1
2
3
4
5
6
7
8
9#include "qemu/osdep.h"
10#include "panic.h"
11#include "qemu-common.h"
12#include "qemu/error-report.h"
13
14#include "sysemu/hvf.h"
15#include "hvf-i386.h"
16#include "vmcs.h"
17#include "vmx.h"
18#include "x86.h"
19#include "x86_descr.h"
20#include "x86_mmu.h"
21#include "x86_decode.h"
22#include "x86_emu.h"
23#include "x86_task.h"
24#include "x86hvf.h"
25
26#include <Hypervisor/hv.h>
27#include <Hypervisor/hv_vmx.h>
28
29#include "exec/address-spaces.h"
30#include "exec/exec-all.h"
31#include "exec/ioport.h"
32#include "hw/i386/apic_internal.h"
33#include "hw/boards.h"
34#include "qemu/main-loop.h"
35#include "sysemu/accel.h"
36#include "sysemu/sysemu.h"
37#include "target/i386/cpu.h"
38
39
40static void save_state_to_tss32(CPUState *cpu, struct x86_tss_segment32 *tss)
41{
42 X86CPU *x86_cpu = X86_CPU(cpu);
43 CPUX86State *env = &x86_cpu->env;
44
45
46 tss->eip = EIP(env);
47 tss->eflags = EFLAGS(env);
48 tss->eax = EAX(env);
49 tss->ecx = ECX(env);
50 tss->edx = EDX(env);
51 tss->ebx = EBX(env);
52 tss->esp = ESP(env);
53 tss->ebp = EBP(env);
54 tss->esi = ESI(env);
55 tss->edi = EDI(env);
56
57 tss->es = vmx_read_segment_selector(cpu, R_ES).sel;
58 tss->cs = vmx_read_segment_selector(cpu, R_CS).sel;
59 tss->ss = vmx_read_segment_selector(cpu, R_SS).sel;
60 tss->ds = vmx_read_segment_selector(cpu, R_DS).sel;
61 tss->fs = vmx_read_segment_selector(cpu, R_FS).sel;
62 tss->gs = vmx_read_segment_selector(cpu, R_GS).sel;
63}
64
65static void load_state_from_tss32(CPUState *cpu, struct x86_tss_segment32 *tss)
66{
67 X86CPU *x86_cpu = X86_CPU(cpu);
68 CPUX86State *env = &x86_cpu->env;
69
70 wvmcs(cpu->hvf_fd, VMCS_GUEST_CR3, tss->cr3);
71
72 RIP(env) = tss->eip;
73 EFLAGS(env) = tss->eflags | 2;
74
75
76 RAX(env) = tss->eax;
77 RCX(env) = tss->ecx;
78 RDX(env) = tss->edx;
79 RBX(env) = tss->ebx;
80 RSP(env) = tss->esp;
81 RBP(env) = tss->ebp;
82 RSI(env) = tss->esi;
83 RDI(env) = tss->edi;
84
85 vmx_write_segment_selector(cpu, (x68_segment_selector){{tss->ldt}}, R_LDTR);
86 vmx_write_segment_selector(cpu, (x68_segment_selector){{tss->es}}, R_ES);
87 vmx_write_segment_selector(cpu, (x68_segment_selector){{tss->cs}}, R_CS);
88 vmx_write_segment_selector(cpu, (x68_segment_selector){{tss->ss}}, R_SS);
89 vmx_write_segment_selector(cpu, (x68_segment_selector){{tss->ds}}, R_DS);
90 vmx_write_segment_selector(cpu, (x68_segment_selector){{tss->fs}}, R_FS);
91 vmx_write_segment_selector(cpu, (x68_segment_selector){{tss->gs}}, R_GS);
92}
93
94static int task_switch_32(CPUState *cpu, x68_segment_selector tss_sel, x68_segment_selector old_tss_sel,
95 uint64_t old_tss_base, struct x86_segment_descriptor *new_desc)
96{
97 struct x86_tss_segment32 tss_seg;
98 uint32_t new_tss_base = x86_segment_base(new_desc);
99 uint32_t eip_offset = offsetof(struct x86_tss_segment32, eip);
100 uint32_t ldt_sel_offset = offsetof(struct x86_tss_segment32, ldt);
101
102 vmx_read_mem(cpu, &tss_seg, old_tss_base, sizeof(tss_seg));
103 save_state_to_tss32(cpu, &tss_seg);
104
105 vmx_write_mem(cpu, old_tss_base + eip_offset, &tss_seg.eip, ldt_sel_offset - eip_offset);
106 vmx_read_mem(cpu, &tss_seg, new_tss_base, sizeof(tss_seg));
107
108 if (old_tss_sel.sel != 0xffff) {
109 tss_seg.prev_tss = old_tss_sel.sel;
110
111 vmx_write_mem(cpu, new_tss_base, &tss_seg.prev_tss, sizeof(tss_seg.prev_tss));
112 }
113 load_state_from_tss32(cpu, &tss_seg);
114 return 0;
115}
116
117void vmx_handle_task_switch(CPUState *cpu, x68_segment_selector tss_sel, int reason, bool gate_valid, uint8_t gate, uint64_t gate_type)
118{
119 uint64_t rip = rreg(cpu->hvf_fd, HV_X86_RIP);
120 if (!gate_valid || (gate_type != VMCS_INTR_T_HWEXCEPTION &&
121 gate_type != VMCS_INTR_T_HWINTR &&
122 gate_type != VMCS_INTR_T_NMI)) {
123 int ins_len = rvmcs(cpu->hvf_fd, VMCS_EXIT_INSTRUCTION_LENGTH);
124 macvm_set_rip(cpu, rip + ins_len);
125 return;
126 }
127
128 load_regs(cpu);
129
130 struct x86_segment_descriptor curr_tss_desc, next_tss_desc;
131 int ret;
132 x68_segment_selector old_tss_sel = vmx_read_segment_selector(cpu, R_TR);
133 uint64_t old_tss_base = vmx_read_segment_base(cpu, R_TR);
134 uint32_t desc_limit;
135 struct x86_call_gate task_gate_desc;
136 struct vmx_segment vmx_seg;
137
138 X86CPU *x86_cpu = X86_CPU(cpu);
139 CPUX86State *env = &x86_cpu->env;
140
141 x86_read_segment_descriptor(cpu, &next_tss_desc, tss_sel);
142 x86_read_segment_descriptor(cpu, &curr_tss_desc, old_tss_sel);
143
144 if (reason == TSR_IDT_GATE && gate_valid) {
145 int dpl;
146
147 ret = x86_read_call_gate(cpu, &task_gate_desc, gate);
148
149 dpl = task_gate_desc.dpl;
150 x68_segment_selector cs = vmx_read_segment_selector(cpu, R_CS);
151 if (tss_sel.rpl > dpl || cs.rpl > dpl)
152 ;
153 }
154
155 desc_limit = x86_segment_limit(&next_tss_desc);
156 if (!next_tss_desc.p || ((desc_limit < 0x67 && (next_tss_desc.type & 8)) || desc_limit < 0x2b)) {
157 VM_PANIC("emulate_ts");
158 }
159
160 if (reason == TSR_IRET || reason == TSR_JMP) {
161 curr_tss_desc.type &= ~(1 << 1);
162 x86_write_segment_descriptor(cpu, &curr_tss_desc, old_tss_sel);
163 }
164
165 if (reason == TSR_IRET)
166 EFLAGS(env) &= ~RFLAGS_NT;
167
168 if (reason != TSR_CALL && reason != TSR_IDT_GATE)
169 old_tss_sel.sel = 0xffff;
170
171 if (reason != TSR_IRET) {
172 next_tss_desc.type |= (1 << 1);
173 x86_write_segment_descriptor(cpu, &next_tss_desc, tss_sel);
174 }
175
176 if (next_tss_desc.type & 8)
177 ret = task_switch_32(cpu, tss_sel, old_tss_sel, old_tss_base, &next_tss_desc);
178 else
179
180 VM_PANIC("task_switch_16");
181
182 macvm_set_cr0(cpu->hvf_fd, rvmcs(cpu->hvf_fd, VMCS_GUEST_CR0) | CR0_TS);
183 x86_segment_descriptor_to_vmx(cpu, tss_sel, &next_tss_desc, &vmx_seg);
184 vmx_write_segment_descriptor(cpu, &vmx_seg, R_TR);
185
186 store_regs(cpu);
187
188 hv_vcpu_invalidate_tlb(cpu->hvf_fd);
189 hv_vcpu_flush(cpu->hvf_fd);
190}
191