add support for Hypervisor.framework in QEMU

This file begins tracking the files that will be the code base for HVF support in QEMU.

Signed-off-by Sergio Andres Gomez Del Real <[email protected]>

---
 cpus.c                              |   42 +
 include/sysemu/hvf.h                |   96 ++
 target/i386/hvf-all.c               |  982 +++++++++++++++++++++
 target/i386/hvf-i386.h              |   48 +
 target/i386/hvf-utils/Makefile.objs |    1 +
 target/i386/hvf-utils/README.md     |    7 +
 target/i386/hvf-utils/vmcs.h        |  368 ++++++++
 target/i386/hvf-utils/vmx.h         |  200 +++++
 target/i386/hvf-utils/x86.c         |  174 ++++
 target/i386/hvf-utils/x86.h         |  470 ++++++++++
 target/i386/hvf-utils/x86_cpuid.c   |  270 ++++++
 target/i386/hvf-utils/x86_cpuid.h   |   51 ++
 target/i386/hvf-utils/x86_decode.c  | 1659 +++++++++++++++++++++++++++++++++++
 target/i386/hvf-utils/x86_decode.h  |  314 +++++++
 target/i386/hvf-utils/x86_descr.c   |  124 +++
 target/i386/hvf-utils/x86_descr.h   |   40 +
 target/i386/hvf-utils/x86_emu.c     | 1466 +++++++++++++++++++++++++++++++
 target/i386/hvf-utils/x86_emu.h     |   16 +
 target/i386/hvf-utils/x86_flags.c   |  317 +++++++
 target/i386/hvf-utils/x86_flags.h   |  218 +++++
 target/i386/hvf-utils/x86_gen.h     |   36 +
 target/i386/hvf-utils/x86_mmu.c     |  254 ++++++
 target/i386/hvf-utils/x86_mmu.h     |   28 +
 target/i386/hvf-utils/x86hvf.c      |  501 +++++++++++
 target/i386/hvf-utils/x86hvf.h      |   19 +
 25 files changed, 7701 insertions(+)
 create mode 100644 include/sysemu/hvf.h
 create mode 100644 target/i386/hvf-all.c
 create mode 100644 target/i386/hvf-i386.h
 create mode 100644 target/i386/hvf-utils/Makefile.objs
 create mode 100644 target/i386/hvf-utils/README.md
 create mode 100644 target/i386/hvf-utils/vmcs.h
 create mode 100644 target/i386/hvf-utils/vmx.h
 create mode 100644 target/i386/hvf-utils/x86.c
 create mode 100644 target/i386/hvf-utils/x86.h
 create mode 100644 target/i386/hvf-utils/x86_cpuid.c
 create mode 100644 target/i386/hvf-utils/x86_cpuid.h
 create mode 100644 target/i386/hvf-utils/x86_decode.c
 create mode 100644 target/i386/hvf-utils/x86_decode.h
 create mode 100644 target/i386/hvf-utils/x86_descr.c
 create mode 100644 target/i386/hvf-utils/x86_descr.h
 create mode 100644 target/i386/hvf-utils/x86_emu.c
 create mode 100644 target/i386/hvf-utils/x86_emu.h
 create mode 100644 target/i386/hvf-utils/x86_flags.c
 create mode 100644 target/i386/hvf-utils/x86_flags.h
 create mode 100644 target/i386/hvf-utils/x86_gen.h
 create mode 100644 target/i386/hvf-utils/x86_mmu.c
 create mode 100644 target/i386/hvf-utils/x86_mmu.h
 create mode 100644 target/i386/hvf-utils/x86hvf.c
 create mode 100644 target/i386/hvf-utils/x86hvf.h

cpus.c +42 -0

index 9bed61eefc..a2cd9dfa5d 100644
@@ -1434,6 +1434,48 @@ static void *qemu_hax_cpu_thread_fn(void *arg)
     return NULL;
 }
 
+/* The HVF-specific vCPU thread function. This one should only run when the host
+ * CPU supports the VMX "unrestricted guest" feature. */
+static void *qemu_hvf_cpu_thread_fn(void *arg)
+{
+    CPUState *cpu = arg;
+
+    int r;
+
+    assert(hvf_enabled());
+
+    rcu_register_thread();
+
+    qemu_mutex_lock_iothread();
+    qemu_thread_get_self(cpu->thread);
+
+    cpu->thread_id = qemu_get_thread_id();
+    cpu->can_do_io = 1;
+    current_cpu = cpu;
+
+    hvf_init_vcpu(cpu);
+
+    /* signal CPU creation */
+    cpu->created = true;
+    qemu_cond_signal(&qemu_cpu_cond);
+
+    do {
+        if (cpu_can_run(cpu)) {
+            r = hvf_vcpu_exec(cpu);
+            if (r == EXCP_DEBUG) {
+                cpu_handle_guest_debug(cpu);
+            }
+        }
+        qemu_hvf_wait_io_event(cpu);
+    } while (!cpu->unplug || cpu_can_run(cpu));
+
+    hvf_vcpu_destroy(cpu);
+    cpu->created = false;
+    qemu_cond_signal(&qemu_cpu_cond);
+    qemu_mutex_unlock_iothread();
+    return NULL;
+}
+
 #ifdef _WIN32
 static void CALLBACK dummy_apc_func(ULONG_PTR unused)
 {

include/sysemu/hvf.h new file +96 -0

new file mode 100644
index 0000000000..b96bd5e8ba
@@ -0,0 +1,96 @@
+/*
+ * QEMU Hypervisor.framework (HVF) support
+ *
+ * Copyright Google Inc., 2017
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+/* header to be included in non-HVF-specific code */
+#ifndef _HVF_H
+#define _HVF_H
+
+#include "config-host.h"
+#include "qemu/osdep.h"
+#include "qemu-common.h"
+#include "hw/hw.h"
+#include "target/i386/cpu.h"
+#include "qemu/bitops.h"
+#include "exec/memory.h"
+#include "sysemu/accel.h"
+#include <Hypervisor/hv.h>
+#include <Hypervisor/hv_vmx.h>
+#include <Hypervisor/hv_error.h>
+
+
+typedef struct hvf_slot {
+    uint64_t start;
+    uint64_t size;
+    uint8_t *mem;
+    int slot_id;
+} hvf_slot;
+
+typedef struct HVFState {
+    AccelState parent;
+    hvf_slot slots[32];
+    int num_slots;
+} HVFState;
+
+struct hvf_vcpu_caps {
+    uint64_t vmx_cap_pinbased;
+    uint64_t vmx_cap_procbased;
+    uint64_t vmx_cap_procbased2;
+    uint64_t vmx_cap_entry;
+    uint64_t vmx_cap_exit;
+    uint64_t vmx_cap_preemption_timer;
+};
+
+int __hvf_set_memory(hvf_slot *);
+void hvf_set_phys_mem(MemoryRegionSection *, bool);
+void hvf_handle_io(CPUArchState *, uint16_t, void *,
+                  int, int, int);
+hvf_slot *hvf_find_overlap_slot(uint64_t, uint64_t);
+
+/* Returns 1 if HVF is available and enabled, 0 otherwise. */
+int hvf_enabled(void);
+
+/* Disable HVF if |disable| is 1, otherwise, enable it iff it is supported by the host CPU.
+ * Use hvf_enabled() after this to get the result. */
+void hvf_disable(int disable);
+
+/* Returns non-0 if the host CPU supports the VMX "unrestricted guest" feature which
+ * allows the virtual CPU to directly run in "real mode". If true, this allows QEMU to run
+ * several vCPU threads in parallel (see cpus.c). Otherwise, only a a single TCG thread
+ * can run, and it will call HVF to run the current instructions, except in case of
+ * "real mode" (paging disabled, typically at boot time), or MMIO operations. */
+// int hvf_ug_platform(void); does not apply to HVF; assume we must be in UG mode
+
+int hvf_sync_vcpus(void);
+
+int hvf_init_vcpu(CPUState *);
+int hvf_vcpu_exec(CPUState *);
+int hvf_smp_cpu_exec(CPUState *);
+void hvf_cpu_synchronize_state(CPUState *);
+void hvf_cpu_synchronize_post_reset(CPUState *);
+void hvf_cpu_synchronize_post_init(CPUState *);
+void _hvf_cpu_synchronize_post_init(CPUState *, run_on_cpu_data);
+
+void hvf_vcpu_destroy(CPUState *);
+void hvf_raise_event(CPUState *);
+// void hvf_reset_vcpu_state(void *opaque);
+void vmx_reset_vcpu(CPUState *);
+void __hvf_cpu_synchronize_state(CPUState *, run_on_cpu_data);
+void __hvf_cpu_synchronize_post_reset(CPUState *, run_on_cpu_data);
+void vmx_update_tpr(CPUState *);
+void update_apic_tpr(CPUState *);
+int apic_get_highest_priority_irr(DeviceState *);
+int hvf_put_registers(CPUState *);
+
+#define TYPE_HVF_ACCEL ACCEL_CLASS_NAME("hvf")
+
+#define HVF_STATE(obj) \
+    OBJECT_CHECK(HVFState, (obj), TYPE_HVF_ACCEL)
+
+#endif

target/i386/hvf-all.c new file +982 -0

new file mode 100644
index 0000000000..06cd8429eb
@@ -0,0 +1,982 @@
+#include "qemu/osdep.h"
+#include "qemu-common.h"
+
+#include "sysemu/hvf.h"
+#include "hvf-i386.h"
+#include "hvf-utils/vmcs.h"
+#include "hvf-utils/vmx.h"
+#include "hvf-utils/x86.h"
+#include "hvf-utils/x86_descr.h"
+#include "hvf-utils/x86_mmu.h"
+#include "hvf-utils/x86_decode.h"
+#include "hvf-utils/x86_emu.h"
+#include "hvf-utils/x86_cpuid.h"
+#include "hvf-utils/x86hvf.h"
+
+#include <Hypervisor/hv.h>
+#include <Hypervisor/hv_vmx.h>
+
+#include "exec/address-spaces.h"
+#include "exec/exec-all.h"
+#include "exec/ioport.h"
+#include "hw/i386/apic_internal.h"
+#include "hw/boards.h"
+#include "qemu/main-loop.h"
+#include "strings.h"
+#include "trace.h"
+#include "sysemu/accel.h"
+#include "sysemu/sysemu.h"
+#include "target/i386/cpu.h"
+
+pthread_rwlock_t mem_lock = PTHREAD_RWLOCK_INITIALIZER;
+HVFState *hvf_state;
+static int hvf_disabled = 1;
+
+static void assert_hvf_ok(hv_return_t ret)
+{
+    if (ret == HV_SUCCESS)
+        return;
+
+    switch (ret) {
+        case HV_ERROR:
+            fprintf(stderr, "Error: HV_ERROR\n");
+            break;
+        case HV_BUSY:
+            fprintf(stderr, "Error: HV_BUSY\n");
+            break;
+        case HV_BAD_ARGUMENT:
+            fprintf(stderr, "Error: HV_BAD_ARGUMENT\n");
+            break;
+        case HV_NO_RESOURCES:
+            fprintf(stderr, "Error: HV_NO_RESOURCES\n");
+            break;
+        case HV_NO_DEVICE:
+            fprintf(stderr, "Error: HV_NO_DEVICE\n");
+            break;
+        case HV_UNSUPPORTED:
+            fprintf(stderr, "Error: HV_UNSUPPORTED\n");
+            break;
+        default:
+            fprintf(stderr, "Unknown Error\n");
+    }
+
+    abort();
+}
+
+// Memory slots/////////////////////////////////////////////////////////////////
+
+hvf_slot *hvf_find_overlap_slot(uint64_t start, uint64_t end) {
+    hvf_slot *slot;
+    int x;
+    for (x = 0; x < hvf_state->num_slots; ++x) {
+        slot = &hvf_state->slots[x];
+        if (slot->size && start < (slot->start + slot->size) && end > slot->start)
+            return slot;
+    }
+    return NULL;
+}
+
+struct mac_slot {
+    int present;
+    uint64_t size;
+    uint64_t gpa_start;
+    uint64_t gva;
+};
+
+struct mac_slot mac_slots[32];
+#define ALIGN(x, y)  (((x)+(y)-1) & ~((y)-1))
+
+int __hvf_set_memory(hvf_slot *slot)
+{
+    struct mac_slot *macslot;
+    hv_memory_flags_t flags;
+    pthread_rwlock_wrlock(&mem_lock);
+    hv_return_t ret;
+
+    macslot = &mac_slots[slot->slot_id];
+
+    if (macslot->present) {
+        if (macslot->size != slot->size) {
+            macslot->present = 0;
+            ret = hv_vm_unmap(macslot->gpa_start, macslot->size);
+            assert_hvf_ok(ret);
+        }
+    }
+
+    if (!slot->size) {
+        pthread_rwlock_unlock(&mem_lock);
+        return 0;
+    }
+
+    flags = HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC;
+
+    macslot->present = 1;
+    macslot->gpa_start = slot->start;
+    macslot->size = slot->size;
+    ret = hv_vm_map((hv_uvaddr_t)slot->mem, slot->start, slot->size, flags);
+    assert_hvf_ok(ret);
+    pthread_rwlock_unlock(&mem_lock);
+    return 0;
+}
+
+void hvf_set_phys_mem(MemoryRegionSection* section, bool add)
+{
+    hvf_slot *mem;
+    MemoryRegion *area = section->mr;
+
+    if (!memory_region_is_ram(area)) return;
+
+    mem = hvf_find_overlap_slot(
+            section->offset_within_address_space,
+            section->offset_within_address_space + int128_get64(section->size));
+
+    if (mem && add) {
+        if (mem->size == int128_get64(section->size) &&
+                mem->start == section->offset_within_address_space &&
+                mem->mem == (memory_region_get_ram_ptr(area) + section->offset_within_region))
+            return; // Same region was attempted to register, go away.
+    }
+
+    // Region needs to be reset. set the size to 0 and remap it.
+    if (mem) {
+        mem->size = 0;
+        if (__hvf_set_memory(mem)) {
+            fprintf(stderr, "Failed to reset overlapping slot\n");
+            abort();
+        }
+    }
+
+    if (!add) return;
+
+    // Now make a new slot.
+    int x;
+
+    for (x = 0; x < hvf_state->num_slots; ++x) {
+        mem = &hvf_state->slots[x];
+        if (!mem->size)
+            break;
+    }
+
+    if (x == hvf_state->num_slots) {
+        fprintf(stderr, "No free slots\n");
+        abort();
+    }
+
+    mem->size = int128_get64(section->size);
+    mem->mem = memory_region_get_ram_ptr(area) + section->offset_within_region;
+    mem->start = section->offset_within_address_space;
+
+    if (__hvf_set_memory(mem)) {
+        fprintf(stderr, "Error registering new memory slot\n");
+        abort();
+    }
+}
+
+/* return -1 if no bit is set */
+static int get_highest_priority_int(uint32_t *tab)
+{
+    int i;
+    for (i = 7; i >= 0; i--) {
+        if (tab[i] != 0) {
+            return i * 32 + apic_fls_bit(tab[i]);
+        }
+    }
+    return -1;
+}
+
+void vmx_update_tpr(CPUState *cpu)
+{
+    // TODO: need integrate APIC handling
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    int tpr = cpu_get_apic_tpr(x86_cpu->apic_state) << 4;
+    int irr = apic_get_highest_priority_irr(x86_cpu->apic_state);
+
+    wreg(cpu->hvf_fd, HV_X86_TPR, tpr);
+    if (irr == -1)
+        wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0);
+    else
+        wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, (irr > tpr) ? tpr >> 4 : irr >> 4);
+}
+
+void update_apic_tpr(CPUState *cpu)
+{
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    int tpr = rreg(cpu->hvf_fd, HV_X86_TPR) >> 4;
+    cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
+}
+
+#define VECTORING_INFO_VECTOR_MASK     0xff
+
+// TODO: taskswitch handling
+static void save_state_to_tss32(CPUState *cpu, struct x86_tss_segment32 *tss)
+{
+    /* CR3 and ldt selector are not saved intentionally */
+    tss->eip = EIP(cpu);
+    tss->eflags = EFLAGS(cpu);
+    tss->eax = EAX(cpu);
+    tss->ecx = ECX(cpu);
+    tss->edx = EDX(cpu);
+    tss->ebx = EBX(cpu);
+    tss->esp = ESP(cpu);
+    tss->ebp = EBP(cpu);
+    tss->esi = ESI(cpu);
+    tss->edi = EDI(cpu);
+
+    tss->es = vmx_read_segment_selector(cpu, REG_SEG_ES).sel;
+    tss->cs = vmx_read_segment_selector(cpu, REG_SEG_CS).sel;
+    tss->ss = vmx_read_segment_selector(cpu, REG_SEG_SS).sel;
+    tss->ds = vmx_read_segment_selector(cpu, REG_SEG_DS).sel;
+    tss->fs = vmx_read_segment_selector(cpu, REG_SEG_FS).sel;
+    tss->gs = vmx_read_segment_selector(cpu, REG_SEG_GS).sel;
+}
+
+static void load_state_from_tss32(CPUState *cpu, struct x86_tss_segment32 *tss)
+{
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_CR3, tss->cr3);
+
+    RIP(cpu) = tss->eip;
+    EFLAGS(cpu) = tss->eflags | 2;
+
+    /* General purpose registers */
+    RAX(cpu) = tss->eax;
+    RCX(cpu) = tss->ecx;
+    RDX(cpu) = tss->edx;
+    RBX(cpu) = tss->ebx;
+    RSP(cpu) = tss->esp;
+    RBP(cpu) = tss->ebp;
+    RSI(cpu) = tss->esi;
+    RDI(cpu) = tss->edi;
+
+    vmx_write_segment_selector(cpu, (x68_segment_selector){{tss->ldt}}, REG_SEG_LDTR);
+    vmx_write_segment_selector(cpu, (x68_segment_selector){{tss->es}}, REG_SEG_ES);
+    vmx_write_segment_selector(cpu, (x68_segment_selector){{tss->cs}}, REG_SEG_CS);
+    vmx_write_segment_selector(cpu, (x68_segment_selector){{tss->ss}}, REG_SEG_SS);
+    vmx_write_segment_selector(cpu, (x68_segment_selector){{tss->ds}}, REG_SEG_DS);
+    vmx_write_segment_selector(cpu, (x68_segment_selector){{tss->fs}}, REG_SEG_FS);
+    vmx_write_segment_selector(cpu, (x68_segment_selector){{tss->gs}}, REG_SEG_GS);
+
+#if 0
+    load_segment(cpu, REG_SEG_LDTR, tss->ldt);
+    load_segment(cpu, REG_SEG_ES, tss->es);
+    load_segment(cpu, REG_SEG_CS, tss->cs);
+    load_segment(cpu, REG_SEG_SS, tss->ss);
+    load_segment(cpu, REG_SEG_DS, tss->ds);
+    load_segment(cpu, REG_SEG_FS, tss->fs);
+    load_segment(cpu, REG_SEG_GS, tss->gs);
+#endif
+}
+
+static int task_switch_32(CPUState *cpu, x68_segment_selector tss_sel, x68_segment_selector old_tss_sel,
+                          uint64_t old_tss_base, struct x86_segment_descriptor *new_desc)
+{
+    struct x86_tss_segment32 tss_seg;
+    uint32_t new_tss_base = x86_segment_base(new_desc);
+    uint32_t eip_offset = offsetof(struct x86_tss_segment32, eip);
+    uint32_t ldt_sel_offset = offsetof(struct x86_tss_segment32, ldt);
+
+    vmx_read_mem(cpu, &tss_seg, old_tss_base, sizeof(tss_seg));
+    save_state_to_tss32(cpu, &tss_seg);
+
+    vmx_write_mem(cpu, old_tss_base + eip_offset, &tss_seg.eip, ldt_sel_offset - eip_offset);
+    vmx_read_mem(cpu, &tss_seg, new_tss_base, sizeof(tss_seg));
+
+    if (old_tss_sel.sel != 0xffff) {
+        tss_seg.prev_tss = old_tss_sel.sel;
+
+        vmx_write_mem(cpu, new_tss_base, &tss_seg.prev_tss, sizeof(tss_seg.prev_tss));
+    }
+    load_state_from_tss32(cpu, &tss_seg);
+    return 0;
+}
+
+static void vmx_handle_task_switch(CPUState *cpu, x68_segment_selector tss_sel, int reason, bool gate_valid, uint8_t gate, uint64_t gate_type)
+{
+    uint64_t rip = rreg(cpu->hvf_fd, HV_X86_RIP);
+    if (!gate_valid || (gate_type != VMCS_INTR_T_HWEXCEPTION &&
+                        gate_type != VMCS_INTR_T_HWINTR &&
+                        gate_type != VMCS_INTR_T_NMI)) {
+        int ins_len = rvmcs(cpu->hvf_fd, VMCS_EXIT_INSTRUCTION_LENGTH);
+        macvm_set_rip(cpu, rip + ins_len);
+        return;
+    }
+
+    load_regs(cpu);
+
+    struct x86_segment_descriptor curr_tss_desc, next_tss_desc;
+    int ret;
+    x68_segment_selector old_tss_sel = vmx_read_segment_selector(cpu, REG_SEG_TR);
+    uint64_t old_tss_base = vmx_read_segment_base(cpu, REG_SEG_TR);
+    uint32_t desc_limit;
+    struct x86_call_gate task_gate_desc;
+    struct vmx_segment vmx_seg;
+
+    x86_read_segment_descriptor(cpu, &next_tss_desc, tss_sel);
+    x86_read_segment_descriptor(cpu, &curr_tss_desc, old_tss_sel);
+
+    if (reason == TSR_IDT_GATE && gate_valid) {
+        int dpl;
+
+        ret = x86_read_call_gate(cpu, &task_gate_desc, gate);
+
+        dpl = task_gate_desc.dpl;
+        x68_segment_selector cs = vmx_read_segment_selector(cpu, REG_SEG_CS);
+        if (tss_sel.rpl > dpl || cs.rpl > dpl)
+            ;//DPRINTF("emulate_gp");
+    }
+
+    desc_limit = x86_segment_limit(&next_tss_desc);
+    if (!next_tss_desc.p || ((desc_limit < 0x67 && (next_tss_desc.type & 8)) || desc_limit < 0x2b)) {
+        VM_PANIC("emulate_ts");
+    }
+
+    if (reason == TSR_IRET || reason == TSR_JMP) {
+        curr_tss_desc.type &= ~(1 << 1); /* clear busy flag */
+        x86_write_segment_descriptor(cpu, &curr_tss_desc, old_tss_sel);
+    }
+
+    if (reason == TSR_IRET)
+        EFLAGS(cpu) &= ~RFLAGS_NT;
+
+    if (reason != TSR_CALL && reason != TSR_IDT_GATE)
+        old_tss_sel.sel = 0xffff;
+
+    if (reason != TSR_IRET) {
+        next_tss_desc.type |= (1 << 1); /* set busy flag */
+        x86_write_segment_descriptor(cpu, &next_tss_desc, tss_sel);
+    }
+
+    if (next_tss_desc.type & 8)
+        ret = task_switch_32(cpu, tss_sel, old_tss_sel, old_tss_base, &next_tss_desc);
+    else
+        //ret = task_switch_16(cpu, tss_sel, old_tss_sel, old_tss_base, &next_tss_desc);
+        VM_PANIC("task_switch_16");
+
+    macvm_set_cr0(cpu->hvf_fd, rvmcs(cpu->hvf_fd, VMCS_GUEST_CR0) | CR0_TS);
+    x86_segment_descriptor_to_vmx(cpu, tss_sel, &next_tss_desc, &vmx_seg);
+    vmx_write_segment_descriptor(cpu, &vmx_seg, REG_SEG_TR);
+
+    store_regs(cpu);
+
+    hv_vcpu_invalidate_tlb(cpu->hvf_fd);
+    hv_vcpu_flush(cpu->hvf_fd);
+}
+
+static void hvf_handle_interrupt(CPUState * cpu, int mask)
+{
+    cpu->interrupt_request |= mask;
+    if (!qemu_cpu_is_self(cpu)) {
+        qemu_cpu_kick(cpu);
+    }
+}
+
+void hvf_handle_io(CPUArchState * env, uint16_t port, void* buffer,
+                  int direction, int size, int count)
+{
+    int i;
+    uint8_t *ptr = buffer;
+
+    for (i = 0; i < count; i++) {
+        address_space_rw(&address_space_io, port, MEMTXATTRS_UNSPECIFIED,
+                         ptr, size,
+                         direction);
+        ptr += size;
+    }
+}
+//
+// TODO: synchronize vcpu state
+void __hvf_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
+{
+    CPUState *cpu_state = cpu;//(CPUState *)data;
+    if (cpu_state->hvf_vcpu_dirty == 0)
+        hvf_get_registers(cpu_state);
+
+    cpu_state->hvf_vcpu_dirty = 1;
+}
+
+void hvf_cpu_synchronize_state(CPUState *cpu_state)
+{
+    if (cpu_state->hvf_vcpu_dirty == 0)
+        run_on_cpu(cpu_state, __hvf_cpu_synchronize_state, RUN_ON_CPU_NULL);
+}
+
+void __hvf_cpu_synchronize_post_reset(CPUState *cpu, run_on_cpu_data arg)
+{
+    CPUState *cpu_state = cpu;
+    hvf_put_registers(cpu_state);
+    cpu_state->hvf_vcpu_dirty = false;
+}
+
+void hvf_cpu_synchronize_post_reset(CPUState *cpu_state)
+{
+    run_on_cpu(cpu_state, __hvf_cpu_synchronize_post_reset, RUN_ON_CPU_NULL);
+}
+
+void _hvf_cpu_synchronize_post_init(CPUState *cpu, run_on_cpu_data arg)
+{
+    CPUState *cpu_state = cpu;
+    hvf_put_registers(cpu_state);
+    cpu_state->hvf_vcpu_dirty = false;
+}
+
+void hvf_cpu_synchronize_post_init(CPUState *cpu_state)
+{
+    run_on_cpu(cpu_state, _hvf_cpu_synchronize_post_init, RUN_ON_CPU_NULL);
+}
+ 
+// TODO: ept fault handlig
+void vmx_clear_int_window_exiting(CPUState *cpu);
+static bool ept_emulation_fault(uint64_t ept_qual)
+{
+	int read, write;
+
+	/* EPT fault on an instruction fetch doesn't make sense here */
+	if (ept_qual & EPT_VIOLATION_INST_FETCH)
+		return false;
+
+	/* EPT fault must be a read fault or a write fault */
+	read = ept_qual & EPT_VIOLATION_DATA_READ ? 1 : 0;
+	write = ept_qual & EPT_VIOLATION_DATA_WRITE ? 1 : 0;
+	if ((read | write) == 0)
+		return false;
+
+	/*
+	 * The EPT violation must have been caused by accessing a
+	 * guest-physical address that is a translation of a guest-linear
+	 * address.
+	 */
+	if ((ept_qual & EPT_VIOLATION_GLA_VALID) == 0 ||
+	    (ept_qual & EPT_VIOLATION_XLAT_VALID) == 0) {
+		return false;
+	}
+
+	return true;
+}
+
+static void hvf_region_add(MemoryListener * listener,
+                           MemoryRegionSection * section)
+{
+    hvf_set_phys_mem(section, true);
+}
+
+static void hvf_region_del(MemoryListener * listener,
+                           MemoryRegionSection * section)
+{
+    hvf_set_phys_mem(section, false);
+}
+
+static MemoryListener hvf_memory_listener = {
+    .priority = 10,
+    .region_add = hvf_region_add,
+    .region_del = hvf_region_del,
+};
+
+static MemoryListener hvf_io_listener = {
+    .priority = 10,
+};
+
+void vmx_reset_vcpu(CPUState *cpu) {
+
+    wvmcs(cpu->hvf_fd, VMCS_ENTRY_CTLS, 0);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_IA32_EFER, 0);
+    macvm_set_cr0(cpu->hvf_fd, 0x60000010);
+
+    wvmcs(cpu->hvf_fd, VMCS_CR4_MASK, CR4_VMXE_MASK);
+    wvmcs(cpu->hvf_fd, VMCS_CR4_SHADOW, 0x0);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_CR4, CR4_VMXE_MASK);
+
+    // set VMCS guest state fields
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_SELECTOR, 0xf000);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_LIMIT, 0xffff);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_ACCESS_RIGHTS, 0x9b);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_BASE, 0xffff0000);
+
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_SELECTOR, 0);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_LIMIT, 0xffff);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_ACCESS_RIGHTS, 0x93);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_BASE, 0);
+
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_SELECTOR, 0);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_LIMIT, 0xffff);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_ACCESS_RIGHTS, 0x93);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_BASE, 0);
+
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_SELECTOR, 0);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_LIMIT, 0xffff);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_ACCESS_RIGHTS, 0x93);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_BASE, 0);
+
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_SELECTOR, 0);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_LIMIT, 0xffff);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_ACCESS_RIGHTS, 0x93);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_BASE, 0);
+
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_SELECTOR, 0);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_LIMIT, 0xffff);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_ACCESS_RIGHTS, 0x93);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_BASE, 0);
+
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_SELECTOR, 0);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_LIMIT, 0);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_ACCESS_RIGHTS, 0x10000);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_BASE, 0);
+
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_SELECTOR, 0);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_LIMIT, 0);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_ACCESS_RIGHTS, 0x83);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_BASE, 0);
+
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_LIMIT, 0);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_BASE, 0);
+
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_IDTR_LIMIT, 0);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_IDTR_BASE, 0);
+
+    //wvmcs(cpu->hvf_fd, VMCS_GUEST_CR2, 0x0);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_CR3, 0x0);
+
+    wreg(cpu->hvf_fd, HV_X86_RIP, 0xfff0);
+    wreg(cpu->hvf_fd, HV_X86_RDX, 0x623);
+    wreg(cpu->hvf_fd, HV_X86_RFLAGS, 0x2);
+    wreg(cpu->hvf_fd, HV_X86_RSP, 0x0);
+    wreg(cpu->hvf_fd, HV_X86_RAX, 0x0);
+    wreg(cpu->hvf_fd, HV_X86_RBX, 0x0);
+    wreg(cpu->hvf_fd, HV_X86_RCX, 0x0);
+    wreg(cpu->hvf_fd, HV_X86_RSI, 0x0);
+    wreg(cpu->hvf_fd, HV_X86_RDI, 0x0);
+    wreg(cpu->hvf_fd, HV_X86_RBP, 0x0);
+
+    for (int i = 0; i < 8; i++)
+         wreg(cpu->hvf_fd, HV_X86_R8+i, 0x0);
+
+    hv_vm_sync_tsc(0);
+    cpu->halted = 0;
+    hv_vcpu_invalidate_tlb(cpu->hvf_fd);
+    hv_vcpu_flush(cpu->hvf_fd);
+}
+
+void hvf_vcpu_destroy(CPUState* cpu) 
+{
+    hv_return_t ret = hv_vcpu_destroy((hv_vcpuid_t)cpu->hvf_fd);
+    assert_hvf_ok(ret);
+}
+
+static void dummy_signal(int sig)
+{
+}
+
+int hvf_init_vcpu(CPUState * cpu) {
+
+    X86CPU *x86cpu;
+    
+    // init cpu signals
+    sigset_t set;
+    struct sigaction sigact;
+
+    memset(&sigact, 0, sizeof(sigact));
+    sigact.sa_handler = dummy_signal;
+    sigaction(SIG_IPI, &sigact, NULL);
+
+    pthread_sigmask(SIG_BLOCK, NULL, &set);
+    sigdelset(&set, SIG_IPI);
+
+    int r;
+    init_emu(cpu);
+    init_decoder(cpu);
+    init_cpuid(cpu);
+
+    cpu->hvf_caps = (struct hvf_vcpu_caps*)g_malloc0(sizeof(struct hvf_vcpu_caps));
+    cpu->hvf_x86 = (struct hvf_x86_state*)g_malloc0(sizeof(struct hvf_x86_state));
+
+    r = hv_vcpu_create((hv_vcpuid_t *)&cpu->hvf_fd, HV_VCPU_DEFAULT);
+    cpu->hvf_vcpu_dirty = 1;
+    assert_hvf_ok(r);
+
+	if (hv_vmx_read_capability(HV_VMX_CAP_PINBASED, &cpu->hvf_caps->vmx_cap_pinbased))
+		abort();
+	if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED, &cpu->hvf_caps->vmx_cap_procbased))
+		abort();
+	if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED2, &cpu->hvf_caps->vmx_cap_procbased2))
+		abort();
+	if (hv_vmx_read_capability(HV_VMX_CAP_ENTRY, &cpu->hvf_caps->vmx_cap_entry))
+		abort();
+
+	/* set VMCS control fields */
+    wvmcs(cpu->hvf_fd, VMCS_PIN_BASED_CTLS, cap2ctrl(cpu->hvf_caps->vmx_cap_pinbased, 0));
+    wvmcs(cpu->hvf_fd, VMCS_PRI_PROC_BASED_CTLS, cap2ctrl(cpu->hvf_caps->vmx_cap_procbased,
+                                                   VMCS_PRI_PROC_BASED_CTLS_HLT |
+                                                   VMCS_PRI_PROC_BASED_CTLS_MWAIT |
+                                                   VMCS_PRI_PROC_BASED_CTLS_TSC_OFFSET |
+                                                   VMCS_PRI_PROC_BASED_CTLS_TPR_SHADOW) |
+                                                   VMCS_PRI_PROC_BASED_CTLS_SEC_CONTROL);
+	wvmcs(cpu->hvf_fd, VMCS_SEC_PROC_BASED_CTLS,
+          cap2ctrl(cpu->hvf_caps->vmx_cap_procbased2,VMCS_PRI_PROC_BASED2_CTLS_APIC_ACCESSES));
+
+	wvmcs(cpu->hvf_fd, VMCS_ENTRY_CTLS, cap2ctrl(cpu->hvf_caps->vmx_cap_entry, 0));
+	wvmcs(cpu->hvf_fd, VMCS_EXCEPTION_BITMAP, 0); /* Double fault */
+
+    wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0);
+
+    vmx_reset_vcpu(cpu);
+
+    x86cpu = X86_CPU(cpu);
+    x86cpu->env.kvm_xsave_buf = qemu_memalign(4096, sizeof(struct hvf_xsave_buf));
+
+    hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_STAR, 1);
+    hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_LSTAR, 1);
+    hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_CSTAR, 1);
+    hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FMASK, 1);
+    hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FSBASE, 1);
+    hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_GSBASE, 1);
+    hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_KERNELGSBASE, 1);
+    hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_TSC_AUX, 1);
+    //hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_TSC, 1);
+    hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_CS, 1);
+    hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_EIP, 1);
+    hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_ESP, 1);
+
+    return 0;
+}
+
+int hvf_enabled() { return !hvf_disabled; }
+void hvf_disable(int shouldDisable) {
+    hvf_disabled = shouldDisable;
+}
+
+int hvf_vcpu_exec(CPUState* cpu) {
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86_cpu->env;
+    int ret = 0;
+    uint64_t rip = 0;
+
+    cpu->halted = 0;
+
+    if (hvf_process_events(cpu)) {
+        return EXCP_HLT;
+    }
+
+    do {
+        if (cpu->hvf_vcpu_dirty) {
+            hvf_put_registers(cpu);
+            cpu->hvf_vcpu_dirty = false;
+        }
+
+        cpu->hvf_x86->interruptable =
+            !(rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) &
+            (VMCS_INTERRUPTIBILITY_STI_BLOCKING | VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING));
+
+        hvf_inject_interrupts(cpu);
+        vmx_update_tpr(cpu);
+
+
+        qemu_mutex_unlock_iothread();
+        if (!cpu_is_bsp(X86_CPU(cpu)) && cpu->halted) {
+            qemu_mutex_lock_iothread();
+            return EXCP_HLT;
+        }
+
+        hv_return_t r  = hv_vcpu_run(cpu->hvf_fd);
+        assert_hvf_ok(r);
+
+        /* handle VMEXIT */
+        uint64_t exit_reason = rvmcs(cpu->hvf_fd, VMCS_EXIT_REASON);
+        uint64_t exit_qual = rvmcs(cpu->hvf_fd, VMCS_EXIT_QUALIFICATION);
+        uint32_t ins_len = (uint32_t)rvmcs(cpu->hvf_fd, VMCS_EXIT_INSTRUCTION_LENGTH);
+        uint64_t idtvec_info = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO);
+        rip = rreg(cpu->hvf_fd, HV_X86_RIP);
+        RFLAGS(cpu) = rreg(cpu->hvf_fd, HV_X86_RFLAGS);
+        env->eflags = RFLAGS(cpu);
+
+        trace_hvf_vm_exit(exit_reason, exit_qual);
+
+        qemu_mutex_lock_iothread();
+
+        update_apic_tpr(cpu);
+        current_cpu = cpu;
+
+        ret = 0;
+        switch (exit_reason) {
+            case EXIT_REASON_HLT: {
+                macvm_set_rip(cpu, rip + ins_len);
+                if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) && (EFLAGS(cpu) & IF_MASK))
+                    && !(cpu->interrupt_request & CPU_INTERRUPT_NMI) &&
+                    !(idtvec_info & VMCS_IDT_VEC_VALID)) {
+                    cpu->halted = 1;
+                    ret = EXCP_HLT;
+                }
+                ret = EXCP_INTERRUPT;
+                break;
+            }
+            case EXIT_REASON_MWAIT: {
+                ret = EXCP_INTERRUPT;
+                break;
+            }
+                /* Need to check if MMIO or unmmaped fault */
+            case EXIT_REASON_EPT_FAULT:
+            {
+                hvf_slot *slot;
+                addr_t gpa = rvmcs(cpu->hvf_fd, VMCS_GUEST_PHYSICAL_ADDRESS);
+                trace_hvf_vm_exit_gpa(gpa);
+
+                if ((idtvec_info & VMCS_IDT_VEC_VALID) == 0 && (exit_qual & EXIT_QUAL_NMIUDTI) != 0)
+                    vmx_set_nmi_blocking(cpu);
+
+                slot = hvf_find_overlap_slot(gpa, gpa);
+                // mmio
+                if (ept_emulation_fault(exit_qual) && !slot) {
+                    struct x86_decode decode;
+
+                    load_regs(cpu);
+                    cpu->hvf_x86->fetch_rip = rip;
+
+                    decode_instruction(cpu, &decode);
+                    exec_instruction(cpu, &decode);
+                    store_regs(cpu);
+                    break;
+                }
+#ifdef DIRTY_VGA_TRACKING
+                if (slot) {
+                    bool read = exit_qual & EPT_VIOLATION_DATA_READ ? 1 : 0;
+                    bool write = exit_qual & EPT_VIOLATION_DATA_WRITE ? 1 : 0;
+                    if (!read && !write)
+                        break;
+                    int flags = HV_MEMORY_READ | HV_MEMORY_EXEC;
+                    if (write) flags |= HV_MEMORY_WRITE;
+
+                    pthread_rwlock_wrlock(&mem_lock);
+                    if (write)
+                        mark_slot_page_dirty(slot, gpa);
+                    hv_vm_protect(gpa & ~0xfff, 4096, flags);
+                    pthread_rwlock_unlock(&mem_lock);
+                }
+#endif
+                break;
+            }
+            case EXIT_REASON_INOUT:
+            {
+                uint32_t in = (exit_qual & 8) != 0;
+                uint32_t size =  (exit_qual & 7) + 1;
+                uint32_t string =  (exit_qual & 16) != 0;
+                uint32_t port =  exit_qual >> 16;
+                //uint32_t rep = (exit_qual & 0x20) != 0;
+
+#if 1
+                if (!string && in) {
+                    uint64_t val = 0;
+                    load_regs(cpu);
+                    hvf_handle_io(env, port, &val, 0, size, 1);
+                    if (size == 1) AL(cpu) = val;
+                    else if (size == 2) AX(cpu) = val;
+                    else if (size == 4) RAX(cpu) = (uint32_t)val;
+                    else VM_PANIC("size");
+                    RIP(cpu) += ins_len;
+                    store_regs(cpu);
+                    break;
+                } else if (!string && !in) {
+                    RAX(cpu) = rreg(cpu->hvf_fd, HV_X86_RAX);
+                    hvf_handle_io(env, port, &RAX(cpu), 1, size, 1);
+                    macvm_set_rip(cpu, rip + ins_len);
+                    break;
+                }
+#endif
+                struct x86_decode decode;
+
+                load_regs(cpu);
+                cpu->hvf_x86->fetch_rip = rip;
+
+                decode_instruction(cpu, &decode);
+                VM_PANIC_ON(ins_len != decode.len);
+                exec_instruction(cpu, &decode);
+                store_regs(cpu);
+
+                break;
+            }
+            case EXIT_REASON_CPUID: {
+                uint32_t rax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX);
+                uint32_t rbx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RBX);
+                uint32_t rcx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX);
+                uint32_t rdx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX);
+
+                get_cpuid_func(cpu, rax, rcx, &rax, &rbx, &rcx, &rdx);
+
+                wreg(cpu->hvf_fd, HV_X86_RAX, rax);
+                wreg(cpu->hvf_fd, HV_X86_RBX, rbx);
+                wreg(cpu->hvf_fd, HV_X86_RCX, rcx);
+                wreg(cpu->hvf_fd, HV_X86_RDX, rdx);
+
+                macvm_set_rip(cpu, rip + ins_len);
+                break;
+            }
+            case EXIT_REASON_XSETBV: {
+                X86CPU *x86_cpu = X86_CPU(cpu);
+                CPUX86State *env = &x86_cpu->env;
+                uint32_t eax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX);
+                uint32_t ecx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX);
+                uint32_t edx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX);
+
+                if (ecx) {
+                    macvm_set_rip(cpu, rip + ins_len);
+                    break;
+                }
+                env->xcr0 = ((uint64_t)edx << 32) | eax;
+                wreg(cpu->hvf_fd, HV_X86_XCR0, env->xcr0 | 1);
+                macvm_set_rip(cpu, rip + ins_len);
+                break;
+            }
+            case EXIT_REASON_INTR_WINDOW:
+                vmx_clear_int_window_exiting(cpu);
+                ret = EXCP_INTERRUPT;
+                break;
+            case EXIT_REASON_NMI_WINDOW:
+                vmx_clear_nmi_window_exiting(cpu);
+                ret = EXCP_INTERRUPT;
+                break;
+            case EXIT_REASON_EXT_INTR:
+                /* force exit and allow io handling */
+                ret = EXCP_INTERRUPT;
+                break;
+            case EXIT_REASON_RDMSR:
+            case EXIT_REASON_WRMSR:
+            {
+                load_regs(cpu);
+                if (exit_reason == EXIT_REASON_RDMSR)
+                    simulate_rdmsr(cpu);
+                else
+                    simulate_wrmsr(cpu);
+                RIP(cpu) += rvmcs(cpu->hvf_fd, VMCS_EXIT_INSTRUCTION_LENGTH);
+                store_regs(cpu);
+                break;
+            }
+            case EXIT_REASON_CR_ACCESS: {
+                int cr;
+                int reg;
+
+                load_regs(cpu);
+                cr = exit_qual & 15;
+                reg = (exit_qual >> 8) & 15;
+
+                switch (cr) {
+                    case 0x0: {
+                        macvm_set_cr0(cpu->hvf_fd, RRX(cpu, reg));
+                        break;
+                    }
+                    case 4: {
+                        macvm_set_cr4(cpu->hvf_fd, RRX(cpu, reg));
+                        break;
+                    }
+                    case 8: {
+                        X86CPU *x86_cpu = X86_CPU(cpu);
+                        if (exit_qual & 0x10) {
+                            RRX(cpu, reg) = cpu_get_apic_tpr(x86_cpu->apic_state);
+                        }
+                        else {
+                            int tpr = RRX(cpu, reg);
+                            cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
+                            ret = EXCP_INTERRUPT;
+                        }
+                        break;
+                    }
+                    default:
+                        fprintf(stderr, "Unrecognized CR %d\n", cr);
+                        abort();
+                }
+                RIP(cpu) += ins_len;
+                store_regs(cpu);
+                break;
+            }
+            case EXIT_REASON_APIC_ACCESS: { // TODO
+                struct x86_decode decode;
+
+                load_regs(cpu);
+                cpu->hvf_x86->fetch_rip = rip;
+
+                decode_instruction(cpu, &decode);
+                exec_instruction(cpu, &decode);
+                store_regs(cpu);
+                break;
+            }
+            case EXIT_REASON_TPR: {
+                ret = 1;
+                break;
+            }
+            case EXIT_REASON_TASK_SWITCH: {
+                uint64_t vinfo = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO);
+                x68_segment_selector sel = {.sel = exit_qual & 0xffff};
+                vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3,
+                 vinfo & VMCS_INTR_VALID, vinfo & VECTORING_INFO_VECTOR_MASK, vinfo & VMCS_INTR_T_MASK);
+                break;
+            }
+            case EXIT_REASON_TRIPLE_FAULT: {
+                //addr_t gpa = rvmcs(cpu->hvf_fd, VMCS_GUEST_PHYSICAL_ADDRESS);
+                qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
+                usleep(1000 * 100);
+                ret = EXCP_INTERRUPT;
+                break;
+            }
+            case EXIT_REASON_RDPMC:
+                wreg(cpu->hvf_fd, HV_X86_RAX, 0);
+                wreg(cpu->hvf_fd, HV_X86_RDX, 0);
+                macvm_set_rip(cpu, rip + ins_len);
+                break;
+            case VMX_REASON_VMCALL:
+                // TODO: maybe just take this out?
+                // if (g_hypervisor_iface) {
+                //     load_regs(cpu);
+                //     g_hypervisor_iface->hypercall_handler(cpu);
+                //     RIP(cpu) += rvmcs(cpu->hvf_fd, VMCS_EXIT_INSTRUCTION_LENGTH);
+                //     store_regs(cpu);
+                // }
+                break;
+            default:
+                fprintf(stderr, "%llx: unhandled exit %llx\n", rip, exit_reason);
+        }
+    } while (ret == 0);
+
+    return ret;
+}
+
+static bool hvf_allowed;
+
+static int hvf_accel_init(MachineState *ms)
+{
+    int x;
+    hv_return_t ret;
+    HVFState *s;
+
+    ret = hv_vm_create(HV_VM_DEFAULT);
+    assert_hvf_ok(ret);
+
+    s = (HVFState *)g_malloc0(sizeof(HVFState));
+ 
+    s->num_slots = 32;
+    for (x = 0; x < s->num_slots; ++x) {
+        s->slots[x].size = 0;
+        s->slots[x].slot_id = x;
+    }
+  
+    hvf_state = s;
+    cpu_interrupt_handler = hvf_handle_interrupt;
+    memory_listener_register(&hvf_memory_listener, &address_space_memory);
+    memory_listener_register(&hvf_io_listener, &address_space_io);
+    return 0;
+}
+
+static void hvf_accel_class_init(ObjectClass *oc, void *data)
+{
+    AccelClass *ac = ACCEL_CLASS(oc);
+    ac->name = "HVF";
+    ac->init_machine = hvf_accel_init;
+    ac->allowed = &hvf_allowed;
+}
+
+static const TypeInfo hvf_accel_type = {
+    .name = TYPE_HVF_ACCEL,
+    .parent = TYPE_ACCEL,
+    .class_init = hvf_accel_class_init,
+};
+
+static void hvf_type_init(void)
+{
+    type_register_static(&hvf_accel_type);
+}
+
+type_init(hvf_type_init);

target/i386/hvf-i386.h new file +48 -0

new file mode 100644
index 0000000000..f3f958058a
@@ -0,0 +1,48 @@
+/*
+ * QEMU Hypervisor.framework (HVF) support
+ *
+ * Copyright 2017 Google Inc
+ *
+ * Adapted from target-i386/hax-i386.h:
+ * Copyright (c) 2011 Intel Corporation
+ *  Written by:
+ *  Jiang Yunhong<[email protected]>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+#ifndef _HVF_I386_H
+#define _HVF_I386_H
+
+#include "sysemu/hvf.h"
+#include "cpu.h"
+#include "hvf-utils/x86.h"
+
+#define HVF_MAX_VCPU 0x10
+#define MAX_VM_ID 0x40
+#define MAX_VCPU_ID 0x40
+
+extern struct hvf_state hvf_global;
+
+struct hvf_vm {
+    int id;
+    struct hvf_vcpu_state *vcpus[HVF_MAX_VCPU];
+};
+
+struct hvf_state {
+    uint32_t version;
+    struct hvf_vm *vm;
+    uint64_t mem_quota;
+};
+
+#ifdef NEED_CPU_H
+/* Functions exported to host specific mode */
+
+/* Host specific functions */
+int hvf_inject_interrupt(CPUArchState * env, int vector);
+int hvf_vcpu_run(struct hvf_vcpu_state *vcpu);
+#endif
+
+#endif

target/i386/hvf-utils/Makefile.objs new file +1 -0

new file mode 100644
index 0000000000..7df219ad9c
@@ -0,0 +1 @@
+obj-y += x86.o x86_cpuid.o x86_decode.o x86_descr.o x86_emu.o x86_flags.o x86_mmu.o x86hvf.o

target/i386/hvf-utils/README.md new file +7 -0

new file mode 100644
index 0000000000..0d27a0d52b
@@ -0,0 +1,7 @@
+# OS X Hypervisor.framework support in QEMU
+
+These sources (and ../hvf-all.c) are adapted from Veertu Inc's vdhh (Veertu Desktop Hosted Hypervisor) (last known location: https://github.com/veertuinc/vdhh) with some minor changes, the most significant of which were:
+
+1. Adapt to our current QEMU's `CPUState` structure and `address_space_rw` API; many struct members have been moved around (emulated x86 state, kvm_xsave_buf) due to historical differences + QEMU needing to handle more emulation targets.
+2. Removal of `apic_page` and hyperv-related functionality.
+3. More relaxed use of `qemu_mutex_lock_iothread`.

target/i386/hvf-utils/vmcs.h new file +368 -0

new file mode 100644
index 0000000000..6f7ccb361a
@@ -0,0 +1,368 @@
+/*-
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _VMCS_H_
+#define	_VMCS_H_
+
+#include <Hypervisor/hv.h>
+#include <Hypervisor/hv_vmx.h>
+
+#define	VMCS_INITIAL			0xffffffffffffffff
+
+#define	VMCS_IDENT(encoding)		((encoding) | 0x80000000)
+/*
+ * VMCS field encodings from Appendix H, Intel Architecture Manual Vol3B.
+ */
+#define	VMCS_INVALID_ENCODING		0xffffffff
+
+/* 16-bit control fields */
+#define	VMCS_VPID			0x00000000
+#define	VMCS_PIR_VECTOR			0x00000002
+
+/* 16-bit guest-state fields */
+#define	VMCS_GUEST_ES_SELECTOR		0x00000800
+#define	VMCS_GUEST_CS_SELECTOR		0x00000802
+#define	VMCS_GUEST_SS_SELECTOR		0x00000804
+#define	VMCS_GUEST_DS_SELECTOR		0x00000806
+#define	VMCS_GUEST_FS_SELECTOR		0x00000808
+#define	VMCS_GUEST_GS_SELECTOR		0x0000080A
+#define	VMCS_GUEST_LDTR_SELECTOR	0x0000080C
+#define	VMCS_GUEST_TR_SELECTOR		0x0000080E
+#define	VMCS_GUEST_INTR_STATUS		0x00000810
+
+/* 16-bit host-state fields */
+#define	VMCS_HOST_ES_SELECTOR		0x00000C00
+#define	VMCS_HOST_CS_SELECTOR		0x00000C02
+#define	VMCS_HOST_SS_SELECTOR		0x00000C04
+#define	VMCS_HOST_DS_SELECTOR		0x00000C06
+#define	VMCS_HOST_FS_SELECTOR		0x00000C08
+#define	VMCS_HOST_GS_SELECTOR		0x00000C0A
+#define	VMCS_HOST_TR_SELECTOR		0x00000C0C
+
+/* 64-bit control fields */
+#define	VMCS_IO_BITMAP_A		0x00002000
+#define	VMCS_IO_BITMAP_B		0x00002002
+#define	VMCS_MSR_BITMAP			0x00002004
+#define	VMCS_EXIT_MSR_STORE		0x00002006
+#define	VMCS_EXIT_MSR_LOAD		0x00002008
+#define	VMCS_ENTRY_MSR_LOAD		0x0000200A
+#define	VMCS_EXECUTIVE_VMCS		0x0000200C
+#define	VMCS_TSC_OFFSET			0x00002010
+#define	VMCS_VIRTUAL_APIC		0x00002012
+#define	VMCS_APIC_ACCESS		0x00002014
+#define	VMCS_PIR_DESC			0x00002016
+#define	VMCS_EPTP			0x0000201A
+#define	VMCS_EOI_EXIT0			0x0000201C
+#define	VMCS_EOI_EXIT1			0x0000201E
+#define	VMCS_EOI_EXIT2			0x00002020
+#define	VMCS_EOI_EXIT3			0x00002022
+#define	VMCS_EOI_EXIT(vector)		(VMCS_EOI_EXIT0 + ((vector) / 64) * 2)
+
+/* 64-bit read-only fields */
+#define	VMCS_GUEST_PHYSICAL_ADDRESS	0x00002400
+
+/* 64-bit guest-state fields */
+#define	VMCS_LINK_POINTER		0x00002800
+#define	VMCS_GUEST_IA32_DEBUGCTL	0x00002802
+#define	VMCS_GUEST_IA32_PAT		0x00002804
+#define	VMCS_GUEST_IA32_EFER		0x00002806
+#define	VMCS_GUEST_IA32_PERF_GLOBAL_CTRL 0x00002808
+#define	VMCS_GUEST_PDPTE0		0x0000280A
+#define	VMCS_GUEST_PDPTE1		0x0000280C
+#define	VMCS_GUEST_PDPTE2		0x0000280E
+#define	VMCS_GUEST_PDPTE3		0x00002810
+
+/* 64-bit host-state fields */
+#define	VMCS_HOST_IA32_PAT		0x00002C00
+#define	VMCS_HOST_IA32_EFER		0x00002C02
+#define	VMCS_HOST_IA32_PERF_GLOBAL_CTRL	0x00002C04
+
+/* 32-bit control fields */
+#define	VMCS_PIN_BASED_CTLS		0x00004000
+#define	VMCS_PRI_PROC_BASED_CTLS	0x00004002
+#define	VMCS_EXCEPTION_BITMAP		0x00004004
+#define	VMCS_PF_ERROR_MASK		0x00004006
+#define	VMCS_PF_ERROR_MATCH		0x00004008
+#define	VMCS_CR3_TARGET_COUNT		0x0000400A
+#define	VMCS_EXIT_CTLS			0x0000400C
+#define	VMCS_EXIT_MSR_STORE_COUNT	0x0000400E
+#define	VMCS_EXIT_MSR_LOAD_COUNT	0x00004010
+#define	VMCS_ENTRY_CTLS			0x00004012
+#define	VMCS_ENTRY_MSR_LOAD_COUNT	0x00004014
+#define	VMCS_ENTRY_INTR_INFO		0x00004016
+#define	VMCS_ENTRY_EXCEPTION_ERROR	0x00004018
+#define	VMCS_ENTRY_INST_LENGTH		0x0000401A
+#define	VMCS_TPR_THRESHOLD		0x0000401C
+#define	VMCS_SEC_PROC_BASED_CTLS	0x0000401E
+#define	VMCS_PLE_GAP			0x00004020
+#define	VMCS_PLE_WINDOW			0x00004022
+
+/* 32-bit read-only data fields */
+#define	VMCS_INSTRUCTION_ERROR		0x00004400
+#define	VMCS_EXIT_REASON		0x00004402
+#define	VMCS_EXIT_INTR_INFO		0x00004404
+#define	VMCS_EXIT_INTR_ERRCODE		0x00004406
+#define	VMCS_IDT_VECTORING_INFO		0x00004408
+#define	VMCS_IDT_VECTORING_ERROR	0x0000440A
+#define	VMCS_EXIT_INSTRUCTION_LENGTH	0x0000440C
+#define	VMCS_EXIT_INSTRUCTION_INFO	0x0000440E
+
+/* 32-bit guest-state fields */
+#define	VMCS_GUEST_ES_LIMIT		0x00004800
+#define	VMCS_GUEST_CS_LIMIT		0x00004802
+#define	VMCS_GUEST_SS_LIMIT		0x00004804
+#define	VMCS_GUEST_DS_LIMIT		0x00004806
+#define	VMCS_GUEST_FS_LIMIT		0x00004808
+#define	VMCS_GUEST_GS_LIMIT		0x0000480A
+#define	VMCS_GUEST_LDTR_LIMIT		0x0000480C
+#define	VMCS_GUEST_TR_LIMIT		0x0000480E
+#define	VMCS_GUEST_GDTR_LIMIT		0x00004810
+#define	VMCS_GUEST_IDTR_LIMIT		0x00004812
+#define	VMCS_GUEST_ES_ACCESS_RIGHTS	0x00004814
+#define	VMCS_GUEST_CS_ACCESS_RIGHTS	0x00004816
+#define	VMCS_GUEST_SS_ACCESS_RIGHTS	0x00004818
+#define	VMCS_GUEST_DS_ACCESS_RIGHTS	0x0000481A
+#define	VMCS_GUEST_FS_ACCESS_RIGHTS	0x0000481C
+#define	VMCS_GUEST_GS_ACCESS_RIGHTS	0x0000481E
+#define	VMCS_GUEST_LDTR_ACCESS_RIGHTS	0x00004820
+#define	VMCS_GUEST_TR_ACCESS_RIGHTS	0x00004822
+#define	VMCS_GUEST_INTERRUPTIBILITY	0x00004824
+#define	VMCS_GUEST_ACTIVITY		0x00004826
+#define VMCS_GUEST_SMBASE		0x00004828
+#define	VMCS_GUEST_IA32_SYSENTER_CS	0x0000482A
+#define	VMCS_PREEMPTION_TIMER_VALUE	0x0000482E
+
+/* 32-bit host state fields */
+#define	VMCS_HOST_IA32_SYSENTER_CS	0x00004C00
+
+/* Natural Width control fields */
+#define	VMCS_CR0_MASK			0x00006000
+#define	VMCS_CR4_MASK			0x00006002
+#define	VMCS_CR0_SHADOW			0x00006004
+#define	VMCS_CR4_SHADOW			0x00006006
+#define	VMCS_CR3_TARGET0		0x00006008
+#define	VMCS_CR3_TARGET1		0x0000600A
+#define	VMCS_CR3_TARGET2		0x0000600C
+#define	VMCS_CR3_TARGET3		0x0000600E
+
+/* Natural Width read-only fields */
+#define	VMCS_EXIT_QUALIFICATION		0x00006400
+#define	VMCS_IO_RCX			0x00006402
+#define	VMCS_IO_RSI			0x00006404
+#define	VMCS_IO_RDI			0x00006406
+#define	VMCS_IO_RIP			0x00006408
+#define	VMCS_GUEST_LINEAR_ADDRESS	0x0000640A
+
+/* Natural Width guest-state fields */
+#define	VMCS_GUEST_CR0			0x00006800
+#define	VMCS_GUEST_CR3			0x00006802
+#define	VMCS_GUEST_CR4			0x00006804
+#define	VMCS_GUEST_ES_BASE		0x00006806
+#define	VMCS_GUEST_CS_BASE		0x00006808
+#define	VMCS_GUEST_SS_BASE		0x0000680A
+#define	VMCS_GUEST_DS_BASE		0x0000680C
+#define	VMCS_GUEST_FS_BASE		0x0000680E
+#define	VMCS_GUEST_GS_BASE		0x00006810
+#define	VMCS_GUEST_LDTR_BASE		0x00006812
+#define	VMCS_GUEST_TR_BASE		0x00006814
+#define	VMCS_GUEST_GDTR_BASE		0x00006816
+#define	VMCS_GUEST_IDTR_BASE		0x00006818
+#define	VMCS_GUEST_DR7			0x0000681A
+#define	VMCS_GUEST_RSP			0x0000681C
+#define	VMCS_GUEST_RIP			0x0000681E
+#define	VMCS_GUEST_RFLAGS		0x00006820
+#define	VMCS_GUEST_PENDING_DBG_EXCEPTIONS 0x00006822
+#define	VMCS_GUEST_IA32_SYSENTER_ESP	0x00006824
+#define	VMCS_GUEST_IA32_SYSENTER_EIP	0x00006826
+
+/* Natural Width host-state fields */
+#define	VMCS_HOST_CR0			0x00006C00
+#define	VMCS_HOST_CR3			0x00006C02
+#define	VMCS_HOST_CR4			0x00006C04
+#define	VMCS_HOST_FS_BASE		0x00006C06
+#define	VMCS_HOST_GS_BASE		0x00006C08
+#define	VMCS_HOST_TR_BASE		0x00006C0A
+#define	VMCS_HOST_GDTR_BASE		0x00006C0C
+#define	VMCS_HOST_IDTR_BASE		0x00006C0E
+#define	VMCS_HOST_IA32_SYSENTER_ESP	0x00006C10
+#define	VMCS_HOST_IA32_SYSENTER_EIP	0x00006C12
+#define	VMCS_HOST_RSP			0x00006C14
+#define	VMCS_HOST_RIP			0x00006c16
+
+/*
+ * VM instruction error numbers
+ */
+#define	VMRESUME_WITH_NON_LAUNCHED_VMCS	5
+
+/*
+ * VMCS exit reasons
+ */
+#define EXIT_REASON_EXCEPTION		0
+#define EXIT_REASON_EXT_INTR		1
+#define EXIT_REASON_TRIPLE_FAULT	2
+#define EXIT_REASON_INIT		3
+#define EXIT_REASON_SIPI		4
+#define EXIT_REASON_IO_SMI		5
+#define EXIT_REASON_SMI			6
+#define EXIT_REASON_INTR_WINDOW		7
+#define EXIT_REASON_NMI_WINDOW		8
+#define EXIT_REASON_TASK_SWITCH		9
+#define EXIT_REASON_CPUID		10
+#define EXIT_REASON_GETSEC		11
+#define EXIT_REASON_HLT			12
+#define EXIT_REASON_INVD		13
+#define EXIT_REASON_INVLPG		14
+#define EXIT_REASON_RDPMC		15
+#define EXIT_REASON_RDTSC		16
+#define EXIT_REASON_RSM			17
+#define EXIT_REASON_VMCALL		18
+#define EXIT_REASON_VMCLEAR		19
+#define EXIT_REASON_VMLAUNCH		20
+#define EXIT_REASON_VMPTRLD		21
+#define EXIT_REASON_VMPTRST		22
+#define EXIT_REASON_VMREAD		23
+#define EXIT_REASON_VMRESUME		24
+#define EXIT_REASON_VMWRITE		25
+#define EXIT_REASON_VMXOFF		26
+#define EXIT_REASON_VMXON		27
+#define EXIT_REASON_CR_ACCESS		28
+#define EXIT_REASON_DR_ACCESS		29
+#define EXIT_REASON_INOUT		30
+#define EXIT_REASON_RDMSR		31
+#define EXIT_REASON_WRMSR		32
+#define EXIT_REASON_INVAL_VMCS		33
+#define EXIT_REASON_INVAL_MSR		34
+#define EXIT_REASON_MWAIT		36
+#define EXIT_REASON_MTF			37
+#define EXIT_REASON_MONITOR		39
+#define EXIT_REASON_PAUSE		40
+#define EXIT_REASON_MCE_DURING_ENTRY	41
+#define EXIT_REASON_TPR			43
+#define EXIT_REASON_APIC_ACCESS		44
+#define	EXIT_REASON_VIRTUALIZED_EOI	45
+#define EXIT_REASON_GDTR_IDTR		46
+#define EXIT_REASON_LDTR_TR		47
+#define EXIT_REASON_EPT_FAULT		48
+#define EXIT_REASON_EPT_MISCONFIG	49
+#define EXIT_REASON_INVEPT		50
+#define EXIT_REASON_RDTSCP		51
+#define EXIT_REASON_VMX_PREEMPT		52
+#define EXIT_REASON_INVVPID		53
+#define EXIT_REASON_WBINVD		54
+#define EXIT_REASON_XSETBV		55
+#define	EXIT_REASON_APIC_WRITE		56
+
+/*
+ * NMI unblocking due to IRET.
+ *
+ * Applies to VM-exits due to hardware exception or EPT fault.
+ */
+#define	EXIT_QUAL_NMIUDTI	(1 << 12)
+/*
+ * VMCS interrupt information fields
+ */
+#define	VMCS_INTR_VALID		(1U << 31)
+#define	VMCS_INTR_T_MASK	0x700		/* Interruption-info type */
+#define	VMCS_INTR_T_HWINTR	(0 << 8)
+#define	VMCS_INTR_T_NMI		(2 << 8)
+#define	VMCS_INTR_T_HWEXCEPTION	(3 << 8)
+#define	VMCS_INTR_T_SWINTR	(4 << 8)
+#define	VMCS_INTR_T_PRIV_SWEXCEPTION (5 << 8)
+#define	VMCS_INTR_T_SWEXCEPTION	(6 << 8)
+#define	VMCS_INTR_DEL_ERRCODE	(1 << 11)
+
+/*
+ * VMCS IDT-Vectoring information fields
+ */
+#define	VMCS_IDT_VEC_VALID          (1U << 31)
+#define	VMCS_IDT_VEC_TYPE           0x700
+#define	VMCS_IDT_VEC_ERRCODE_VALID	(1U << 11)
+#define	VMCS_IDT_VEC_HWINTR         (0 << 8)
+#define	VMCS_IDT_VEC_NMI            (2 << 8)
+#define	VMCS_IDT_VEC_HWEXCEPTION	(3 << 8)
+#define	VMCS_IDT_VEC_SWINTR         (4 << 8)
+
+/*
+ * VMCS Guest interruptibility field
+ */
+#define	VMCS_INTERRUPTIBILITY_STI_BLOCKING	(1 << 0)
+#define	VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING	(1 << 1)
+#define	VMCS_INTERRUPTIBILITY_SMI_BLOCKING	(1 << 2)
+#define	VMCS_INTERRUPTIBILITY_NMI_BLOCKING	(1 << 3)
+
+/*
+ * Exit qualification for EXIT_REASON_INVAL_VMCS
+ */
+#define	EXIT_QUAL_NMI_WHILE_STI_BLOCKING	3
+
+/*
+ * Exit qualification for EPT violation
+ */
+#define	EPT_VIOLATION_DATA_READ		(1UL << 0)
+#define	EPT_VIOLATION_DATA_WRITE	(1UL << 1)
+#define	EPT_VIOLATION_INST_FETCH	(1UL << 2)
+#define	EPT_VIOLATION_GPA_READABLE	(1UL << 3)
+#define	EPT_VIOLATION_GPA_WRITEABLE	(1UL << 4)
+#define	EPT_VIOLATION_GPA_EXECUTABLE	(1UL << 5)
+#define	EPT_VIOLATION_GLA_VALID		(1UL << 7)
+#define	EPT_VIOLATION_XLAT_VALID	(1UL << 8)
+
+/*
+ * Exit qualification for APIC-access VM exit
+ */
+#define	APIC_ACCESS_OFFSET(qual)	((qual) & 0xFFF)
+#define	APIC_ACCESS_TYPE(qual)		(((qual) >> 12) & 0xF)
+
+/*
+ * Exit qualification for APIC-write VM exit
+ */
+#define	APIC_WRITE_OFFSET(qual)		((qual) & 0xFFF)
+
+
+#define VMCS_PRI_PROC_BASED_CTLS_INT_WINDOW_EXITING    (1 << 2)
+#define VMCS_PRI_PROC_BASED_CTLS_TSC_OFFSET    (1 << 3)
+#define VMCS_PRI_PROC_BASED_CTLS_HLT           (1 << 7)
+#define VMCS_PRI_PROC_BASED_CTLS_MWAIT         (1 << 10)
+#define VMCS_PRI_PROC_BASED_CTLS_TSC           (1 << 12)
+#define VMCS_PRI_PROC_BASED_CTLS_CR8_LOAD      (1 << 19)
+#define VMCS_PRI_PROC_BASED_CTLS_CR8_STORE     (1 << 20)
+#define VMCS_PRI_PROC_BASED_CTLS_TPR_SHADOW    (1 << 21)
+#define VMCS_PRI_PROC_BASED_CTLS_NMI_WINDOW_EXITING    (1 << 22)
+#define VMCS_PRI_PROC_BASED_CTLS_SEC_CONTROL   (1 << 31)
+
+#define VMCS_PRI_PROC_BASED2_CTLS_APIC_ACCESSES (1 << 0)
+#define VMCS_PRI_PROC_BASED2_CTLS_X2APIC        (1 << 4)
+
+enum task_switch_reason {
+	TSR_CALL,
+	TSR_IRET,
+    TSR_JMP,
+	TSR_IDT_GATE,	/* task gate in IDT */
+};
+
+#endif

target/i386/hvf-utils/vmx.h new file +200 -0

new file mode 100644
index 0000000000..8a080e6777
@@ -0,0 +1,200 @@
+/*
+ * Copyright (C) 2016 Veertu Inc,
+ * Copyright (C) 2017 Google Inc,
+ * Based on Veertu vddh/vmm/vmx.h
+ *
+ * Interfaces to Hypervisor.framework to read/write X86 registers and VMCS.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef VMX_H
+#define VMX_H
+
+#include <stdint.h>
+#include <Hypervisor/hv.h>
+#include <Hypervisor/hv_vmx.h>
+#include "vmcs.h"
+#include "cpu.h"
+#include "x86.h"
+
+#include "exec/address-spaces.h"
+
+static uint64_t inline rreg(hv_vcpuid_t vcpu, hv_x86_reg_t reg)
+{
+	uint64_t v;
+
+	if (hv_vcpu_read_register(vcpu, reg, &v)) {
+		abort();
+	}
+
+	return v;
+}
+
+/* write GPR */
+static void inline wreg(hv_vcpuid_t vcpu, hv_x86_reg_t reg, uint64_t v)
+{
+	if (hv_vcpu_write_register(vcpu, reg, v)) {
+		abort();
+	}
+}
+
+/* read VMCS field */
+static uint64_t inline rvmcs(hv_vcpuid_t vcpu, uint32_t field)
+{
+	uint64_t v;
+
+	hv_vmx_vcpu_read_vmcs(vcpu, field, &v);
+
+	return v;
+}
+
+/* write VMCS field */
+static void inline wvmcs(hv_vcpuid_t vcpu, uint32_t field, uint64_t v)
+{
+	hv_vmx_vcpu_write_vmcs(vcpu, field, v);
+}
+
+/* desired control word constrained by hardware/hypervisor capabilities */
+static uint64_t inline cap2ctrl(uint64_t cap, uint64_t ctrl)
+{
+	return (ctrl | (cap & 0xffffffff)) & (cap >> 32);
+}
+
+#define VM_ENTRY_GUEST_LMA (1LL << 9)
+
+#define AR_TYPE_ACCESSES_MASK 1
+#define AR_TYPE_READABLE_MASK (1 << 1)
+#define AR_TYPE_WRITEABLE_MASK (1 << 2)
+#define AR_TYPE_CODE_MASK (1 << 3)
+#define AR_TYPE_MASK 0x0f
+#define AR_TYPE_BUSY_64_TSS 11
+#define AR_TYPE_BUSY_32_TSS 11
+#define AR_TYPE_BUSY_16_TSS 3
+#define AR_TYPE_LDT 2
+
+static void enter_long_mode(hv_vcpuid_t vcpu, uint64_t cr0, uint64_t efer)
+{
+    uint64_t entry_ctls;
+
+    efer |= EFER_LMA;
+    wvmcs(vcpu, VMCS_GUEST_IA32_EFER, efer);
+    entry_ctls = rvmcs(vcpu, VMCS_ENTRY_CTLS);
+    wvmcs(vcpu, VMCS_ENTRY_CTLS, rvmcs(vcpu, VMCS_ENTRY_CTLS) | VM_ENTRY_GUEST_LMA);
+
+    uint64_t guest_tr_ar = rvmcs(vcpu, VMCS_GUEST_TR_ACCESS_RIGHTS);
+    if ((efer & EFER_LME) && (guest_tr_ar & AR_TYPE_MASK) != AR_TYPE_BUSY_64_TSS) {
+        wvmcs(vcpu, VMCS_GUEST_TR_ACCESS_RIGHTS, (guest_tr_ar & ~AR_TYPE_MASK) | AR_TYPE_BUSY_64_TSS);
+    }
+}
+
+static void exit_long_mode(hv_vcpuid_t vcpu, uint64_t cr0, uint64_t efer)
+{
+    uint64_t entry_ctls;
+
+    entry_ctls = rvmcs(vcpu, VMCS_ENTRY_CTLS);
+    wvmcs(vcpu, VMCS_ENTRY_CTLS, entry_ctls & ~VM_ENTRY_GUEST_LMA);
+
+    efer &= ~EFER_LMA;
+    wvmcs(vcpu, VMCS_GUEST_IA32_EFER, efer);
+}
+
+static void inline macvm_set_cr0(hv_vcpuid_t vcpu, uint64_t cr0)
+{
+    int i;
+    uint64_t pdpte[4] = {0, 0, 0, 0};
+    uint64_t efer = rvmcs(vcpu, VMCS_GUEST_IA32_EFER);
+    uint64_t old_cr0 = rvmcs(vcpu, VMCS_GUEST_CR0);
+
+    if ((cr0 & CR0_PG) && (rvmcs(vcpu, VMCS_GUEST_CR4) & CR4_PAE) && !(efer & EFER_LME))
+        address_space_rw(&address_space_memory, rvmcs(vcpu, VMCS_GUEST_CR3) & ~0x1f,
+                         MEMTXATTRS_UNSPECIFIED,
+                         (uint8_t *)pdpte, 32, 0);
+
+    for (i = 0; i < 4; i++)
+        wvmcs(vcpu, VMCS_GUEST_PDPTE0 + i * 2, pdpte[i]);
+
+    wvmcs(vcpu, VMCS_CR0_MASK, CR0_CD | CR0_NE | CR0_PG);
+    wvmcs(vcpu, VMCS_CR0_SHADOW, cr0);
+
+    cr0 &= ~CR0_CD;
+    wvmcs(vcpu, VMCS_GUEST_CR0, cr0 | CR0_NE| CR0_ET);
+
+    if (efer & EFER_LME) {
+        if (!(old_cr0 & CR0_PG) && (cr0 & CR0_PG))
+             enter_long_mode(vcpu, cr0, efer);
+        if (/*(old_cr0 & CR0_PG) &&*/ !(cr0 & CR0_PG))
+            exit_long_mode(vcpu, cr0, efer);
+    }
+
+    hv_vcpu_invalidate_tlb(vcpu);
+    hv_vcpu_flush(vcpu);
+}
+
+static void inline macvm_set_cr4(hv_vcpuid_t vcpu, uint64_t cr4)
+{
+    uint64_t guest_cr4 = cr4 | CR4_VMXE;
+
+    wvmcs(vcpu, VMCS_GUEST_CR4, guest_cr4);
+    wvmcs(vcpu, VMCS_CR4_SHADOW, cr4);
+
+    hv_vcpu_invalidate_tlb(vcpu);
+    hv_vcpu_flush(vcpu);
+}
+
+static void inline macvm_set_rip(CPUState *cpu, uint64_t rip)
+{
+    uint64_t val;
+
+    /* BUG, should take considering overlap.. */
+    wreg(cpu->hvf_fd, HV_X86_RIP, rip);
+
+    /* after moving forward in rip, we need to clean INTERRUPTABILITY */
+   val = rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY);
+   if (val & (VMCS_INTERRUPTIBILITY_STI_BLOCKING | VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING))
+        wvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY,
+              val & ~(VMCS_INTERRUPTIBILITY_STI_BLOCKING | VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING));
+}
+
+static void inline vmx_clear_nmi_blocking(CPUState *cpu)
+{
+    uint32_t gi = (uint32_t) rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY);
+    gi &= ~VMCS_INTERRUPTIBILITY_NMI_BLOCKING;
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY, gi);
+}
+
+static void inline vmx_set_nmi_blocking(CPUState *cpu)
+{
+    uint32_t gi = (uint32_t)rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY);
+    gi |= VMCS_INTERRUPTIBILITY_NMI_BLOCKING;
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY, gi);
+}
+
+static void inline vmx_set_nmi_window_exiting(CPUState *cpu)
+{
+    uint64_t val;
+    val = rvmcs(cpu->hvf_fd, VMCS_PRI_PROC_BASED_CTLS);
+    wvmcs(cpu->hvf_fd, VMCS_PRI_PROC_BASED_CTLS, val | VMCS_PRI_PROC_BASED_CTLS_NMI_WINDOW_EXITING);
+
+}
+
+static void inline vmx_clear_nmi_window_exiting(CPUState *cpu)
+{
+
+    uint64_t val;
+    val = rvmcs(cpu->hvf_fd, VMCS_PRI_PROC_BASED_CTLS);
+    wvmcs(cpu->hvf_fd, VMCS_PRI_PROC_BASED_CTLS, val & ~VMCS_PRI_PROC_BASED_CTLS_NMI_WINDOW_EXITING);
+}
+
+#endif

target/i386/hvf-utils/x86.c new file +174 -0

new file mode 100644
index 0000000000..e3db2c9c8b
@@ -0,0 +1,174 @@
+/*
+ * Copyright (C) 2016 Veertu Inc,
+ * Copyright (C) 2017 Google Inc,
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+
+#include "qemu-common.h"
+#include "x86_decode.h"
+#include "x86_emu.h"
+#include "vmcs.h"
+#include "vmx.h"
+#include "x86_mmu.h"
+#include "x86_descr.h"
+
+static uint32_t x86_segment_access_rights(struct x86_segment_descriptor *var)
+{
+    uint32_t ar;
+
+    if (!var->p) {
+        ar = 1 << 16;
+        return ar;
+    }
+
+    ar = var->type & 15;
+    ar |= (var->s & 1) << 4;
+    ar |= (var->dpl & 3) << 5;
+    ar |= (var->p & 1) << 7;
+    ar |= (var->avl & 1) << 12;
+    ar |= (var->l & 1) << 13;
+    ar |= (var->db & 1) << 14;
+    ar |= (var->g & 1) << 15;
+    return ar;
+}
+
+bool x86_read_segment_descriptor(struct CPUState *cpu, struct x86_segment_descriptor *desc, x68_segment_selector sel)
+{
+    addr_t base;
+    uint32_t limit;
+
+    ZERO_INIT(*desc);
+    // valid gdt descriptors start from index 1
+    if (!sel.index && GDT_SEL == sel.ti)
+        return false;
+
+    if (GDT_SEL == sel.ti) {
+        base  = rvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_BASE);
+        limit = rvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_LIMIT);
+    } else {
+        base  = rvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_BASE);
+        limit = rvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_LIMIT);
+    }
+
+    if (sel.index * 8 >= limit)
+        return false;
+
+    vmx_read_mem(cpu, desc, base + sel.index * 8, sizeof(*desc));
+    return true;
+}
+
+bool x86_write_segment_descriptor(struct CPUState *cpu, struct x86_segment_descriptor *desc, x68_segment_selector sel)
+{
+    addr_t base;
+    uint32_t limit;
+    
+    if (GDT_SEL == sel.ti) {
+        base  = rvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_BASE);
+        limit = rvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_LIMIT);
+    } else {
+        base  = rvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_BASE);
+        limit = rvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_LIMIT);
+    }
+    
+    if (sel.index * 8 >= limit) {
+        printf("%s: gdt limit\n", __FUNCTION__);
+        return false;
+    }
+    vmx_write_mem(cpu, base + sel.index * 8, desc, sizeof(*desc));
+    return true;
+}
+
+bool x86_read_call_gate(struct CPUState *cpu, struct x86_call_gate *idt_desc, int gate)
+{
+    addr_t base  = rvmcs(cpu->hvf_fd, VMCS_GUEST_IDTR_BASE);
+    uint32_t limit = rvmcs(cpu->hvf_fd, VMCS_GUEST_IDTR_LIMIT);
+
+    ZERO_INIT(*idt_desc);
+    if (gate * 8 >= limit) {
+        printf("%s: idt limit\n", __FUNCTION__);
+        return false;
+    }
+
+    vmx_read_mem(cpu, idt_desc, base + gate * 8, sizeof(*idt_desc));
+    return true;
+}
+
+bool x86_is_protected(struct CPUState *cpu)
+{
+    uint64_t cr0 = rvmcs(cpu->hvf_fd, VMCS_GUEST_CR0);
+    return cr0 & CR0_PE;
+}
+
+bool x86_is_real(struct CPUState *cpu)
+{
+    return !x86_is_protected(cpu);
+}
+
+bool x86_is_v8086(struct CPUState *cpu)
+{
+    return (x86_is_protected(cpu) && (RFLAGS(cpu) & RFLAGS_VM));
+}
+
+bool x86_is_long_mode(struct CPUState *cpu)
+{
+    return rvmcs(cpu->hvf_fd, VMCS_GUEST_IA32_EFER) & EFER_LMA;
+}
+
+bool x86_is_long64_mode(struct CPUState *cpu)
+{
+    struct vmx_segment desc;
+    vmx_read_segment_descriptor(cpu, &desc, REG_SEG_CS);
+
+    return x86_is_long_mode(cpu) && ((desc.ar >> 13) & 1);
+}
+
+bool x86_is_paging_mode(struct CPUState *cpu)
+{
+    uint64_t cr0 = rvmcs(cpu->hvf_fd, VMCS_GUEST_CR0);
+    return cr0 & CR0_PG;
+}
+
+bool x86_is_pae_enabled(struct CPUState *cpu)
+{
+    uint64_t cr4 = rvmcs(cpu->hvf_fd, VMCS_GUEST_CR4);
+    return cr4 & CR4_PAE;
+}
+
+addr_t linear_addr(struct CPUState *cpu, addr_t addr, x86_reg_segment seg)
+{
+    return vmx_read_segment_base(cpu, seg) + addr;
+}
+
+addr_t linear_addr_size(struct CPUState *cpu, addr_t addr, int size, x86_reg_segment seg)
+{
+    switch (size) {
+        case 2:
+            addr = (uint16_t)addr;
+            break;
+        case 4:
+            addr = (uint32_t)addr;
+            break;
+        default:
+            break;
+    }
+    return linear_addr(cpu, addr, seg);
+}
+
+addr_t linear_rip(struct CPUState *cpu, addr_t rip)
+{
+    return linear_addr(cpu, rip, REG_SEG_CS);
+}

target/i386/hvf-utils/x86.h new file +470 -0

new file mode 100644
index 0000000000..5dffdd6568
@@ -0,0 +1,470 @@
+/*
+ * Copyright (C) 2016 Veertu Inc,
+ * Copyright (C) 2017 Veertu Inc,
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#pragma once
+
+#include <sys/types.h>
+#include <sys/ioctl.h>
+#include <sys/mman.h>
+#include <stdarg.h>
+#include "qemu-common.h"
+#include "x86_flags.h"
+
+// exceptions
+typedef enum x86_exception {
+    EXCEPTION_DE,           // divide error
+    EXCEPTION_DB,           // debug fault
+    EXCEPTION_NMI,          // non-maskable interrupt
+    EXCEPTION_BP,           // breakpoint	trap
+    EXCEPTION_OF,           // overflow	trap
+    EXCEPTION_BR,           // boundary range exceeded	fault
+    EXCEPTION_UD,           // undefined opcode
+    EXCEPTION_NM,           // device not available
+    EXCEPTION_DF,           // double fault
+    EXCEPTION_RSVD,         // not defined
+    EXCEPTION_TS,           // invalid TSS	fault
+    EXCEPTION_NP,           // not present	fault
+    EXCEPTION_GP,           // general protection	fault
+    EXCEPTION_PF,           // page fault
+    EXCEPTION_RSVD2,        // not defined
+} x86_exception;
+
+// general purpose regs
+typedef enum x86_reg_name {
+    REG_RAX = 0,
+    REG_RCX = 1,
+    REG_RDX = 2,
+    REG_RBX = 3,
+    REG_RSP = 4,
+    REG_RBP = 5,
+    REG_RSI = 6,
+    REG_RDI = 7,
+    REG_R8 = 8,
+    REG_R9 = 9,
+    REG_R10 = 10,
+    REG_R11 = 11,
+    REG_R12 = 12,
+    REG_R13 = 13,
+    REG_R14 = 14,
+    REG_R15 = 15,
+} x86_reg_name;
+
+// segment regs
+typedef enum x86_reg_segment {
+    REG_SEG_ES = 0,
+    REG_SEG_CS = 1,
+    REG_SEG_SS = 2,
+    REG_SEG_DS = 3,
+    REG_SEG_FS = 4,
+    REG_SEG_GS = 5,
+    REG_SEG_LDTR = 6,
+    REG_SEG_TR = 7,
+} x86_reg_segment;
+
+typedef struct x86_register
+{
+    union {
+        struct {
+            uint64_t rrx;               // full 64 bit
+        };
+        struct {
+            uint32_t erx;               // low 32 bit part
+            uint32_t hi32_unused1;
+        };
+        struct {
+            uint16_t rx;                // low 16 bit part
+            uint16_t hi16_unused1;
+            uint32_t hi32_unused2;
+        };
+        struct {
+            uint8_t lx;                 // low 8 bit part
+            uint8_t hx;                 // high 8 bit
+            uint16_t hi16_unused2;
+            uint32_t hi32_unused3;
+        };
+    };
+} __attribute__ ((__packed__)) x86_register;
+
+typedef enum x86_rflags {
+    RFLAGS_CF       = (1L << 0),
+    RFLAGS_PF       = (1L << 2),
+    RFLAGS_AF       = (1L << 4),
+    RFLAGS_ZF       = (1L << 6),
+    RFLAGS_SF       = (1L << 7),
+    RFLAGS_TF       = (1L << 8),
+    RFLAGS_IF       = (1L << 9),
+    RFLAGS_DF       = (1L << 10),
+    RFLAGS_OF       = (1L << 11),
+    RFLAGS_IOPL     = (3L << 12),
+    RFLAGS_NT       = (1L << 14),
+    RFLAGS_RF       = (1L << 16),
+    RFLAGS_VM       = (1L << 17),
+    RFLAGS_AC       = (1L << 18),
+    RFLAGS_VIF      = (1L << 19),
+    RFLAGS_VIP      = (1L << 20),
+    RFLAGS_ID       = (1L << 21),
+} x86_rflags;
+
+// rflags register
+typedef struct x86_reg_flags {
+    union {
+        struct {
+            uint64_t rflags;
+        };
+        struct {
+            uint32_t eflags;
+            uint32_t hi32_unused1;
+        };
+        struct {
+            uint32_t cf:1;
+            uint32_t unused1:1;
+            uint32_t pf:1;
+            uint32_t unused2:1;
+            uint32_t af:1;
+            uint32_t unused3:1;
+            uint32_t zf:1;
+            uint32_t sf:1;
+            uint32_t tf:1;
+            uint32_t ief:1;
+            uint32_t df:1;
+            uint32_t of:1;
+            uint32_t iopl:2;
+            uint32_t nt:1;
+            uint32_t unused4:1;
+            uint32_t rf:1;
+            uint32_t vm:1;
+            uint32_t ac:1;
+            uint32_t vif:1;
+            uint32_t vip:1;
+            uint32_t id:1;
+            uint32_t unused5:10;
+            uint32_t hi32_unused2;
+        };
+    };
+} __attribute__ ((__packed__)) x86_reg_flags;
+
+typedef enum x86_reg_efer {
+    EFER_SCE =          (1L << 0),
+    EFER_LME =          (1L << 8),
+    EFER_LMA =          (1L << 10),
+    EFER_NXE =          (1L << 11),
+    EFER_SVME =         (1L << 12),
+    EFER_FXSR =         (1L << 14),
+} x86_reg_efer;
+
+typedef struct x86_efer {
+    uint64_t efer;
+} __attribute__ ((__packed__)) x86_efer;
+
+typedef enum x86_reg_cr0 {
+    CR0_PE =            (1L << 0),
+    CR0_MP =            (1L << 1),
+    CR0_EM =            (1L << 2),
+    CR0_TS =            (1L << 3),
+    CR0_ET =            (1L << 4),
+    CR0_NE =            (1L << 5),
+    CR0_WP =            (1L << 16),
+    CR0_AM =            (1L << 18),
+    CR0_NW =            (1L << 29),
+    CR0_CD =            (1L << 30),
+    CR0_PG =            (1L << 31),
+} x86_reg_cr0;
+
+typedef enum x86_reg_cr4 {
+    CR4_VME =            (1L << 0),
+    CR4_PVI =            (1L << 1),
+    CR4_TSD =            (1L << 2),
+    CR4_DE  =            (1L << 3),
+    CR4_PSE =            (1L << 4),
+    CR4_PAE =            (1L << 5),
+    CR4_MSE =            (1L << 6),
+    CR4_PGE =            (1L << 7),
+    CR4_PCE =            (1L << 8),
+    CR4_OSFXSR =         (1L << 9),
+    CR4_OSXMMEXCPT =     (1L << 10),
+    CR4_VMXE =           (1L << 13),
+    CR4_SMXE =           (1L << 14),
+    CR4_FSGSBASE =       (1L << 16),
+    CR4_PCIDE =          (1L << 17),
+    CR4_OSXSAVE =        (1L << 18),
+    CR4_SMEP =           (1L << 20),
+} x86_reg_cr4;
+
+// 16 bit Task State Segment
+typedef struct x86_tss_segment16 {
+    uint16_t link;
+    uint16_t sp0;
+    uint16_t ss0;
+    uint32_t sp1;
+    uint16_t ss1;
+    uint32_t sp2;
+    uint16_t ss2;
+    uint16_t ip;
+    uint16_t flags;
+    uint16_t ax;
+    uint16_t cx;
+    uint16_t dx;
+    uint16_t bx;
+    uint16_t sp;
+    uint16_t bp;
+    uint16_t si;
+    uint16_t di;
+    uint16_t es;
+    uint16_t cs;
+    uint16_t ss;
+    uint16_t ds;
+    uint16_t ldtr;
+} __attribute__((packed)) x86_tss_segment16;
+
+// 32 bit Task State Segment
+typedef struct x86_tss_segment32
+{
+    uint32_t prev_tss;
+    uint32_t esp0;
+    uint32_t ss0;
+    uint32_t esp1;
+    uint32_t ss1;
+    uint32_t esp2;
+    uint32_t ss2;
+    uint32_t cr3;
+    uint32_t eip;
+    uint32_t eflags;
+    uint32_t eax;
+    uint32_t ecx;
+    uint32_t edx;
+    uint32_t ebx;
+    uint32_t esp;
+    uint32_t ebp;
+    uint32_t esi;
+    uint32_t edi;
+    uint32_t es;
+    uint32_t cs;
+    uint32_t ss;
+    uint32_t ds;
+    uint32_t fs;
+    uint32_t gs;
+    uint32_t ldt;
+    uint16_t trap;
+    uint16_t iomap_base;
+} __attribute__ ((__packed__)) x86_tss_segment32;
+
+// 64 bit Task State Segment
+typedef struct x86_tss_segment64
+{
+    uint32_t unused;
+    uint64_t rsp0;
+    uint64_t rsp1;
+    uint64_t rsp2;
+    uint64_t unused1;
+    uint64_t ist1;
+    uint64_t ist2;
+    uint64_t ist3;
+    uint64_t ist4;
+    uint64_t ist5;
+    uint64_t ist6;
+    uint64_t ist7;
+    uint64_t unused2;
+    uint16_t unused3;
+    uint16_t iomap_base;
+} __attribute__ ((__packed__)) x86_tss_segment64;
+
+// segment descriptors
+typedef struct x86_segment_descriptor {
+    uint64_t    limit0:16;
+    uint64_t    base0:16;
+    uint64_t    base1:8;
+    uint64_t    type:4;
+    uint64_t    s:1;
+    uint64_t    dpl:2;
+    uint64_t    p:1;
+    uint64_t    limit1:4;
+    uint64_t    avl:1;
+    uint64_t    l:1;
+    uint64_t    db:1;
+    uint64_t    g:1;
+    uint64_t    base2:8;
+} __attribute__ ((__packed__)) x86_segment_descriptor;
+
+static inline uint32_t x86_segment_base(x86_segment_descriptor *desc)
+{
+    return (uint32_t)((desc->base2 << 24) | (desc->base1 << 16) | desc->base0);
+}
+
+static inline void x86_set_segment_base(x86_segment_descriptor *desc, uint32_t base)
+{
+    desc->base2 = base >> 24;
+    desc->base1 = (base >> 16) & 0xff;
+    desc->base0 = base & 0xffff;
+}
+
+static inline uint32_t x86_segment_limit(x86_segment_descriptor *desc)
+{
+    uint32_t limit = (uint32_t)((desc->limit1 << 16) | desc->limit0);
+    if (desc->g)
+        return (limit << 12) | 0xfff;
+    return limit;
+}
+
+static inline void x86_set_segment_limit(x86_segment_descriptor *desc, uint32_t limit)
+{
+    desc->limit0 = limit & 0xffff;
+    desc->limit1 = limit >> 16;
+}
+
+typedef struct x86_call_gate {
+    uint64_t offset0:16;
+    uint64_t selector:16;
+    uint64_t param_count:4;
+    uint64_t reserved:3;
+    uint64_t type:4;
+    uint64_t dpl:1;
+    uint64_t p:1;
+    uint64_t offset1:16;
+} __attribute__ ((__packed__)) x86_call_gate;
+
+static inline uint32_t x86_call_gate_offset(x86_call_gate *gate)
+{
+    return (uint32_t)((gate->offset1 << 16) | gate->offset0);
+}
+
+#define LDT_SEL     0
+#define GDT_SEL     1
+
+typedef struct x68_segment_selector {
+    union {
+        uint16_t sel;
+        struct {
+            uint16_t rpl:3;
+            uint16_t ti:1;
+            uint16_t index:12;
+        };
+    };
+} __attribute__ ((__packed__)) x68_segment_selector;
+
+// Definition of hvf_x86_state is here
+struct hvf_x86_state {
+    int hlt;
+    uint64_t init_tsc;
+    
+    int interruptable;
+    uint64_t exp_rip;
+    uint64_t fetch_rip;
+    uint64_t rip;
+    struct x86_register regs[16];
+    struct x86_reg_flags   rflags;
+    struct lazy_flags   lflags;
+    struct x86_efer efer;
+    uint8_t mmio_buf[4096];
+    uint8_t* apic_page;
+};
+
+/*
+* hvf xsave area
+*/
+struct hvf_xsave_buf {
+    uint32_t data[1024];
+};
+
+// useful register access  macros
+#define RIP(cpu)    (cpu->hvf_x86->rip)
+#define EIP(cpu)    ((uint32_t)cpu->hvf_x86->rip)
+#define RFLAGS(cpu) (cpu->hvf_x86->rflags.rflags)
+#define EFLAGS(cpu) (cpu->hvf_x86->rflags.eflags)
+
+#define RRX(cpu, reg) (cpu->hvf_x86->regs[reg].rrx)
+#define RAX(cpu)        RRX(cpu, REG_RAX)
+#define RCX(cpu)        RRX(cpu, REG_RCX)
+#define RDX(cpu)        RRX(cpu, REG_RDX)
+#define RBX(cpu)        RRX(cpu, REG_RBX)
+#define RSP(cpu)        RRX(cpu, REG_RSP)
+#define RBP(cpu)        RRX(cpu, REG_RBP)
+#define RSI(cpu)        RRX(cpu, REG_RSI)
+#define RDI(cpu)        RRX(cpu, REG_RDI)
+#define R8(cpu)         RRX(cpu, REG_R8)
+#define R9(cpu)         RRX(cpu, REG_R9)
+#define R10(cpu)        RRX(cpu, REG_R10)
+#define R11(cpu)        RRX(cpu, REG_R11)
+#define R12(cpu)        RRX(cpu, REG_R12)
+#define R13(cpu)        RRX(cpu, REG_R13)
+#define R14(cpu)        RRX(cpu, REG_R14)
+#define R15(cpu)        RRX(cpu, REG_R15)
+
+#define ERX(cpu, reg)   (cpu->hvf_x86->regs[reg].erx)
+#define EAX(cpu)        ERX(cpu, REG_RAX)
+#define ECX(cpu)        ERX(cpu, REG_RCX)
+#define EDX(cpu)        ERX(cpu, REG_RDX)
+#define EBX(cpu)        ERX(cpu, REG_RBX)
+#define ESP(cpu)        ERX(cpu, REG_RSP)
+#define EBP(cpu)        ERX(cpu, REG_RBP)
+#define ESI(cpu)        ERX(cpu, REG_RSI)
+#define EDI(cpu)        ERX(cpu, REG_RDI)
+
+#define RX(cpu, reg)   (cpu->hvf_x86->regs[reg].rx)
+#define AX(cpu)        RX(cpu, REG_RAX)
+#define CX(cpu)        RX(cpu, REG_RCX)
+#define DX(cpu)        RX(cpu, REG_RDX)
+#define BP(cpu)        RX(cpu, REG_RBP)
+#define SP(cpu)        RX(cpu, REG_RSP)
+#define BX(cpu)        RX(cpu, REG_RBX)
+#define SI(cpu)        RX(cpu, REG_RSI)
+#define DI(cpu)        RX(cpu, REG_RDI)
+
+#define RL(cpu, reg)   (cpu->hvf_x86->regs[reg].lx)
+#define AL(cpu)        RL(cpu, REG_RAX)
+#define CL(cpu)        RL(cpu, REG_RCX)
+#define DL(cpu)        RL(cpu, REG_RDX)
+#define BL(cpu)        RL(cpu, REG_RBX)
+
+#define RH(cpu, reg)   (cpu->hvf_x86->regs[reg].hx)
+#define AH(cpu)        RH(cpu, REG_RAX)
+#define CH(cpu)        RH(cpu, REG_RCX)
+#define DH(cpu)        RH(cpu, REG_RDX)
+#define BH(cpu)        RH(cpu, REG_RBX)
+
+// deal with GDT/LDT descriptors in memory
+bool x86_read_segment_descriptor(struct CPUState *cpu, struct x86_segment_descriptor *desc, x68_segment_selector sel);
+bool x86_write_segment_descriptor(struct CPUState *cpu, struct x86_segment_descriptor *desc, x68_segment_selector sel);
+
+bool x86_read_call_gate(struct CPUState *cpu, struct x86_call_gate *idt_desc, int gate);
+
+// helpers
+bool x86_is_protected(struct CPUState *cpu);
+bool x86_is_real(struct CPUState *cpu);
+bool x86_is_v8086(struct CPUState *cpu);
+bool x86_is_long_mode(struct CPUState *cpu);
+bool x86_is_long64_mode(struct CPUState *cpu);
+bool x86_is_paging_mode(struct CPUState *cpu);
+bool x86_is_pae_enabled(struct CPUState *cpu);
+
+addr_t linear_addr(struct CPUState *cpu, addr_t addr, x86_reg_segment seg);
+addr_t linear_addr_size(struct CPUState *cpu, addr_t addr, int size, x86_reg_segment seg);
+addr_t linear_rip(struct CPUState *cpu, addr_t rip);
+
+static inline uint64_t rdtscp(void)
+{
+    uint64_t tsc;
+    __asm__ __volatile__("rdtscp; "         // serializing read of tsc
+                         "shl $32,%%rdx; "  // shift higher 32 bits stored in rdx up
+                         "or %%rdx,%%rax"   // and or onto rax
+                         : "=a"(tsc)        // output to tsc variable
+                         :
+                         : "%rcx", "%rdx"); // rcx and rdx are clobbered
+    
+    return tsc;
+}
+

target/i386/hvf-utils/x86_cpuid.c new file +270 -0

new file mode 100644
index 0000000000..e496cf001c
@@ -0,0 +1,270 @@
+/*
+ *  i386 CPUID helper functions
+ *
+ *  Copyright (c) 2003 Fabrice Bellard
+ *  Copyright (c) 2017 Google Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ *
+ * cpuid
+ */
+
+#include "qemu/osdep.h"
+#include "x86_cpuid.h"
+#include "x86.h"
+#include "vmx.h"
+
+#define PPRO_FEATURES (CPUID_FP87 | CPUID_DE | CPUID_PSE | CPUID_TSC | \
+    CPUID_MSR | CPUID_MCE | CPUID_CX8 | CPUID_PGE | CPUID_CMOV | \
+    CPUID_PAT | CPUID_FXSR | CPUID_MMX | CPUID_SSE | CPUID_SSE2 | \
+    CPUID_PAE | CPUID_SEP | CPUID_APIC)
+
+struct x86_cpuid builtin_cpus[] = {
+    {
+        .name = "vmx32",
+        .vendor1  = CPUID_VENDOR_INTEL_1,
+        .vendor2  = CPUID_VENDOR_INTEL_2,
+        .vendor3  = CPUID_VENDOR_INTEL_3,
+        .level = 4,
+        .family = 6,
+        .model = 3,
+        .stepping = 3,
+        .features = PPRO_FEATURES,
+        .ext_features = /*CPUID_EXT_SSE3 |*/ CPUID_EXT_POPCNT, CPUID_MTRR | CPUID_CLFLUSH,
+                    CPUID_PSE36,
+        .ext2_features = CPUID_EXT2_LM | CPUID_EXT2_SYSCALL | CPUID_EXT2_NX,
+        .ext3_features = 0,//CPUID_EXT3_LAHF_LM,
+        .xlevel = 0x80000004,
+        .model_id = "vmx32",
+    },
+    {
+        .name = "core2duo",
+        .vendor1  = CPUID_VENDOR_INTEL_1,
+        .vendor2  = CPUID_VENDOR_INTEL_2,
+        .vendor3  = CPUID_VENDOR_INTEL_3,
+        .level = 10,
+        .family = 6,
+        .model = 15,
+        .stepping = 11,
+        .features = PPRO_FEATURES |
+        CPUID_MTRR | CPUID_CLFLUSH | CPUID_MCA |
+        CPUID_PSE36 | CPUID_VME | CPUID_DTS | CPUID_ACPI | CPUID_SS |
+        CPUID_HT | CPUID_TM | CPUID_PBE,
+        .ext_features = CPUID_EXT_SSE3 | CPUID_EXT_SSSE3 | 
+        CPUID_EXT_DTES64 | CPUID_EXT_DSCPL |
+        CPUID_EXT_CX16 | CPUID_EXT_XTPR | CPUID_EXT_PDCM | CPUID_EXT_HYPERVISOR,
+        .ext2_features = CPUID_EXT2_LM | CPUID_EXT2_SYSCALL | CPUID_EXT2_NX,
+        .ext3_features = CPUID_EXT3_LAHF_LM,
+        .xlevel = 0x80000008,
+        .model_id = "Intel(R) Core(TM)2 Duo GETCPU     T7700  @ 2.40GHz",
+    },
+    {
+        .name = "vmX",
+        .vendor1  = CPUID_VENDOR_INTEL_1,
+        .vendor2  = CPUID_VENDOR_INTEL_2,
+        .vendor3  = CPUID_VENDOR_INTEL_3,
+        .level = 0xd,
+        .family = 6,
+        .model = 15,
+        .stepping = 11,
+        .features = PPRO_FEATURES |
+        CPUID_MTRR | CPUID_CLFLUSH | CPUID_MCA |
+        CPUID_PSE36 | CPUID_VME | CPUID_DTS | CPUID_ACPI | CPUID_SS |
+        CPUID_HT | CPUID_TM | CPUID_PBE,
+        .ext_features = CPUID_EXT_SSE3 | CPUID_EXT_SSSE3 |
+        CPUID_EXT_DTES64 | CPUID_EXT_DSCPL |
+        CPUID_EXT_CX16 | CPUID_EXT_XTPR | CPUID_EXT_PDCM | CPUID_EXT_HYPERVISOR,
+        .ext2_features = CPUID_EXT2_LM | CPUID_EXT2_SYSCALL | CPUID_EXT2_NX,
+        .ext3_features = CPUID_EXT3_LAHF_LM,
+        .xlevel = 0x80000008,
+        .model_id = "Common vmX processor",
+    },
+};
+
+static struct x86_cpuid *_cpuid = NULL;
+
+void init_cpuid(struct CPUState* cpu)
+{
+    _cpuid = &builtin_cpus[2]; // core2duo
+}
+
+void get_cpuid_func(struct CPUState* cpu, int func, int cnt, uint32_t *eax, uint32_t *ebx, uint32_t *ecx, uint32_t *edx)
+{
+   uint32_t h_rax, h_rbx, h_rcx, h_rdx;
+   host_cpuid(func, cnt, &h_rax, &h_rbx, &h_rcx, &h_rdx);
+   uint32_t apic_id = X86_CPU(cpu)->apic_id;
+
+
+    *eax = *ebx = *ecx = *edx = 0;
+    switch(func) {
+        case 0:
+            *eax = _cpuid->level;
+            *ebx = _cpuid->vendor1;
+            *edx = _cpuid->vendor2;
+            *ecx = _cpuid->vendor3;
+            break;
+        case 1:
+            *eax = h_rax;//_cpuid->stepping | (_cpuid->model << 3) | (_cpuid->family << 6);
+            *ebx = (apic_id << 24) | (h_rbx & 0x00ffffff);
+            *ecx = h_rcx;
+            *edx = h_rdx;
+
+            if (cpu->nr_cores * cpu->nr_threads > 1) {
+                *ebx |= (cpu->nr_cores * cpu->nr_threads) << 16;
+                *edx |= 1 << 28;    /* Enable Hyper-Threading */
+            }
+
+            *ecx = *ecx & ~(CPUID_EXT_OSXSAVE | CPUID_EXT_MONITOR | CPUID_EXT_X2APIC |
+                        CPUID_EXT_VMX | CPUID_EXT_TSC_DEADLINE_TIMER | CPUID_EXT_TM2 | CPUID_EXT_PCID |
+                        CPUID_EXT_EST | CPUID_EXT_SSE42 | CPUID_EXT_SSE41);
+            *ecx |= CPUID_EXT_HYPERVISOR;
+            break;
+        case 2:
+            /* cache info: needed for Pentium Pro compatibility */
+            *eax = h_rax;
+            *ebx = h_rbx;
+            *ecx = h_rcx;
+            *edx = h_rdx;
+            break;
+        case 4:
+            /* cache info: needed for Core compatibility */
+            *eax = h_rax;
+            *ebx = h_rbx;
+            *ecx = h_rcx;
+            *edx = h_rdx;
+            break;
+        case 5:
+            /* mwait info: needed for Core compatibility */
+            *eax = h_rax;
+            *ebx = h_rbx;
+            *ecx = h_rcx;
+            *edx = h_rdx;
+            break;
+        case 6:
+            /* Thermal and Power Leaf */
+            *eax = 0;
+            *ebx = 0;
+            *ecx = 0;
+            *edx = 0;
+            break;
+        case 7:
+            *eax = h_rax;
+            *ebx = h_rbx & ~(CPUID_7_0_EBX_AVX512F | CPUID_7_0_EBX_AVX512PF | CPUID_7_0_EBX_AVX512ER | CPUID_7_0_EBX_AVX512CD |
+                             CPUID_7_0_EBX_AVX512BW | CPUID_7_0_EBX_AVX512VL | CPUID_7_0_EBX_MPX | CPUID_7_0_EBX_INVPCID);
+            *ecx = h_rcx & ~(CPUID_7_0_ECX_AVX512BMI);
+            *edx = h_rdx;
+            break;
+        case 9:
+            /* Direct Cache Access Information Leaf */
+            *eax = h_rax;
+            *ebx = h_rbx;
+            *ecx = h_rcx;
+            *edx = h_rdx;
+            break;
+        case 0xA:
+            /* Architectural Performance Monitoring Leaf */
+            *eax = 0;
+            *ebx = 0;
+            *ecx = 0;
+            *edx = 0;
+            break;
+        case 0xB:
+            /* CPU Topology Leaf */
+            *eax = 0;
+            *ebx = 0;   /* Means that we don't support this leaf */
+            *ecx = 0;
+            *edx = 0;
+            break;
+        case 0xD:
+            *eax = h_rax;
+            if (!cnt)
+                *eax &= (XSTATE_FP_MASK | XSTATE_SSE_MASK | XSTATE_YMM_MASK);
+            if (1 == cnt)
+                *eax &= (CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC);
+            *ebx = h_rbx;
+            *ecx = h_rcx;
+            *edx = h_rdx;
+            break;
+        case 0x80000000:
+            *eax = _cpuid->xlevel;
+            *ebx = _cpuid->vendor1;
+            *edx = _cpuid->vendor2;
+            *ecx = _cpuid->vendor3;
+            break;
+        case 0x80000001:
+            *eax = h_rax;//_cpuid->stepping | (_cpuid->model << 3) | (_cpuid->family << 6);
+            *ebx = 0;
+            *ecx = _cpuid->ext3_features & h_rcx;
+            *edx = _cpuid->ext2_features & h_rdx;
+            break;
+        case 0x80000002:
+        case 0x80000003:
+        case 0x80000004:
+            *eax = h_rax;
+            *ebx = h_rbx;
+            *ecx = h_rcx;
+            *edx = h_rdx;
+            break;
+        case 0x80000005:
+            /* cache info (L1 cache) */
+            *eax = h_rax;
+            *ebx = h_rbx;
+            *ecx = h_rcx;
+            *edx = h_rdx;
+            break;
+        case 0x80000006:
+            /* cache info (L2 cache) */
+            *eax = h_rax;
+            *ebx = h_rbx;
+            *ecx = h_rcx;
+            *edx = h_rdx;
+            break;
+        case 0x80000007:
+            *eax = 0;
+            *ebx = 0;
+            *ecx = 0;
+            *edx = 0;   /* Note - We disable invariant TSC (bit 8) in purpose */
+            break;
+        case 0x80000008:
+            /* virtual & phys address size in low 2 bytes. */
+            *eax = h_rax;
+            *ebx = 0;
+            *ecx = 0;
+            *edx = 0;
+            break;
+        case 0x8000000A:
+            *eax = 0;
+            *ebx = 0;
+            *ecx = 0;
+            *edx = 0;
+            break;
+        case 0x80000019:
+            *eax = h_rax;
+            *ebx = h_rbx;
+            *ecx = 0;
+            *edx = 0;
+        case 0xC0000000:
+            *eax = _cpuid->xlevel2;
+            *ebx = 0;
+            *ecx = 0;
+            *edx = 0;
+            break;
+        default:
+            *eax = 0;
+            *ebx = 0;
+            *ecx = 0;
+            *edx = 0;
+            break;
+    }
+}

target/i386/hvf-utils/x86_cpuid.h new file +51 -0

new file mode 100644
index 0000000000..02f2f115b0
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2016 Veertu Inc,
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef __CPUID_H__
+#define __CPUID_H__
+
+#include <sys/types.h>
+#include <sys/ioctl.h>
+#include <sys/mman.h>
+#include <stdarg.h>
+#include "qemu-common.h"
+#include "x86_flags.h"
+
+struct x86_cpuid {
+    const char *name;
+    uint32_t level;
+    uint32_t vendor1, vendor2, vendor3;
+    int family;
+    int model;
+    int stepping;
+    int tsc_khz;
+    uint32_t features, ext_features, ext2_features, ext3_features;
+    uint32_t kvm_features, svm_features;
+    uint32_t xlevel;
+    char model_id[48];
+    int vendor_override;
+    uint32_t flags;
+    uint32_t xlevel2;
+    uint32_t cpuid_7_0_ebx_features;
+};
+
+struct CPUState;
+
+void init_cpuid(struct CPUState* cpu);
+void get_cpuid_func(struct CPUState *cpu, int func, int cnt, uint32_t *eax, uint32_t *ebx, uint32_t *ecx, uint32_t *edx);
+
+#endif /* __CPUID_H__ */
+

target/i386/hvf-utils/x86_decode.c new file +1659 -0

new file mode 100644
index 0000000000..b4d8e22449
@@ -0,0 +1,1659 @@
+/*
+ * Copyright (C) 2016 Veertu Inc,
+ * Copyright (C) 2017 Google Inc,
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+
+#include "x86_decode.h"
+#include "string.h"
+#include "vmx.h"
+#include "x86_gen.h"
+#include "x86_mmu.h"
+#include "x86_descr.h"
+
+#define OPCODE_ESCAPE   0xf
+
+static void decode_invalid(CPUState *cpu, struct x86_decode *decode)
+{
+    printf("%llx: failed to decode instruction ", cpu->hvf_x86->fetch_rip - decode->len);
+    for (int i = 0; i < decode->opcode_len; i++)
+        printf("%x ", decode->opcode[i]);
+    printf("\n");
+    VM_PANIC("decoder failed\n");
+}
+
+uint64_t sign(uint64_t val, int size)
+{
+    switch (size) {
+        case 1:
+            val = (int8_t)val;
+            break;
+        case 2:
+            val = (int16_t)val;
+            break;
+        case 4:
+            val = (int32_t)val;
+            break;
+        case 8:
+            val = (int64_t)val;
+            break;
+        default:
+            VM_PANIC_EX("%s invalid size %d\n", __FUNCTION__, size);
+            break;
+    }
+    return val;
+}
+
+static inline uint64_t decode_bytes(CPUState *cpu, struct x86_decode *decode, int size)
+{
+    addr_t val = 0;
+    
+    switch (size) {
+        case 1:
+        case 2:
+        case 4:
+        case 8:
+            break;
+        default:
+            VM_PANIC_EX("%s invalid size %d\n", __FUNCTION__, size);
+            break;
+    }
+    addr_t va  = linear_rip(cpu, RIP(cpu)) + decode->len;
+    vmx_read_mem(cpu, &val, va, size);
+    decode->len += size;
+    
+    return val;
+}
+
+static inline uint8_t decode_byte(CPUState *cpu, struct x86_decode *decode)
+{
+    return (uint8_t)decode_bytes(cpu, decode, 1);
+}
+
+static inline uint16_t decode_word(CPUState *cpu, struct x86_decode *decode)
+{
+    return (uint16_t)decode_bytes(cpu, decode, 2);
+}
+
+static inline uint32_t decode_dword(CPUState *cpu, struct x86_decode *decode)
+{
+    return (uint32_t)decode_bytes(cpu, decode, 4);
+}
+
+static inline uint64_t decode_qword(CPUState *cpu, struct x86_decode *decode)
+{
+    return decode_bytes(cpu, decode, 8);
+}
+
+static void decode_modrm_rm(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    op->type = X86_VAR_RM;
+}
+
+static void decode_modrm_reg(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    op->type = X86_VAR_REG;
+    op->reg = decode->modrm.reg;
+    op->ptr = get_reg_ref(cpu, op->reg, decode->rex.r, decode->operand_size);
+}
+
+static void decode_rax(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    op->type = X86_VAR_REG;
+    op->reg = REG_RAX;
+    op->ptr = get_reg_ref(cpu, op->reg, 0, decode->operand_size);
+}
+
+static inline void decode_immediate(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *var, int size)
+{
+    var->type = X86_VAR_IMMEDIATE;
+    var->size = size;
+    switch (size) {
+        case 1:
+            var->val = decode_byte(cpu, decode);
+            break;
+        case 2:
+            var->val = decode_word(cpu, decode);
+            break;
+        case 4:
+            var->val = decode_dword(cpu, decode);
+            break;
+        case 8:
+            var->val = decode_qword(cpu, decode);
+            break;
+        default:
+            VM_PANIC_EX("bad size %d\n", size);
+    }
+}
+
+static void decode_imm8(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    decode_immediate(cpu, decode, op, 1);
+    op->type = X86_VAR_IMMEDIATE;
+}
+
+static void decode_imm8_signed(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    decode_immediate(cpu, decode, op, 1);
+    op->val = sign(op->val, 1);
+    op->type = X86_VAR_IMMEDIATE;
+}
+
+static void decode_imm16(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    decode_immediate(cpu, decode, op, 2);
+    op->type = X86_VAR_IMMEDIATE;
+}
+
+
+static void decode_imm(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    if (8 == decode->operand_size) {
+        decode_immediate(cpu, decode, op, 4);
+        op->val = sign(op->val, decode->operand_size);
+    } else {
+        decode_immediate(cpu, decode, op, decode->operand_size);
+    }
+    op->type = X86_VAR_IMMEDIATE;
+}
+
+static void decode_imm_signed(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    decode_immediate(cpu, decode, op, decode->operand_size);
+    op->val = sign(op->val, decode->operand_size);
+    op->type = X86_VAR_IMMEDIATE;
+}
+
+static void decode_imm_1(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    op->type = X86_VAR_IMMEDIATE;
+    op->val = 1;
+}
+
+static void decode_imm_0(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    op->type = X86_VAR_IMMEDIATE;
+    op->val = 0;
+}
+
+
+static void decode_pushseg(CPUState *cpu, struct x86_decode *decode)
+{
+    uint8_t op = (decode->opcode_len > 1) ? decode->opcode[1] : decode->opcode[0];
+    
+    decode->op[0].type = X86_VAR_REG;
+    switch (op) {
+        case 0xe:
+            decode->op[0].reg = REG_SEG_CS;
+            break;
+        case 0x16:
+            decode->op[0].reg = REG_SEG_SS;
+            break;
+        case 0x1e:
+            decode->op[0].reg = REG_SEG_DS;
+            break;
+        case 0x06:
+            decode->op[0].reg = REG_SEG_ES;
+            break;
+        case 0xa0:
+            decode->op[0].reg = REG_SEG_FS;
+            break;
+        case 0xa8:
+            decode->op[0].reg = REG_SEG_GS;
+            break;
+    }
+}
+
+static void decode_popseg(CPUState *cpu, struct x86_decode *decode)
+{
+    uint8_t op = (decode->opcode_len > 1) ? decode->opcode[1] : decode->opcode[0];
+    
+    decode->op[0].type = X86_VAR_REG;
+    switch (op) {
+        case 0xf:
+            decode->op[0].reg = REG_SEG_CS;
+            break;
+        case 0x17:
+            decode->op[0].reg = REG_SEG_SS;
+            break;
+        case 0x1f:
+            decode->op[0].reg = REG_SEG_DS;
+            break;
+        case 0x07:
+            decode->op[0].reg = REG_SEG_ES;
+            break;
+        case 0xa1:
+            decode->op[0].reg = REG_SEG_FS;
+            break;
+        case 0xa9:
+            decode->op[0].reg = REG_SEG_GS;
+            break;
+    }
+}
+
+static void decode_incgroup(CPUState *cpu, struct x86_decode *decode)
+{
+    decode->op[0].type = X86_VAR_REG;
+    decode->op[0].reg = decode->opcode[0] - 0x40;
+    decode->op[0].ptr = get_reg_ref(cpu, decode->op[0].reg, decode->rex.b, decode->operand_size);
+}
+
+static void decode_decgroup(CPUState *cpu, struct x86_decode *decode)
+{
+    decode->op[0].type = X86_VAR_REG;
+    decode->op[0].reg = decode->opcode[0] - 0x48;
+    decode->op[0].ptr = get_reg_ref(cpu, decode->op[0].reg, decode->rex.b, decode->operand_size);
+}
+
+static void decode_incgroup2(CPUState *cpu, struct x86_decode *decode)
+{
+    if (!decode->modrm.reg)
+        decode->cmd = X86_DECODE_CMD_INC;
+    else if (1 == decode->modrm.reg)
+        decode->cmd = X86_DECODE_CMD_DEC;
+}
+
+static void decode_pushgroup(CPUState *cpu, struct x86_decode *decode)
+{
+    decode->op[0].type = X86_VAR_REG;
+    decode->op[0].reg = decode->opcode[0] - 0x50;
+    decode->op[0].ptr = get_reg_ref(cpu, decode->op[0].reg, decode->rex.b, decode->operand_size);
+}
+
+static void decode_popgroup(CPUState *cpu, struct x86_decode *decode)
+{
+    decode->op[0].type = X86_VAR_REG;
+    decode->op[0].reg = decode->opcode[0] - 0x58;
+    decode->op[0].ptr = get_reg_ref(cpu, decode->op[0].reg, decode->rex.b, decode->operand_size);
+}
+
+static void decode_jxx(CPUState *cpu, struct x86_decode *decode)
+{
[… more lines in the raw message]

Lines of this file are not shown. View the raw message.

target/i386/hvf-utils/x86_decode.h new file +314 -0

new file mode 100644
index 0000000000..3a22d7d1a5

Lines of this file are not shown. View the raw message.

target/i386/hvf-utils/x86_descr.c new file +124 -0

new file mode 100644
index 0000000000..c3b089aaa8

Lines of this file are not shown. View the raw message.

target/i386/hvf-utils/x86_descr.h new file +40 -0

new file mode 100644
index 0000000000..78fb1bc420

Lines of this file are not shown. View the raw message.

target/i386/hvf-utils/x86_emu.c new file +1466 -0

new file mode 100644
index 0000000000..8b5efc76f0

Lines of this file are not shown. View the raw message.

target/i386/hvf-utils/x86_emu.h new file +16 -0

new file mode 100644
index 0000000000..c56b2798fa

Lines of this file are not shown. View the raw message.

target/i386/hvf-utils/x86_flags.c new file +317 -0

new file mode 100644
index 0000000000..ca876d03dd

Lines of this file are not shown. View the raw message.

target/i386/hvf-utils/x86_flags.h new file +218 -0

new file mode 100644
index 0000000000..f963f8ad1b

Lines of this file are not shown. View the raw message.

target/i386/hvf-utils/x86_gen.h new file +36 -0

new file mode 100644
index 0000000000..770ee80100

Lines of this file are not shown. View the raw message.

target/i386/hvf-utils/x86_mmu.c new file +254 -0

new file mode 100644
index 0000000000..00fae735be

Lines of this file are not shown. View the raw message.

target/i386/hvf-utils/x86_mmu.h new file +28 -0

new file mode 100644
index 0000000000..c31bf28982

Lines of this file are not shown. View the raw message.

target/i386/hvf-utils/x86hvf.c new file +501 -0

new file mode 100644
index 0000000000..d5668df37f

Lines of this file are not shown. View the raw message.

target/i386/hvf-utils/x86hvf.h new file +19 -0

new file mode 100644
index 0000000000..b4cb4c4d26

Lines of this file are not shown. View the raw message.

The rest of this diff is not shown. View the raw message.

Signature · 1 line

2.14.1