xref: /qemu/target/i386/hvf/hvf.c (revision 8b7b9c5c)
1 /* Copyright 2008 IBM Corporation
2  *           2008 Red Hat, Inc.
3  * Copyright 2011 Intel Corporation
4  * Copyright 2016 Veertu, Inc.
5  * Copyright 2017 The Android Open Source Project
6  *
7  * QEMU Hypervisor.framework support
8  *
9  * This program is free software; you can redistribute it and/or
10  * modify it under the terms of version 2 of the GNU General Public
11  * License as published by the Free Software Foundation.
12  *
13  * This program is distributed in the hope that it will be useful,
14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
16  * General Public License for more details.
17  *
18  * You should have received a copy of the GNU General Public License
19  * along with this program; if not, see <http://www.gnu.org/licenses/>.
20  *
21  * This file contain code under public domain from the hvdos project:
22  * https://github.com/mist64/hvdos
23  *
24  * Parts Copyright (c) 2011 NetApp, Inc.
25  * All rights reserved.
26  *
27  * Redistribution and use in source and binary forms, with or without
28  * modification, are permitted provided that the following conditions
29  * are met:
30  * 1. Redistributions of source code must retain the above copyright
31  *    notice, this list of conditions and the following disclaimer.
32  * 2. Redistributions in binary form must reproduce the above copyright
33  *    notice, this list of conditions and the following disclaimer in the
34  *    documentation and/or other materials provided with the distribution.
35  *
36  * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
37  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
38  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
39  * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
40  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
41  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
42  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
43  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
44  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
45  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
46  * SUCH DAMAGE.
47  */
48 
49 #include "qemu/osdep.h"
50 #include "qemu/error-report.h"
51 #include "qemu/memalign.h"
52 
53 #include "sysemu/hvf.h"
54 #include "sysemu/hvf_int.h"
55 #include "sysemu/runstate.h"
56 #include "sysemu/cpus.h"
57 #include "hvf-i386.h"
58 #include "vmcs.h"
59 #include "vmx.h"
60 #include "x86.h"
61 #include "x86_descr.h"
62 #include "x86_mmu.h"
63 #include "x86_decode.h"
64 #include "x86_emu.h"
65 #include "x86_task.h"
66 #include "x86hvf.h"
67 
68 #include <Hypervisor/hv.h>
69 #include <Hypervisor/hv_vmx.h>
70 #include <sys/sysctl.h>
71 
72 #include "hw/i386/apic_internal.h"
73 #include "qemu/main-loop.h"
74 #include "qemu/accel.h"
75 #include "target/i386/cpu.h"
76 
77 void vmx_update_tpr(CPUState *cpu)
78 {
79     /* TODO: need integrate APIC handling */
80     X86CPU *x86_cpu = X86_CPU(cpu);
81     int tpr = cpu_get_apic_tpr(x86_cpu->apic_state) << 4;
82     int irr = apic_get_highest_priority_irr(x86_cpu->apic_state);
83 
84     wreg(cpu->accel->fd, HV_X86_TPR, tpr);
85     if (irr == -1) {
86         wvmcs(cpu->accel->fd, VMCS_TPR_THRESHOLD, 0);
87     } else {
88         wvmcs(cpu->accel->fd, VMCS_TPR_THRESHOLD, (irr > tpr) ? tpr >> 4 :
89               irr >> 4);
90     }
91 }
92 
93 static void update_apic_tpr(CPUState *cpu)
94 {
95     X86CPU *x86_cpu = X86_CPU(cpu);
96     int tpr = rreg(cpu->accel->fd, HV_X86_TPR) >> 4;
97     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
98 }
99 
100 #define VECTORING_INFO_VECTOR_MASK     0xff
101 
102 void hvf_handle_io(CPUArchState *env, uint16_t port, void *buffer,
103                   int direction, int size, int count)
104 {
105     int i;
106     uint8_t *ptr = buffer;
107 
108     for (i = 0; i < count; i++) {
109         address_space_rw(&address_space_io, port, MEMTXATTRS_UNSPECIFIED,
110                          ptr, size,
111                          direction);
112         ptr += size;
113     }
114 }
115 
116 static bool ept_emulation_fault(hvf_slot *slot, uint64_t gpa, uint64_t ept_qual)
117 {
118     int read, write;
119 
120     /* EPT fault on an instruction fetch doesn't make sense here */
121     if (ept_qual & EPT_VIOLATION_INST_FETCH) {
122         return false;
123     }
124 
125     /* EPT fault must be a read fault or a write fault */
126     read = ept_qual & EPT_VIOLATION_DATA_READ ? 1 : 0;
127     write = ept_qual & EPT_VIOLATION_DATA_WRITE ? 1 : 0;
128     if ((read | write) == 0) {
129         return false;
130     }
131 
132     if (write && slot) {
133         if (slot->flags & HVF_SLOT_LOG) {
134             memory_region_set_dirty(slot->region, gpa - slot->start, 1);
135             hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size,
136                           HV_MEMORY_READ | HV_MEMORY_WRITE);
137         }
138     }
139 
140     /*
141      * The EPT violation must have been caused by accessing a
142      * guest-physical address that is a translation of a guest-linear
143      * address.
144      */
145     if ((ept_qual & EPT_VIOLATION_GLA_VALID) == 0 ||
146         (ept_qual & EPT_VIOLATION_XLAT_VALID) == 0) {
147         return false;
148     }
149 
150     if (!slot) {
151         return true;
152     }
153     if (!memory_region_is_ram(slot->region) &&
154         !(read && memory_region_is_romd(slot->region))) {
155         return true;
156     }
157     return false;
158 }
159 
160 void hvf_arch_vcpu_destroy(CPUState *cpu)
161 {
162     X86CPU *x86_cpu = X86_CPU(cpu);
163     CPUX86State *env = &x86_cpu->env;
164 
165     g_free(env->hvf_mmio_buf);
166 }
167 
168 static void init_tsc_freq(CPUX86State *env)
169 {
170     size_t length;
171     uint64_t tsc_freq;
172 
173     if (env->tsc_khz != 0) {
174         return;
175     }
176 
177     length = sizeof(uint64_t);
178     if (sysctlbyname("machdep.tsc.frequency", &tsc_freq, &length, NULL, 0)) {
179         return;
180     }
181     env->tsc_khz = tsc_freq / 1000;  /* Hz to KHz */
182 }
183 
184 static void init_apic_bus_freq(CPUX86State *env)
185 {
186     size_t length;
187     uint64_t bus_freq;
188 
189     if (env->apic_bus_freq != 0) {
190         return;
191     }
192 
193     length = sizeof(uint64_t);
194     if (sysctlbyname("hw.busfrequency", &bus_freq, &length, NULL, 0)) {
195         return;
196     }
197     env->apic_bus_freq = bus_freq;
198 }
199 
200 static inline bool tsc_is_known(CPUX86State *env)
201 {
202     return env->tsc_khz != 0;
203 }
204 
205 static inline bool apic_bus_freq_is_known(CPUX86State *env)
206 {
207     return env->apic_bus_freq != 0;
208 }
209 
210 void hvf_kick_vcpu_thread(CPUState *cpu)
211 {
212     cpus_kick_thread(cpu);
213 }
214 
215 int hvf_arch_init(void)
216 {
217     return 0;
218 }
219 
220 int hvf_arch_init_vcpu(CPUState *cpu)
221 {
222     X86CPU *x86cpu = X86_CPU(cpu);
223     CPUX86State *env = &x86cpu->env;
224     uint64_t reqCap;
225 
226     init_emu();
227     init_decoder();
228 
229     hvf_state->hvf_caps = g_new0(struct hvf_vcpu_caps, 1);
230     env->hvf_mmio_buf = g_new(char, 4096);
231 
232     if (x86cpu->vmware_cpuid_freq) {
233         init_tsc_freq(env);
234         init_apic_bus_freq(env);
235 
236         if (!tsc_is_known(env) || !apic_bus_freq_is_known(env)) {
237             error_report("vmware-cpuid-freq: feature couldn't be enabled");
238         }
239     }
240 
241     if (hv_vmx_read_capability(HV_VMX_CAP_PINBASED,
242         &hvf_state->hvf_caps->vmx_cap_pinbased)) {
243         abort();
244     }
245     if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED,
246         &hvf_state->hvf_caps->vmx_cap_procbased)) {
247         abort();
248     }
249     if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED2,
250         &hvf_state->hvf_caps->vmx_cap_procbased2)) {
251         abort();
252     }
253     if (hv_vmx_read_capability(HV_VMX_CAP_ENTRY,
254         &hvf_state->hvf_caps->vmx_cap_entry)) {
255         abort();
256     }
257 
258     /* set VMCS control fields */
259     wvmcs(cpu->accel->fd, VMCS_PIN_BASED_CTLS,
260           cap2ctrl(hvf_state->hvf_caps->vmx_cap_pinbased,
261                    VMCS_PIN_BASED_CTLS_EXTINT |
262                    VMCS_PIN_BASED_CTLS_NMI |
263                    VMCS_PIN_BASED_CTLS_VNMI));
264     wvmcs(cpu->accel->fd, VMCS_PRI_PROC_BASED_CTLS,
265           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased,
266                    VMCS_PRI_PROC_BASED_CTLS_HLT |
267                    VMCS_PRI_PROC_BASED_CTLS_MWAIT |
268                    VMCS_PRI_PROC_BASED_CTLS_TSC_OFFSET |
269                    VMCS_PRI_PROC_BASED_CTLS_TPR_SHADOW) |
270           VMCS_PRI_PROC_BASED_CTLS_SEC_CONTROL);
271 
272     reqCap = VMCS_PRI_PROC_BASED2_CTLS_APIC_ACCESSES;
273 
274     /* Is RDTSCP support in CPUID?  If so, enable it in the VMCS. */
275     if (hvf_get_supported_cpuid(0x80000001, 0, R_EDX) & CPUID_EXT2_RDTSCP) {
276         reqCap |= VMCS_PRI_PROC_BASED2_CTLS_RDTSCP;
277     }
278 
279     wvmcs(cpu->accel->fd, VMCS_SEC_PROC_BASED_CTLS,
280           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased2, reqCap));
281 
282     wvmcs(cpu->accel->fd, VMCS_ENTRY_CTLS,
283           cap2ctrl(hvf_state->hvf_caps->vmx_cap_entry, 0));
284     wvmcs(cpu->accel->fd, VMCS_EXCEPTION_BITMAP, 0); /* Double fault */
285 
286     wvmcs(cpu->accel->fd, VMCS_TPR_THRESHOLD, 0);
287 
288     x86cpu = X86_CPU(cpu);
289     x86cpu->env.xsave_buf_len = 4096;
290     x86cpu->env.xsave_buf = qemu_memalign(4096, x86cpu->env.xsave_buf_len);
291 
292     /*
293      * The allocated storage must be large enough for all of the
294      * possible XSAVE state components.
295      */
296     assert(hvf_get_supported_cpuid(0xd, 0, R_ECX) <= x86cpu->env.xsave_buf_len);
297 
298     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_STAR, 1);
299     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_LSTAR, 1);
300     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_CSTAR, 1);
301     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_FMASK, 1);
302     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_FSBASE, 1);
303     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_GSBASE, 1);
304     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_KERNELGSBASE, 1);
305     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_TSC_AUX, 1);
306     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_TSC, 1);
307     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_SYSENTER_CS, 1);
308     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_SYSENTER_EIP, 1);
309     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_SYSENTER_ESP, 1);
310 
311     return 0;
312 }
313 
314 static void hvf_store_events(CPUState *cpu, uint32_t ins_len, uint64_t idtvec_info)
315 {
316     X86CPU *x86_cpu = X86_CPU(cpu);
317     CPUX86State *env = &x86_cpu->env;
318 
319     env->exception_nr = -1;
320     env->exception_pending = 0;
321     env->exception_injected = 0;
322     env->interrupt_injected = -1;
323     env->nmi_injected = false;
324     env->ins_len = 0;
325     env->has_error_code = false;
326     if (idtvec_info & VMCS_IDT_VEC_VALID) {
327         switch (idtvec_info & VMCS_IDT_VEC_TYPE) {
328         case VMCS_IDT_VEC_HWINTR:
329         case VMCS_IDT_VEC_SWINTR:
330             env->interrupt_injected = idtvec_info & VMCS_IDT_VEC_VECNUM;
331             break;
332         case VMCS_IDT_VEC_NMI:
333             env->nmi_injected = true;
334             break;
335         case VMCS_IDT_VEC_HWEXCEPTION:
336         case VMCS_IDT_VEC_SWEXCEPTION:
337             env->exception_nr = idtvec_info & VMCS_IDT_VEC_VECNUM;
338             env->exception_injected = 1;
339             break;
340         case VMCS_IDT_VEC_PRIV_SWEXCEPTION:
341         default:
342             abort();
343         }
344         if ((idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWEXCEPTION ||
345             (idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWINTR) {
346             env->ins_len = ins_len;
347         }
348         if (idtvec_info & VMCS_IDT_VEC_ERRCODE_VALID) {
349             env->has_error_code = true;
350             env->error_code = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_ERROR);
351         }
352     }
353     if ((rvmcs(cpu->accel->fd, VMCS_GUEST_INTERRUPTIBILITY) &
354         VMCS_INTERRUPTIBILITY_NMI_BLOCKING)) {
355         env->hflags2 |= HF2_NMI_MASK;
356     } else {
357         env->hflags2 &= ~HF2_NMI_MASK;
358     }
359     if (rvmcs(cpu->accel->fd, VMCS_GUEST_INTERRUPTIBILITY) &
360          (VMCS_INTERRUPTIBILITY_STI_BLOCKING |
361          VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING)) {
362         env->hflags |= HF_INHIBIT_IRQ_MASK;
363     } else {
364         env->hflags &= ~HF_INHIBIT_IRQ_MASK;
365     }
366 }
367 
368 static void hvf_cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
369                               uint32_t *eax, uint32_t *ebx,
370                               uint32_t *ecx, uint32_t *edx)
371 {
372     /*
373      * A wrapper extends cpu_x86_cpuid with 0x40000000 and 0x40000010 leafs,
374      * leafs 0x40000001-0x4000000F are filled with zeros
375      * Provides vmware-cpuid-freq support to hvf
376      *
377      * Note: leaf 0x40000000 not exposes HVF,
378      * leaving hypervisor signature empty
379      */
380 
381     if (index < 0x40000000 || index > 0x40000010 ||
382         !tsc_is_known(env) || !apic_bus_freq_is_known(env)) {
383 
384         cpu_x86_cpuid(env, index, count, eax, ebx, ecx, edx);
385         return;
386     }
387 
388     switch (index) {
389     case 0x40000000:
390         *eax = 0x40000010;    /* Max available cpuid leaf */
391         *ebx = 0;             /* Leave signature empty */
392         *ecx = 0;
393         *edx = 0;
394         break;
395     case 0x40000010:
396         *eax = env->tsc_khz;
397         *ebx = env->apic_bus_freq / 1000; /* Hz to KHz */
398         *ecx = 0;
399         *edx = 0;
400         break;
401     default:
402         *eax = 0;
403         *ebx = 0;
404         *ecx = 0;
405         *edx = 0;
406         break;
407     }
408 }
409 
410 int hvf_vcpu_exec(CPUState *cpu)
411 {
412     X86CPU *x86_cpu = X86_CPU(cpu);
413     CPUX86State *env = &x86_cpu->env;
414     int ret = 0;
415     uint64_t rip = 0;
416 
417     if (hvf_process_events(cpu)) {
418         return EXCP_HLT;
419     }
420 
421     do {
422         if (cpu->vcpu_dirty) {
423             hvf_put_registers(cpu);
424             cpu->vcpu_dirty = false;
425         }
426 
427         if (hvf_inject_interrupts(cpu)) {
428             return EXCP_INTERRUPT;
429         }
430         vmx_update_tpr(cpu);
431 
432         qemu_mutex_unlock_iothread();
433         if (!cpu_is_bsp(X86_CPU(cpu)) && cpu->halted) {
434             qemu_mutex_lock_iothread();
435             return EXCP_HLT;
436         }
437 
438         hv_return_t r  = hv_vcpu_run(cpu->accel->fd);
439         assert_hvf_ok(r);
440 
441         /* handle VMEXIT */
442         uint64_t exit_reason = rvmcs(cpu->accel->fd, VMCS_EXIT_REASON);
443         uint64_t exit_qual = rvmcs(cpu->accel->fd, VMCS_EXIT_QUALIFICATION);
444         uint32_t ins_len = (uint32_t)rvmcs(cpu->accel->fd,
445                                            VMCS_EXIT_INSTRUCTION_LENGTH);
446 
447         uint64_t idtvec_info = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_INFO);
448 
449         hvf_store_events(cpu, ins_len, idtvec_info);
450         rip = rreg(cpu->accel->fd, HV_X86_RIP);
451         env->eflags = rreg(cpu->accel->fd, HV_X86_RFLAGS);
452 
453         qemu_mutex_lock_iothread();
454 
455         update_apic_tpr(cpu);
456         current_cpu = cpu;
457 
458         ret = 0;
459         switch (exit_reason) {
460         case EXIT_REASON_HLT: {
461             macvm_set_rip(cpu, rip + ins_len);
462             if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) &&
463                 (env->eflags & IF_MASK))
464                 && !(cpu->interrupt_request & CPU_INTERRUPT_NMI) &&
465                 !(idtvec_info & VMCS_IDT_VEC_VALID)) {
466                 cpu->halted = 1;
467                 ret = EXCP_HLT;
468                 break;
469             }
470             ret = EXCP_INTERRUPT;
471             break;
472         }
473         case EXIT_REASON_MWAIT: {
474             ret = EXCP_INTERRUPT;
475             break;
476         }
477         /* Need to check if MMIO or unmapped fault */
478         case EXIT_REASON_EPT_FAULT:
479         {
480             hvf_slot *slot;
481             uint64_t gpa = rvmcs(cpu->accel->fd, VMCS_GUEST_PHYSICAL_ADDRESS);
482 
483             if (((idtvec_info & VMCS_IDT_VEC_VALID) == 0) &&
484                 ((exit_qual & EXIT_QUAL_NMIUDTI) != 0)) {
485                 vmx_set_nmi_blocking(cpu);
486             }
487 
488             slot = hvf_find_overlap_slot(gpa, 1);
489             /* mmio */
490             if (ept_emulation_fault(slot, gpa, exit_qual)) {
491                 struct x86_decode decode;
492 
493                 load_regs(cpu);
494                 decode_instruction(env, &decode);
495                 exec_instruction(env, &decode);
496                 store_regs(cpu);
497                 break;
498             }
499             break;
500         }
501         case EXIT_REASON_INOUT:
502         {
503             uint32_t in = (exit_qual & 8) != 0;
504             uint32_t size =  (exit_qual & 7) + 1;
505             uint32_t string =  (exit_qual & 16) != 0;
506             uint32_t port =  exit_qual >> 16;
507             /*uint32_t rep = (exit_qual & 0x20) != 0;*/
508 
509             if (!string && in) {
510                 uint64_t val = 0;
511                 load_regs(cpu);
512                 hvf_handle_io(env, port, &val, 0, size, 1);
513                 if (size == 1) {
514                     AL(env) = val;
515                 } else if (size == 2) {
516                     AX(env) = val;
517                 } else if (size == 4) {
518                     RAX(env) = (uint32_t)val;
519                 } else {
520                     RAX(env) = (uint64_t)val;
521                 }
522                 env->eip += ins_len;
523                 store_regs(cpu);
524                 break;
525             } else if (!string && !in) {
526                 RAX(env) = rreg(cpu->accel->fd, HV_X86_RAX);
527                 hvf_handle_io(env, port, &RAX(env), 1, size, 1);
528                 macvm_set_rip(cpu, rip + ins_len);
529                 break;
530             }
531             struct x86_decode decode;
532 
533             load_regs(cpu);
534             decode_instruction(env, &decode);
535             assert(ins_len == decode.len);
536             exec_instruction(env, &decode);
537             store_regs(cpu);
538 
539             break;
540         }
541         case EXIT_REASON_CPUID: {
542             uint32_t rax = (uint32_t)rreg(cpu->accel->fd, HV_X86_RAX);
543             uint32_t rbx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RBX);
544             uint32_t rcx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RCX);
545             uint32_t rdx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RDX);
546 
547             if (rax == 1) {
548                 /* CPUID1.ecx.OSXSAVE needs to know CR4 */
549                 env->cr[4] = rvmcs(cpu->accel->fd, VMCS_GUEST_CR4);
550             }
551             hvf_cpu_x86_cpuid(env, rax, rcx, &rax, &rbx, &rcx, &rdx);
552 
553             wreg(cpu->accel->fd, HV_X86_RAX, rax);
554             wreg(cpu->accel->fd, HV_X86_RBX, rbx);
555             wreg(cpu->accel->fd, HV_X86_RCX, rcx);
556             wreg(cpu->accel->fd, HV_X86_RDX, rdx);
557 
558             macvm_set_rip(cpu, rip + ins_len);
559             break;
560         }
561         case EXIT_REASON_XSETBV: {
562             X86CPU *x86_cpu = X86_CPU(cpu);
563             CPUX86State *env = &x86_cpu->env;
564             uint32_t eax = (uint32_t)rreg(cpu->accel->fd, HV_X86_RAX);
565             uint32_t ecx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RCX);
566             uint32_t edx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RDX);
567 
568             if (ecx) {
569                 macvm_set_rip(cpu, rip + ins_len);
570                 break;
571             }
572             env->xcr0 = ((uint64_t)edx << 32) | eax;
573             wreg(cpu->accel->fd, HV_X86_XCR0, env->xcr0 | 1);
574             macvm_set_rip(cpu, rip + ins_len);
575             break;
576         }
577         case EXIT_REASON_INTR_WINDOW:
578             vmx_clear_int_window_exiting(cpu);
579             ret = EXCP_INTERRUPT;
580             break;
581         case EXIT_REASON_NMI_WINDOW:
582             vmx_clear_nmi_window_exiting(cpu);
583             ret = EXCP_INTERRUPT;
584             break;
585         case EXIT_REASON_EXT_INTR:
586             /* force exit and allow io handling */
587             ret = EXCP_INTERRUPT;
588             break;
589         case EXIT_REASON_RDMSR:
590         case EXIT_REASON_WRMSR:
591         {
592             load_regs(cpu);
593             if (exit_reason == EXIT_REASON_RDMSR) {
594                 simulate_rdmsr(cpu);
595             } else {
596                 simulate_wrmsr(cpu);
597             }
598             env->eip += ins_len;
599             store_regs(cpu);
600             break;
601         }
602         case EXIT_REASON_CR_ACCESS: {
603             int cr;
604             int reg;
605 
606             load_regs(cpu);
607             cr = exit_qual & 15;
608             reg = (exit_qual >> 8) & 15;
609 
610             switch (cr) {
611             case 0x0: {
612                 macvm_set_cr0(cpu->accel->fd, RRX(env, reg));
613                 break;
614             }
615             case 4: {
616                 macvm_set_cr4(cpu->accel->fd, RRX(env, reg));
617                 break;
618             }
619             case 8: {
620                 X86CPU *x86_cpu = X86_CPU(cpu);
621                 if (exit_qual & 0x10) {
622                     RRX(env, reg) = cpu_get_apic_tpr(x86_cpu->apic_state);
623                 } else {
624                     int tpr = RRX(env, reg);
625                     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
626                     ret = EXCP_INTERRUPT;
627                 }
628                 break;
629             }
630             default:
631                 error_report("Unrecognized CR %d", cr);
632                 abort();
633             }
634             env->eip += ins_len;
635             store_regs(cpu);
636             break;
637         }
638         case EXIT_REASON_APIC_ACCESS: { /* TODO */
639             struct x86_decode decode;
640 
641             load_regs(cpu);
642             decode_instruction(env, &decode);
643             exec_instruction(env, &decode);
644             store_regs(cpu);
645             break;
646         }
647         case EXIT_REASON_TPR: {
648             ret = 1;
649             break;
650         }
651         case EXIT_REASON_TASK_SWITCH: {
652             uint64_t vinfo = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_INFO);
653             x68_segment_selector sel = {.sel = exit_qual & 0xffff};
654             vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3,
655              vinfo & VMCS_INTR_VALID, vinfo & VECTORING_INFO_VECTOR_MASK, vinfo
656              & VMCS_INTR_T_MASK);
657             break;
658         }
659         case EXIT_REASON_TRIPLE_FAULT: {
660             qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
661             ret = EXCP_INTERRUPT;
662             break;
663         }
664         case EXIT_REASON_RDPMC:
665             wreg(cpu->accel->fd, HV_X86_RAX, 0);
666             wreg(cpu->accel->fd, HV_X86_RDX, 0);
667             macvm_set_rip(cpu, rip + ins_len);
668             break;
669         case VMX_REASON_VMCALL:
670             env->exception_nr = EXCP0D_GPF;
671             env->exception_injected = 1;
672             env->has_error_code = true;
673             env->error_code = 0;
674             break;
675         default:
676             error_report("%llx: unhandled exit %llx", rip, exit_reason);
677         }
678     } while (ret == 0);
679 
680     return ret;
681 }
682 
683 int hvf_arch_insert_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp)
684 {
685     return -ENOSYS;
686 }
687 
688 int hvf_arch_remove_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp)
689 {
690     return -ENOSYS;
691 }
692 
693 int hvf_arch_insert_hw_breakpoint(vaddr addr, vaddr len, int type)
694 {
695     return -ENOSYS;
696 }
697 
698 int hvf_arch_remove_hw_breakpoint(vaddr addr, vaddr len, int type)
699 {
700     return -ENOSYS;
701 }
702 
703 void hvf_arch_remove_all_hw_breakpoints(void)
704 {
705 }
706 
707 void hvf_arch_update_guest_debug(CPUState *cpu)
708 {
709 }
710 
711 inline bool hvf_arch_supports_guest_debug(void)
712 {
713     return false;
714 }
715