd, HV_X86_RSI); 476 RRX(env, R_EDI) = rreg(cs->accel->fd, HV_X86_RDI); 477 RRX(env, R_ESP) = rreg(cs->accel->fd, HV_X86_RSP); 478 RRX(env, R_EBP) = rreg(cs->accel->fd, HV_X86_RBP); 479 for (i = 8; i < 16; i++) { 480 RRX(env, i) = rreg(cs->accel->fd, HV_X86_RAX + i); 481 } 482 483 env->eflags = rreg(cs->accel->fd, HV_X86_RFLAGS); 484 rflags_to_lflags(env); 485 env->eip = rreg(cs->accel->fd, HV_X86_RIP); 486 } 487 488 void hvf_store_regs(CPUState *cs) 489 { 490 X86CPU *cpu = X86_CPU(cs); 491 CPUX86State *env = &cpu->env; 492 493 int i = 0; 494 wreg(cs->accel->fd, HV_X86_RAX, RAX(env)); 495 wreg(cs->accel->fd, HV_X86_RBX, RBX(env)); 496 wreg(cs->accel->fd, HV_X86_RCX, RCX(env)); 497 wreg(cs->accel->fd, HV_X86_RDX, RDX(env)); 498 wreg(cs->accel->fd, HV_X86_RSI, RSI(env)); 499 wreg(cs->accel->fd, HV_X86_RDI, RDI(env)); 500 wreg(cs->accel->fd, HV_X86_RBP, RBP(env)); 501 wreg(cs->accel->fd, HV_X86_RSP, RSP(env)); 502 for (i = 8; i < 16; i++) { 503 wreg(cs->accel->fd, HV_X86_RAX + i, RRX(env, i)); 504 } 505 506 lflags_to_rflags(env); 507 wreg(cs->accel->fd, HV_X86_RFLAGS, env->eflags); 508 macvm_set_rip(cs, env->eip); 509 } 510 511 void hvf_simulate_rdmsr(CPUState *cs) 512 { 513 X86CPU *cpu = X86_CPU(cs); 514 CPUX86State *env = &cpu->env; 515 uint32_t msr = ECX(env); 516 uint64_t val = 0; 517 518 switch (msr) { 519 case MSR_IA32_TSC: 520 val = rdtscp() + rvmcs(cs->accel->fd, VMCS_TSC_OFFSET); 521 break; 522 case MSR_IA32_APICBASE: 523 val = cpu_get_apic_base(cpu->apic_state); 524 break; 525 case MSR_APIC_START ... MSR_APIC_END: { 526 int ret; 527 int index = (uint32_t)env->regs[R_ECX] - MSR_APIC_START; 528 529 ret = apic_msr_read(index, &val); 530 if (ret < 0) { 531 x86_emul_raise_exception(env, EXCP0D_GPF, 0); 532 } 533 534 break; 535 } 536 case MSR_IA32_UCODE_REV: 537 val = cpu->ucode_rev; 538 break; 539 case MSR_EFER: 540 val = rvmcs(cs->accel->fd, VMCS_GUEST_IA32_EFER); 541 break; 542 case MSR_FSBASE: 543 val = rvmcs(cs->accel->fd, VMCS_GUEST_FS_BASE); 544 break; 545 case MSR_GSBASE: 546 val = rvmcs(cs->accel->fd, VMCS_GUEST_GS_BASE); 547 break; 548 case MSR_KERNELGSBASE: 549 val = rvmcs(cs->accel->fd, VMCS_HOST_FS_BASE); 550 break; 551 case MSR_STAR: 552 abort(); 553 break; 554 case MSR_LSTAR: 555 abort(); 556 break; 557 case MSR_CSTAR: 558 abort(); 559 break; 560 case MSR_IA32_MISC_ENABLE: 561 val = env->msr_ia32_misc_enable; 562 break; 563 case MSR_MTRRphysBase(0): 564 case MSR_MTRRphysBase(1): 565 case MSR_MTRRphysBase(2): 566 case MSR_MTRRphysBase(3): 567 case MSR_MTRRphysBase(4): 568 case MSR_MTRRphysBase(5): 569 case MSR_MTRRphysBase(6): 570 case MSR_MTRRphysBase(7): 571 val = env->mtrr_var[(ECX(env) - MSR_MTRRphysBase(0)) / 2].base; 572 break; 573 case MSR_MTRRphysMask(0): 574 case MSR_MTRRphysMask(1): 575 case MSR_MTRRphysMask(2): 576 case MSR_MTRRphysMask(3): 577 case MSR_MTRRphysMask(4): 578 case MSR_MTRRphysMask(5): 579 case MSR_MTRRphysMask(6): 580 case MSR_MTRRphysMask(7): 581 val = env->mtrr_var[(ECX(env) - MSR_MTRRphysMask(0)) / 2].mask; 582 break; 583 case MSR_MTRRfix64K_00000: 584 val = env->mtrr_fixed[0]; 585 break; 586 case MSR_MTRRfix16K_80000: 587 case MSR_MTRRfix16K_A0000: 588 val = env->mtrr_fixed[ECX(env) - MSR_MTRRfix16K_80000 + 1]; 589 break; 590 case MSR_MTRRfix4K_C0000: 591 case MSR_MTRRfix4K_C8000: 592 case MSR_MTRRfix4K_D0000: 593 case MSR_MTRRfix4K_D8000: 594 case MSR_MTRRfix4K_E0000: 595 case MSR_MTRRfix4K_E8000: 596 case MSR_MTRRfix4K_F0000: 597 case MSR_MTRRfix4K_F8000: 598 val = env->mtrr_fixed[ECX(env) - MSR_MTRRfix4K_C0000 + 3]; 599 break; 600 case MSR_MTRRdefType: 601 val = env->mtrr_deftype; 602 break; 603 case MSR_CORE_THREAD_COUNT: 604 val = cpu_x86_get_msr_core_thread_count(cpu); 605 break; 606 default: 607 /* fprintf(stderr, "%s: unknown msr 0x%x\n", __func__, msr); */ 608 val = 0; 609 break; 610 } 611 612 RAX(env) = (uint32_t)val; 613 RDX(env) = (uint32_t)(val >> 32); 614 } 615 616 void hvf_simulate_wrmsr(CPUState *cs) 617 { 618 X86CPU *cpu = X86_CPU(cs); 619 CPUX86State *env = &cpu->env; 620 uint32_t msr = ECX(env); 621 uint64_t data = ((uint64_t)EDX(env) << 32) | EAX(env); 622 623 switch (msr) { 624 case MSR_IA32_TSC: 625 break; 626 case MSR_IA32_APICBASE: { 627 int r; 628 629 r = cpu_set_apic_base(cpu->apic_state, data); 630 if (r < 0) { 631 x86_emul_raise_exception(env, EXCP0D_GPF, 0); 632 } 633 634 break; 635 } 636 case MSR_APIC_START ... MSR_APIC_END: { 637 int ret; 638 int index = (uint32_t)env->regs[R_ECX] - MSR_APIC_START; 639 640 ret = apic_msr_write(index, data); 641 if (ret < 0) { 642 x86_emul_raise_exception(env, EXCP0D_GPF, 0); 643 } 644 645 break; 646 } 647 case MSR_FSBASE: 648 wvmcs(cs->accel->fd, VMCS_GUEST_FS_BASE, data); 649 break; 650 case MSR_GSBASE: 651 wvmcs(cs->accel->fd, VMCS_GUEST_GS_BASE, data); 652 break; 653 case MSR_KERNELGSBASE: 654 wvmcs(cs->accel->fd, VMCS_HOST_FS_BASE, data); 655 break; 656 case MSR_STAR: 657 abort(); 658 break; 659 case MSR_LSTAR: 660 abort(); 661 break; 662 case MSR_CSTAR: 663 abort(); 664 break; 665 case MSR_EFER: 666 /*printf("new efer %llx\n", EFER(cs));*/ 667 wvmcs(cs->accel->fd, VMCS_GUEST_IA32_EFER, data); 668 if (data & MSR_EFER_NXE) { 669 hv_vcpu_invalidate_tlb(cs->accel->fd); 670 } 671 break; 672 case MSR_MTRRphysBase(0): 673 case MSR_MTRRphysBase(1): 674 case MSR_MTRRphysBase(2): 675 case MSR_MTRRphysBase(3): 676 case MSR_MTRRphysBase(4): 677 case MSR_MTRRphysBase(5): 678 case MSR_MTRRphysBase(6): 679 case MSR_MTRRphysBase(7): 680 env->mtrr_var[(ECX(env) - MSR_MTRRphysBase(0)) / 2].base = data; 681 break; 682 case MSR_MTRRphysMask(0): 683 case MSR_MTRRphysMask(1): 684 case MSR_MTRRphysMask(2): 685 case MSR_MTRRphysMask(3): 686 case MSR_MTRRphysMask(4): 687 case MSR_MTRRphysMask(5): 688 case MSR_MTRRphysMask(6): 689 case MSR_MTRRphysMask(7): 690 env->mtrr_var[(ECX(env) - MSR_MTRRphysMask(0)) / 2].mask = data; 691 break; 692 case MSR_MTRRfix64K_00000: 693 env->mtrr_fixed[ECX(env) - MSR_MTRRfix64K_00000] = data; 694 break; 695 case MSR_MTRRfix16K_80000: 696 case MSR_MTRRfix16K_A0000: 697 env->mtrr_fixed[ECX(env) - MSR_MTRRfix16K_80000 + 1] = data; 698 break; 699 case MSR_MTRRfix4K_C0000: 700 case MSR_MTRRfix4K_C8000: 701 case MSR_MTRRfix4K_D0000: 702 case MSR_MTRRfix4K_D8000: 703 case MSR_MTRRfix4K_E0000: 704 case MSR_MTRRfix4K_E8000: 705 case MSR_MTRRfix4K_F0000: 706 case MSR_MTRRfix4K_F8000: 707 env->mtrr_fixed[ECX(env) - MSR_MTRRfix4K_C0000 + 3] = data; 708 break; 709 case MSR_MTRRdefType: 710 env->mtrr_deftype = data; 711 break; 712 default: 713 break; 714 } 715 716 /* Related to support known hypervisor interface */ 717 /* if (g_hypervisor_iface) 718 g_hypervisor_iface->wrmsr_handler(cs, msr, data); 719 720 printf("write msr %llx\n", RCX(cs));*/ 721 } 722 723 int hvf_vcpu_exec(CPUState *cpu) 724 { 725 X86CPU *x86_cpu = X86_CPU(cpu); 726 CPUX86State *env = &x86_cpu->env; 727 int ret = 0; 728 uint64_t rip = 0; 729 730 if (hvf_process_events(cpu)) { 731 return EXCP_HLT; 732 } 733 734 do { 735 if (cpu->accel->dirty) { 736 hvf_put_registers(cpu); 737 cpu->accel->dirty = false; 738 } 739 740 if (hvf_inject_interrupts(cpu)) { 741 return EXCP_INTERRUPT; 742 } 743 vmx_update_tpr(cpu); 744 745 bql_unlock(); 746 if (!cpu_is_bsp(X86_CPU(cpu)) && cpu->halted) { 747 bql_lock(); 748 return EXCP_HLT; 749 } 750 751 hv_return_t r = hv_vcpu_run_until(cpu->accel->fd, HV_DEADLINE_FOREVER); 752 assert_hvf_ok(r); 753 754 /* handle VMEXIT */ 755 uint64_t exit_reason = rvmcs(cpu->accel->fd, VMCS_EXIT_REASON); 756 uint64_t exit_qual = rvmcs(cpu->accel->fd, VMCS_EXIT_QUALIFICATION); 757 uint32_t ins_len = (uint32_t)rvmcs(cpu->accel->fd, 758 VMCS_EXIT_INSTRUCTION_LENGTH); 759 760 uint64_t idtvec_info = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_INFO); 761 762 hvf_store_events(cpu, ins_len, idtvec_info); 763 rip = rreg(cpu->accel->fd, HV_X86_RIP); 764 env->eflags = rreg(cpu->accel->fd, HV_X86_RFLAGS); 765 766 bql_lock(); 767 768 update_apic_tpr(cpu); 769 current_cpu = cpu; 770 771 ret = 0; 772 switch (exit_reason) { 773 case EXIT_REASON_HLT: { 774 macvm_set_rip(cpu, rip + ins_len); 775 if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) && 776 (env->eflags & IF_MASK)) 777 && !(cpu->interrupt_request & CPU_INTERRUPT_NMI) && 778 !(idtvec_info & VMCS_IDT_VEC_VALID)) { 779 cpu->halted = 1; 780 ret = EXCP_HLT; 781 break; 782 } 783 ret = EXCP_INTERRUPT; 784 break; 785 } 786 case EXIT_REASON_MWAIT: { 787 ret = EXCP_INTERRUPT; 788 break; 789 } 790 /* Need to check if MMIO or unmapped fault */ 791 case EXIT_REASON_EPT_FAULT: 792 { 793 hvf_slot *slot; 794 uint64_t gpa = rvmcs(cpu->accel->fd, VMCS_GUEST_PHYSICAL_ADDRESS); 795 796 if (((idtvec_info & VMCS_IDT_VEC_VALID) == 0) && 797 ((exit_qual & EXIT_QUAL_NMIUDTI) != 0)) { 798 vmx_set_nmi_blocking(cpu); 799 } 800 801 slot = hvf_find_overlap_slot(gpa, 1); 802 /* mmio */ 803 if (ept_emulation_fault(slot, gpa, exit_qual)) { 804 struct x86_decode decode; 805 806 hvf_load_regs(cpu); 807 decode_instruction(env, &decode); 808 exec_instruction(env, &decode); 809 hvf_store_regs(cpu); 810 break; 811 } 812 break; 813 } 814 case EXIT_REASON_INOUT: 815 { 816 uint32_t in = (exit_qual & 8) != 0; 817 uint32_t size = (exit_qual & 7) + 1; 818 uint32_t string = (exit_qual & 16) != 0; 819 uint32_t port = exit_qual >> 16; 820 /*uint32_t rep = (exit_qual & 0x20) != 0;*/ 821 822 if (!string && in) { 823 uint64_t val = 0; 824 hvf_load_regs(cpu); 825 hvf_handle_io(env_cpu(env), port, &val, 0, size, 1); 826 if (size == 1) { 827 AL(env) = val; 828 } else if (size == 2) { 829 AX(env) = val; 830 } else if (size == 4) { 831 RAX(env) = (uint32_t)val; 832 } else { 833 RAX(env) = (uint64_t)val; 834 } 835 env->eip += ins_len; 836 hvf_store_regs(cpu); 837 break; 838 } else if (!string && !in) { 839 RAX(env) = rreg(cpu->accel->fd, HV_X86_RAX); 840 hvf_handle_io(env_cpu(env), port, &RAX(env), 1, size, 1); 841 macvm_set_rip(cpu, rip + ins_len); 842 break; 843 } 844 struct x86_decode decode; 845 846 hvf_load_regs(cpu); 847 decode_instruction(env, &decode); 848 assert(ins_len == decode.len); 849 exec_instruction(env, &decode); 850 hvf_store_regs(cpu); 851 852 break; 853 } 854 case EXIT_REASON_CPUID: { 855 uint32_t rax = (uint32_t)rreg(cpu->accel->fd, HV_X86_RAX); 856 uint32_t rbx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RBX); 857 uint32_t rcx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RCX); 858 uint32_t rdx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RDX); 859 860 if (rax == 1) { 861 /* CPUID1.ecx.OSXSAVE needs to know CR4 */ 862 env->cr[4] = rvmcs(cpu->accel->fd, VMCS_GUEST_CR4); 863 } 864 hvf_cpu_x86_cpuid(env, rax, rcx, &rax, &rbx, &rcx, &rdx); 865 866 wreg(cpu->accel->fd, HV_X86_RAX, rax); 867 wreg(cpu->accel->fd, HV_X86_RBX, rbx); 868 wreg(cpu->accel->fd, HV_X86_RCX, rcx); 869 wreg(cpu->accel->fd, HV_X86_RDX, rdx); 870 871 macvm_set_rip(cpu, rip + ins_len); 872 break; 873 } 874 case EXIT_REASON_XSETBV: { 875 uint32_t eax = (uint32_t)rreg(cpu->accel->fd, HV_X86_RAX); 876 uint32_t ecx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RCX); 877 uint32_t edx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RDX); 878 879 if (ecx) { 880 macvm_set_rip(cpu, rip + ins_len); 881 break; 882 } 883 env->xcr0 = ((uint64_t)edx << 32) | eax; 884 wreg(cpu->accel->fd, HV_X86_XCR0, env->xcr0 | 1); 885 macvm_set_rip(cpu, rip + ins_len); 886 break; 887 } 888 case EXIT_REASON_INTR_WINDOW: 889 vmx_clear_int_window_exiting(cpu); 890 ret = EXCP_INTERRUPT; 891 break; 892 case EXIT_REASON_NMI_WINDOW: 893 vmx_clear_nmi_window_exiting(cpu); 894 ret = EXCP_INTERRUPT; 895 break; 896 case EXIT_REASON_EXT_INTR: 897 /* force exit and allow io handling */ 898 ret = EXCP_INTERRUPT; 899 break; 900 case EXIT_REASON_RDMSR: 901 case EXIT_REASON_WRMSR: 902 { 903 hvf_load_regs(cpu); 904 if (exit_reason == EXIT_REASON_RDMSR) { 905 hvf_simulate_rdmsr(cpu); 906 } else { 907 hvf_simulate_wrmsr(cpu); 908 } 909 env->eip += ins_len; 910 hvf_store_regs(cpu); 911 break; 912 } 913 case EXIT_REASON_CR_ACCESS: { 914 int cr; 915 int reg; 916 917 hvf_load_regs(cpu); 918 cr = exit_qual & 15; 919 reg = (exit_qual >> 8) & 15; 920 921 switch (cr) { 922 case 0x0: { 923 macvm_set_cr0(cpu->accel->fd, RRX(env, reg)); 924 break; 925 } 926 case 4: { 927 macvm_set_cr4(cpu->accel->fd, RRX(env, reg)); 928 break; 929 } 930 case 8: { 931 if (exit_qual & 0x10) { 932 RRX(env, reg) = cpu_get_apic_tpr(x86_cpu->apic_state); 933 } else { 934 int tpr = RRX(env, reg); 935 cpu_set_apic_tpr(x86_cpu->apic_state, tpr); 936 ret = EXCP_INTERRUPT; 937 } 938 break; 939 } 940 default: 941 error_report("Unrecognized CR %d", cr); 942 abort(); 943 } 944 env->eip += ins_len; 945 hvf_store_regs(cpu); 946 break; 947 } 948 case EXIT_REASON_APIC_ACCESS: { /* TODO */ 949 struct x86_decode decode; 950 951 hvf_load_regs(cpu); 952 decode_instruction(env, &decode); 953 exec_instruction(env, &decode); 954 hvf_store_regs(cpu); 955 break; 956 } 957 case EXIT_REASON_TPR: { 958 ret = 1; 959 break; 960 } 961 case EXIT_REASON_TASK_SWITCH: { 962 uint64_t vinfo = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_INFO); 963 x86_segment_selector sel = {.sel = exit_qual & 0xffff}; 964 vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3, 965 vinfo & VMCS_INTR_VALID, vinfo & VECTORING_INFO_VECTOR_MASK, vinfo 966 & VMCS_INTR_T_MASK); 967 break; 968 } 969 case EXIT_REASON_TRIPLE_FAULT: { 970 qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET); 971 ret = EXCP_INTERRUPT; 972 break; 973 } 974 case EXIT_REASON_RDPMC: 975 wreg(cpu->accel->fd, HV_X86_RAX, 0); 976 wreg(cpu->accel->fd, HV_X86_RDX, 0); 977 macvm_set_rip(cpu, rip + ins_len); 978 break; 979 case VMX_REASON_VMCALL: 980 env->exception_nr = EXCP0D_GPF; 981 env->exception_injected = 1; 982 env->has_error_code = true; 983 env->error_code = 0; 984 break; 985 default: 986 error_report("%llx: unhandled exit %llx", rip, exit_reason); 987 } 988 } while (ret == 0); 989 990 return ret; 991 } 992 993 int hvf_arch_insert_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp) 994 { 995 return -ENOSYS; 996 } 997 998 int hvf_arch_remove_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp) 999 { 1000 return -ENOSYS; 1001 } 1002 1003 int hvf_arch_insert_hw_breakpoint(vaddr addr, vaddr len, int type) 1004 { 1005 return -ENOSYS; 1006 } 1007 1008 int hvf_arch_remove_hw_breakpoint(vaddr addr, vaddr len, int type) 1009 { 1010 return -ENOSYS; 1011 } 1012 1013 void hvf_arch_remove_all_hw_breakpoints(void) 1014 { 1015 } 1016 1017 void hvf_arch_update_guest_debug(CPUState *cpu) 1018 { 1019 } 1020 1021 bool hvf_arch_supports_guest_debug(void) 1022 { 1023 return false; 1024 } 1025