diff options
| -rw-r--r-- | cpu-all.h | 1 | ||||
| -rw-r--r-- | cpu-exec.c | 29 | ||||
| -rw-r--r-- | exec.c | 5 | ||||
| -rw-r--r-- | target-i386/cpu.h | 22 | ||||
| -rw-r--r-- | target-i386/exec.h | 10 | ||||
| -rw-r--r-- | target-i386/helper.c | 523 | ||||
| -rw-r--r-- | target-i386/helper2.c | 15 | ||||
| -rw-r--r-- | target-i386/op.c | 88 | ||||
| -rw-r--r-- | target-i386/translate.c | 243 |
9 files changed, 921 insertions, 15 deletions
@@ -716,6 +716,7 @@ extern int code_copy_enabled; #define CPU_INTERRUPT_HALT 0x20 /* CPU halt wanted */ #define CPU_INTERRUPT_SMI 0x40 /* (x86 only) SMI interrupt pending */ #define CPU_INTERRUPT_DEBUG 0x80 /* Debug event occured. */ +#define CPU_INTERRUPT_VIRQ 0x100 /* virtual interrupt pending. */ void cpu_interrupt(CPUState *s, int mask); void cpu_reset_interrupt(CPUState *env, int mask); diff --git a/cpu-exec.c b/cpu-exec.c index 3395059662..58737b3a40 100644 --- a/cpu-exec.c +++ b/cpu-exec.c @@ -163,6 +163,7 @@ static inline TranslationBlock *tb_find_fast(void) #if defined(TARGET_I386) flags = env->hflags; flags |= (env->eflags & (IOPL_MASK | TF_MASK | VM_MASK)); + flags |= env->intercept; cs_base = env->segs[R_CS].base; pc = cs_base + env->eip; #elif defined(TARGET_ARM) @@ -372,7 +373,11 @@ int cpu_exec(CPUState *env1) tmp_T0 = T0; #endif interrupt_request = env->interrupt_request; - if (__builtin_expect(interrupt_request, 0)) { + if (__builtin_expect(interrupt_request, 0) +#if defined(TARGET_I386) + && env->hflags & HF_GIF_MASK +#endif + ) { if (interrupt_request & CPU_INTERRUPT_DEBUG) { env->interrupt_request &= ~CPU_INTERRUPT_DEBUG; env->exception_index = EXCP_DEBUG; @@ -390,6 +395,7 @@ int cpu_exec(CPUState *env1) #if defined(TARGET_I386) if ((interrupt_request & CPU_INTERRUPT_SMI) && !(env->hflags & HF_SMM_MASK)) { + svm_check_intercept(SVM_EXIT_SMI); env->interrupt_request &= ~CPU_INTERRUPT_SMI; do_smm_enter(); #if defined(__sparc__) && !defined(HOST_SOLARIS) @@ -398,9 +404,10 @@ int cpu_exec(CPUState *env1) T0 = 0; #endif } else if ((interrupt_request & CPU_INTERRUPT_HARD) && - (env->eflags & IF_MASK) && + (env->eflags & IF_MASK || env->hflags & HF_HIF_MASK) && !(env->hflags & HF_INHIBIT_IRQ_MASK)) { int intno; + svm_check_intercept(SVM_EXIT_INTR); env->interrupt_request &= ~CPU_INTERRUPT_HARD; intno = cpu_get_pic_interrupt(env); if (loglevel & CPU_LOG_TB_IN_ASM) { @@ -414,6 +421,24 @@ int cpu_exec(CPUState *env1) #else T0 = 0; #endif +#if !defined(CONFIG_USER_ONLY) + } else if ((interrupt_request & CPU_INTERRUPT_VIRQ) && + (env->eflags & IF_MASK) && !(env->hflags & HF_INHIBIT_IRQ_MASK)) { + int intno; + /* FIXME: this should respect TPR */ + env->interrupt_request &= ~CPU_INTERRUPT_VIRQ; + stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_ctl), + ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_ctl)) & ~V_IRQ_MASK); + intno = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_vector)); + if (loglevel & CPU_LOG_TB_IN_ASM) + fprintf(logfile, "Servicing virtual hardware INT=0x%02x\n", intno); + do_interrupt(intno, 0, 0, -1, 1); +#if defined(__sparc__) && !defined(HOST_SOLARIS) + tmp_T0 = 0; +#else + T0 = 0; +#endif +#endif } #elif defined(TARGET_PPC) #if 0 @@ -1292,6 +1292,11 @@ void cpu_abort(CPUState *env, const char *fmt, ...) vfprintf(stderr, fmt, ap); fprintf(stderr, "\n"); #ifdef TARGET_I386 + if(env->intercept & INTERCEPT_SVM_MASK) { + /* most probably the virtual machine should not + be shut down but rather caught by the VMM */ + vmexit(SVM_EXIT_SHUTDOWN, 0); + } cpu_dump_state(env, stderr, fprintf, X86_DUMP_FPU | X86_DUMP_CCOP); #else cpu_dump_state(env, stderr, fprintf, 0); diff --git a/target-i386/cpu.h b/target-i386/cpu.h index 9ae50ee6d7..2cc7d64e95 100644 --- a/target-i386/cpu.h +++ b/target-i386/cpu.h @@ -84,6 +84,7 @@ #define DESC_AVL_MASK (1 << 20) #define DESC_P_MASK (1 << 15) #define DESC_DPL_SHIFT 13 +#define DESC_DPL_MASK (1 << DESC_DPL_SHIFT) #define DESC_S_MASK (1 << 12) #define DESC_TYPE_SHIFT 8 #define DESC_A_MASK (1 << 8) @@ -149,6 +150,8 @@ #define HF_VM_SHIFT 17 /* must be same as eflags */ #define HF_HALTED_SHIFT 18 /* CPU halted */ #define HF_SMM_SHIFT 19 /* CPU in SMM mode */ +#define HF_GIF_SHIFT 20 /* if set CPU takes interrupts */ +#define HF_HIF_SHIFT 21 /* shadow copy of IF_MASK when in SVM */ #define HF_CPL_MASK (3 << HF_CPL_SHIFT) #define HF_SOFTMMU_MASK (1 << HF_SOFTMMU_SHIFT) @@ -166,6 +169,8 @@ #define HF_OSFXSR_MASK (1 << HF_OSFXSR_SHIFT) #define HF_HALTED_MASK (1 << HF_HALTED_SHIFT) #define HF_SMM_MASK (1 << HF_SMM_SHIFT) +#define HF_GIF_MASK (1 << HF_GIF_SHIFT) +#define HF_HIF_MASK (1 << HF_HIF_SHIFT) #define CR0_PE_MASK (1 << 0) #define CR0_MP_MASK (1 << 1) @@ -249,6 +254,8 @@ #define MSR_GSBASE 0xc0000101 #define MSR_KERNELGSBASE 0xc0000102 +#define MSR_VM_HSAVE_PA 0xc0010117 + /* cpuid_features bits */ #define CPUID_FP87 (1 << 0) #define CPUID_VME (1 << 1) @@ -283,6 +290,8 @@ #define CPUID_EXT2_FFXSR (1 << 25) #define CPUID_EXT2_LM (1 << 29) +#define CPUID_EXT3_SVM (1 << 2) + #define EXCP00_DIVZ 0 #define EXCP01_SSTP 1 #define EXCP02_NMI 2 @@ -489,6 +498,16 @@ typedef struct CPUX86State { uint32_t sysenter_eip; uint64_t efer; uint64_t star; + + target_phys_addr_t vm_hsave; + target_phys_addr_t vm_vmcb; + uint64_t intercept; + uint16_t intercept_cr_read; + uint16_t intercept_cr_write; + uint16_t intercept_dr_read; + uint16_t intercept_dr_write; + uint32_t intercept_exceptions; + #ifdef TARGET_X86_64 target_ulong lstar; target_ulong cstar; @@ -530,6 +549,7 @@ typedef struct CPUX86State { uint32_t cpuid_xlevel; uint32_t cpuid_model[12]; uint32_t cpuid_ext2_features; + uint32_t cpuid_ext3_features; uint32_t cpuid_apic_id; #ifdef USE_KQEMU @@ -670,4 +690,6 @@ static inline int cpu_get_time_fast(void) #include "cpu-all.h" +#include "svm.h" + #endif /* CPU_I386_H */ diff --git a/target-i386/exec.h b/target-i386/exec.h index 59c0649232..1cb73467bb 100644 --- a/target-i386/exec.h +++ b/target-i386/exec.h @@ -502,6 +502,15 @@ void update_fp_status(void); void helper_hlt(void); void helper_monitor(void); void helper_mwait(void); +void helper_vmrun(target_ulong addr); +void helper_vmmcall(void); +void helper_vmload(target_ulong addr); +void helper_vmsave(target_ulong addr); +void helper_stgi(void); +void helper_clgi(void); +void helper_skinit(void); +void helper_invlpga(void); +void vmexit(uint64_t exit_code, uint64_t exit_info_1); extern const uint8_t parity_table[256]; extern const uint8_t rclw_table[32]; @@ -589,3 +598,4 @@ static inline int cpu_halted(CPUState *env) { } return EXCP_HALTED; } + diff --git a/target-i386/helper.c b/target-i386/helper.c index 43a8b9b579..40dc41f3a7 100644 --- a/target-i386/helper.c +++ b/target-i386/helper.c @@ -594,7 +594,18 @@ static void do_interrupt_protected(int intno, int is_int, int error_code, int has_error_code, new_stack, shift; uint32_t e1, e2, offset, ss, esp, ss_e1, ss_e2; uint32_t old_eip, sp_mask; + int svm_should_check = 1; + if ((env->intercept & INTERCEPT_SVM_MASK) && !is_int && next_eip==-1) { + next_eip = EIP; + svm_should_check = 0; + } + + if (svm_should_check + && (INTERCEPTEDl(_exceptions, 1 << intno) + && !is_int)) { + raise_interrupt(intno, is_int, error_code, 0); + } has_error_code = 0; if (!is_int && !is_hw) { switch(intno) { @@ -830,7 +841,17 @@ static void do_interrupt64(int intno, int is_int, int error_code, int has_error_code, new_stack; uint32_t e1, e2, e3, ss; target_ulong old_eip, esp, offset; + int svm_should_check = 1; + if ((env->intercept & INTERCEPT_SVM_MASK) && !is_int && next_eip==-1) { + next_eip = EIP; + svm_should_check = 0; + } + if (svm_should_check + && INTERCEPTEDl(_exceptions, 1 << intno) + && !is_int) { + raise_interrupt(intno, is_int, error_code, 0); + } has_error_code = 0; if (!is_int && !is_hw) { switch(intno) { @@ -1077,7 +1098,17 @@ static void do_interrupt_real(int intno, int is_int, int error_code, int selector; uint32_t offset, esp; uint32_t old_cs, old_eip; + int svm_should_check = 1; + if ((env->intercept & INTERCEPT_SVM_MASK) && !is_int && next_eip==-1) { + next_eip = EIP; + svm_should_check = 0; + } + if (svm_should_check + && INTERCEPTEDl(_exceptions, 1 << intno) + && !is_int) { + raise_interrupt(intno, is_int, error_code, 0); + } /* real mode (simpler !) */ dt = &env->idt; if (intno * 4 + 3 > dt->limit) @@ -1227,8 +1258,10 @@ int check_exception(int intno, int *error_code) void raise_interrupt(int intno, int is_int, int error_code, int next_eip_addend) { - if (!is_int) + if (!is_int) { + svm_check_intercept_param(SVM_EXIT_EXCP_BASE + intno, error_code); intno = check_exception(intno, &error_code); + } env->exception_index = intno; env->error_code = error_code; @@ -1671,7 +1704,7 @@ void helper_cpuid(void) case 0x80000001: EAX = env->cpuid_features; EBX = 0; - ECX = 0; + ECX = env->cpuid_ext3_features; EDX = env->cpuid_ext2_features; break; case 0x80000002: @@ -2745,6 +2778,9 @@ void helper_wrmsr(void) case MSR_PAT: env->pat = val; break; + case MSR_VM_HSAVE_PA: + env->vm_hsave = val; + break; #ifdef TARGET_X86_64 case MSR_LSTAR: env->lstar = val; @@ -2796,6 +2832,9 @@ void helper_rdmsr(void) case MSR_PAT: val = env->pat; break; + case MSR_VM_HSAVE_PA: + val = env->vm_hsave; + break; #ifdef TARGET_X86_64 case MSR_LSTAR: val = env->lstar; @@ -3877,3 +3916,483 @@ void tlb_fill(target_ulong addr, int is_write, int is_user, void *retaddr) } env = saved_env; } + + +/* Secure Virtual Machine helpers */ + +void helper_stgi(void) +{ + env->hflags |= HF_GIF_MASK; +} + +void helper_clgi(void) +{ + env->hflags &= ~HF_GIF_MASK; +} + +#if defined(CONFIG_USER_ONLY) + +void helper_vmrun(target_ulong addr) { } +void helper_vmmcall(void) { } +void helper_vmload(target_ulong addr) { } +void helper_vmsave(target_ulong addr) { } +void helper_skinit(void) { } +void helper_invlpga(void) { } +void vmexit(uint64_t exit_code, uint64_t exit_info_1) { } +int svm_check_intercept_param(uint32_t type, uint64_t param) +{ + return 0; +} + +#else + +static inline uint32_t +vmcb2cpu_attrib(uint16_t vmcb_attrib, uint32_t vmcb_base, uint32_t vmcb_limit) +{ + return ((vmcb_attrib & 0x00ff) << 8) /* Type, S, DPL, P */ + | ((vmcb_attrib & 0x0f00) << 12) /* AVL, L, DB, G */ + | ((vmcb_base >> 16) & 0xff) /* Base 23-16 */ + | (vmcb_base & 0xff000000) /* Base 31-24 */ + | (vmcb_limit & 0xf0000); /* Limit 19-16 */ +} + +static inline uint16_t cpu2vmcb_attrib(uint32_t cpu_attrib) +{ + return ((cpu_attrib >> 8) & 0xff) /* Type, S, DPL, P */ + | ((cpu_attrib & 0xf00000) >> 12); /* AVL, L, DB, G */ +} + +extern uint8_t *phys_ram_base; +void helper_vmrun(target_ulong addr) +{ + uint32_t event_inj; + uint32_t int_ctl; + + if (loglevel & CPU_LOG_TB_IN_ASM) + fprintf(logfile,"vmrun! " TARGET_FMT_lx "\n", addr); + + env->vm_vmcb = addr; + regs_to_env(); + + /* save the current CPU state in the hsave page */ + stq_phys(env->vm_hsave + offsetof(struct vmcb, save.gdtr.base), env->gdt.base); + stl_phys(env->vm_hsave + offsetof(struct vmcb, save.gdtr.limit), env->gdt.limit); + + stq_phys(env->vm_hsave + offsetof(struct vmcb, save.idtr.base), env->idt.base); + stl_phys(env->vm_hsave + offsetof(struct vmcb, save.idtr.limit), env->idt.limit); + + stq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr0), env->cr[0]); + stq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr2), env->cr[2]); + stq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr3), env->cr[3]); + stq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr4), env->cr[4]); + stq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr8), env->cr[8]); + stq_phys(env->vm_hsave + offsetof(struct vmcb, save.dr6), env->dr[6]); + stq_phys(env->vm_hsave + offsetof(struct vmcb, save.dr7), env->dr[7]); + + stq_phys(env->vm_hsave + offsetof(struct vmcb, save.efer), env->efer); + stq_phys(env->vm_hsave + offsetof(struct vmcb, save.rflags), compute_eflags()); + + SVM_SAVE_SEG(env->vm_hsave, segs[R_ES], es); + SVM_SAVE_SEG(env->vm_hsave, segs[R_CS], cs); + SVM_SAVE_SEG(env->vm_hsave, segs[R_SS], ss); + SVM_SAVE_SEG(env->vm_hsave, segs[R_DS], ds); + + stq_phys(env->vm_hsave + offsetof(struct vmcb, save.rip), EIP); + stq_phys(env->vm_hsave + offsetof(struct vmcb, save.rsp), ESP); + stq_phys(env->vm_hsave + offsetof(struct vmcb, save.rax), EAX); + + /* load the interception bitmaps so we do not need to access the + vmcb in svm mode */ + /* We shift all the intercept bits so we can OR them with the TB + flags later on */ + env->intercept = (ldq_phys(env->vm_vmcb + offsetof(struct vmcb, control.intercept)) << INTERCEPT_INTR) | INTERCEPT_SVM_MASK; + env->intercept_cr_read = lduw_phys(env->vm_vmcb + offsetof(struct vmcb, control.intercept_cr_read)); + env->intercept_cr_write = lduw_phys(env->vm_vmcb + offsetof(struct vmcb, control.intercept_cr_write)); + env->intercept_dr_read = lduw_phys(env->vm_vmcb + offsetof(struct vmcb, control.intercept_dr_read)); + env->intercept_dr_write = lduw_phys(env->vm_vmcb + offsetof(struct vmcb, control.intercept_dr_write)); + env->intercept_exceptions = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.intercept_exceptions)); + + env->gdt.base = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.gdtr.base)); + env->gdt.limit = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, save.gdtr.limit)); + + env->idt.base = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.idtr.base)); + env->idt.limit = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, save.idtr.limit)); + + /* clear exit_info_2 so we behave like the real hardware */ + stq_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2), 0); + + cpu_x86_update_cr0(env, ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr0))); + cpu_x86_update_cr4(env, ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr4))); + cpu_x86_update_cr3(env, ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr3))); + env->cr[2] = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr2)); + int_ctl = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_ctl)); + if (int_ctl & V_INTR_MASKING_MASK) { + env->cr[8] = int_ctl & V_TPR_MASK; + if (env->eflags & IF_MASK) + env->hflags |= HF_HIF_MASK; + } + +#ifdef TARGET_X86_64 + env->efer = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.efer)); + env->hflags &= ~HF_LMA_MASK; + if (env->efer & MSR_EFER_LMA) + env->hflags |= HF_LMA_MASK; +#endif + env->eflags = 0; + load_eflags(ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rflags)), + ~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK)); + CC_OP = CC_OP_EFLAGS; + CC_DST = 0xffffffff; + + SVM_LOAD_SEG(env->vm_vmcb, ES, es); + SVM_LOAD_SEG(env->vm_vmcb, CS, cs); + SVM_LOAD_SEG(env->vm_vmcb, SS, ss); + SVM_LOAD_SEG(env->vm_vmcb, DS, ds); + + EIP = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rip)); + env->eip = EIP; + ESP = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rsp)); + EAX = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rax)); + env->dr[7] = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.dr7)); + env->dr[6] = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.dr6)); + cpu_x86_set_cpl(env, ldub_phys(env->vm_vmcb + offsetof(struct vmcb, save.cpl))); + + /* FIXME: guest state consistency checks */ + + switch(ldub_phys(env->vm_vmcb + offsetof(struct vmcb, control.tlb_ctl))) { + case TLB_CONTROL_DO_NOTHING: + break; + case TLB_CONTROL_FLUSH_ALL_ASID: + /* FIXME: this is not 100% correct but should work for now */ + tlb_flush(env, 1); + break; + } + + helper_stgi(); + + regs_to_env(); + + /* maybe we need to inject an event */ + event_inj = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj)); + if (event_inj & SVM_EVTINJ_VALID) { + uint8_t vector = event_inj & SVM_EVTINJ_VEC_MASK; + uint16_t valid_err = event_inj & SVM_EVTINJ_VALID_ERR; + uint32_t event_inj_err = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj_err)); + stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj), event_inj & ~SVM_EVTINJ_VALID); + + if (loglevel & CPU_LOG_TB_IN_ASM) + fprintf(logfile, "Injecting(%#hx): ", valid_err); + /* FIXME: need to implement valid_err */ + switch (event_inj & SVM_EVTINJ_TYPE_MASK) { + case SVM_EVTINJ_TYPE_INTR: + env->exception_index = vector; + env->error_code = event_inj_err; + env->exception_is_int = 1; + env->exception_next_eip = -1; + if (loglevel & CPU_LOG_TB_IN_ASM) + fprintf(logfile, "INTR"); + break; + case SVM_EVTINJ_TYPE_NMI: + env->exception_index = vector; + env->error_code = event_inj_err; + env->exception_is_int = 1; + env->exception_next_eip = EIP; + if (loglevel & CPU_LOG_TB_IN_ASM) + fprintf(logfile, "NMI"); + break; + case SVM_EVTINJ_TYPE_EXEPT: + env->exception_index = vector; + env->error_code = event_inj_err; + env->exception_is_int = 0; + env->exception_next_eip = -1; + if (loglevel & CPU_LOG_TB_IN_ASM) + fprintf(logfile, "EXEPT"); + break; + case SVM_EVTINJ_TYPE_SOFT: + env->exception_index = vector; + env->error_code = event_inj_err; + env->exception_is_int = 1; + env->exception_next_eip = EIP; + if (loglevel & CPU_LOG_TB_IN_ASM) + fprintf(logfile, "SOFT"); + break; + } + if (loglevel & CPU_LOG_TB_IN_ASM) + fprintf(logfile, " %#x %#x\n", env->exception_index, env->error_code); + } + if (int_ctl & V_IRQ_MASK) + env->interrupt_request |= CPU_INTERRUPT_VIRQ; + + cpu_loop_exit(); +} + +void helper_vmmcall(void) +{ + if (loglevel & CPU_LOG_TB_IN_ASM) + fprintf(logfile,"vmmcall!\n"); +} + +void helper_vmload(target_ulong addr) +{ + if (loglevel & CPU_LOG_TB_IN_ASM) + fprintf(logfile,"vmload! " TARGET_FMT_lx "\nFS: %016" PRIx64 " | " TARGET_FMT_lx "\n", + addr, ldq_phys(addr + offsetof(struct vmcb, save.fs.base)), + env->segs[R_FS].base); + + SVM_LOAD_SEG2(addr, segs[R_FS], fs); + SVM_LOAD_SEG2(addr, segs[R_GS], gs); + SVM_LOAD_SEG2(addr, tr, tr); + SVM_LOAD_SEG2(addr, ldt, ldtr); + +#ifdef TARGET_X86_64 + env->kernelgsbase = ldq_phys(addr + offsetof(struct vmcb, save.kernel_gs_base)); + env->lstar = ldq_phys(addr + offsetof(struct vmcb, save.lstar)); + env->cstar = ldq_phys(addr + offsetof(struct vmcb, save.cstar)); + env->fmask = ldq_phys(addr + offsetof(struct vmcb, save.sfmask)); +#endif + env->star = ldq_phys(addr + offsetof(struct vmcb, save.star)); + env->sysenter_cs = ldq_phys(addr + offsetof(struct vmcb, save.sysenter_cs)); + env->sysenter_esp = ldq_phys(addr + offsetof(struct vmcb, save.sysenter_esp)); + env->sysenter_eip = ldq_phys(addr + offsetof(struct vmcb, save.sysenter_eip)); +} + +void helper_vmsave(target_ulong addr) +{ + if (loglevel & CPU_LOG_TB_IN_ASM) + fprintf(logfile,"vmsave! " TARGET_FMT_lx "\nFS: %016" PRIx64 " | " TARGET_FMT_lx "\n", + addr, ldq_phys(addr + offsetof(struct vmcb, save.fs.base)), + env->segs[R_FS].base); + + SVM_SAVE_SEG(addr, segs[R_FS], fs); + SVM_SAVE_SEG(addr, segs[R_GS], gs); + SVM_SAVE_SEG(addr, tr, tr); + SVM_SAVE_SEG(addr, ldt, ldtr); + +#ifdef TARGET_X86_64 + stq_phys(addr + offsetof(struct vmcb, save.kernel_gs_base), env->kernelgsbase); + stq_phys(addr + offsetof(struct vmcb, save.lstar), env->lstar); + stq_phys(addr + offsetof(struct vmcb, save.cstar), env->cstar); + stq_phys(addr + offsetof(struct vmcb, save.sfmask), env->fmask); +#endif + stq_phys(addr + offsetof(struct vmcb, save.star), env->star); + stq_phys(addr + offsetof(struct vmcb, save.sysenter_cs), env->sysenter_cs); + stq_phys(addr + offsetof(struct vmcb, save.sysenter_esp), env->sysenter_esp); + stq_phys(addr + offsetof(struct vmcb, save.sysenter_eip), env->sysenter_eip); +} + +void helper_skinit(void) +{ + if (loglevel & CPU_LOG_TB_IN_ASM) + fprintf(logfile,"skinit!\n"); +} + +void helper_invlpga(void) +{ + tlb_flush(env, 0); +} + +int svm_check_intercept_param(uint32_t type, uint64_t param) +{ + switch(type) { + case SVM_EXIT_READ_CR0 ... SVM_EXIT_READ_CR0 + 8: + if (INTERCEPTEDw(_cr_read, (1 << (type - SVM_EXIT_READ_CR0)))) { + vmexit(type, param); + return 1; + } + break; + case SVM_EXIT_READ_DR0 ... SVM_EXIT_READ_DR0 + 8: + if (INTERCEPTEDw(_dr_read, (1 << (type - SVM_EXIT_READ_DR0)))) { + vmexit(type, param); + return 1; + } + break; + case SVM_EXIT_WRITE_CR0 ... SVM_EXIT_WRITE_CR0 + 8: + if (INTERCEPTEDw(_cr_write, (1 << (type - SVM_EXIT_WRITE_CR0)))) { + vmexit(type, param); + return 1; + } + break; + case SVM_EXIT_WRITE_DR0 ... SVM_EXIT_WRITE_DR0 + 8: + if (INTERCEPTEDw(_dr_write, (1 << (type - SVM_EXIT_WRITE_DR0)))) { + vmexit(type, param); + return 1; + } + break; + case SVM_EXIT_EXCP_BASE ... SVM_EXIT_EXCP_BASE + 16: + if (INTERCEPTEDl(_exceptions, (1 << (type - SVM_EXIT_EXCP_BASE)))) { + vmexit(type, param); + return 1; + } + break; + case SVM_EXIT_IOIO: + if (INTERCEPTED(1ULL << INTERCEPT_IOIO_PROT)) { + /* FIXME: this should be read in at vmrun (faster this way?) */ + uint64_t addr = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, control.iopm_base_pa)); + uint16_t port = (uint16_t) (param >> 16); + + if(ldub_phys(addr + port / 8) & (1 << (port % 8))) + vmexit(type, param); + } + break; + + case SVM_EXIT_MSR: + if (INTERCEPTED(1ULL << INTERCEPT_MSR_PROT)) { + /* FIXME: this should be read in at vmrun (faster this way?) */ + uint64_t addr = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, control.msrpm_base_pa)); + switch((uint32_t)ECX) { + case 0 ... 0x1fff: + T0 = (ECX * 2) % 8; + T1 = ECX / 8; + break; + case 0xc0000000 ... 0xc0001fff: + T0 = (8192 + ECX - 0xc0000000) * 2; + T1 = (T0 / 8); + T0 %= 8; + break; + case 0xc0010000 ... 0xc0011fff: + T0 = (16384 + ECX - 0xc0010000) * 2; + T1 = (T0 / 8); + T0 %= 8; + break; + default: + vmexit(type, param); + return 1; + } + if (ldub_phys(addr + T1) & ((1 << param) << T0)) + vmexit(type, param); + return 1; + } + break; + default: + if (INTERCEPTED((1ULL << ((type - SVM_EXIT_INTR) + INTERCEPT_INTR)))) { + vmexit(type, param); + return 1; + } + break; + } + return 0; +} + +void vmexit(uint64_t exit_code, uint64_t exit_info_1) +{ + uint32_t int_ctl; + + if (loglevel & CPU_LOG_TB_IN_ASM) + fprintf(logfile,"vmexit(%016" PRIx64 ", %016" PRIx64 ", %016" PRIx64 ", " TARGET_FMT_lx ")!\n", + exit_code, exit_info_1, + ldq_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2)), + EIP); + + /* Save the VM state in the vmcb */ + SVM_SAVE_SEG(env->vm_vmcb, segs[R_ES], es); + SVM_SAVE_SEG(env->vm_vmcb, segs[R_CS], cs); + SVM_SAVE_SEG(env->vm_vmcb, segs[R_SS], ss); + SVM_SAVE_SEG(env->vm_vmcb, segs[R_DS], ds); + + stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.gdtr.base), env->gdt.base); + stl_phys(env->vm_vmcb + offsetof(struct vmcb, save.gdtr.limit), env->gdt.limit); + + stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.idtr.base), env->idt.base); + stl_phys(env->vm_vmcb + offsetof(struct vmcb, save.idtr.limit), env->idt.limit); + + stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.efer), env->efer); + stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr0), env->cr[0]); + stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr2), env->cr[2]); + stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr3), env->cr[3]); + stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr4), env->cr[4]); + + if ((int_ctl = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_ctl))) & V_INTR_MASKING_MASK) { + int_ctl &= ~V_TPR_MASK; + int_ctl |= env->cr[8] & V_TPR_MASK; + stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_ctl), int_ctl); + } + + stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rflags), compute_eflags()); + stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rip), env->eip); + stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rsp), ESP); + stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rax), EAX); + stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.dr7), env->dr[7]); + stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.dr6), env->dr[6]); + stb_phys(env->vm_vmcb + offsetof(struct vmcb, save.cpl), env->hflags & HF_CPL_MASK); + + /* Reload the host state from vm_hsave */ + env->hflags &= ~HF_HIF_MASK; + env->intercept = 0; + env->intercept_exceptions = 0; + env->interrupt_request &= ~CPU_INTERRUPT_VIRQ; + + env->gdt.base = ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.gdtr.base)); + env->gdt.limit = ldl_phys(env->vm_hsave + offsetof(struct vmcb, save.gdtr.limit)); + + env->idt.base = ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.idtr.base)); + env->idt.limit = ldl_phys(env->vm_hsave + offsetof(struct vmcb, save.idtr.limit)); + + cpu_x86_update_cr0(env, ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr0)) | CR0_PE_MASK); + cpu_x86_update_cr4(env, ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr4))); + cpu_x86_update_cr3(env, ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr3))); + if (int_ctl & V_INTR_MASKING_MASK) + env->cr[8] = ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr8)); + /* we need to set the efer after the crs so the hidden flags get set properly */ +#ifdef TARGET_X86_64 + env->efer = ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.efer)); + env->hflags &= ~HF_LMA_MASK; + if (env->efer & MSR_EFER_LMA) + env->hflags |= HF_LMA_MASK; +#endif + + env->eflags = 0; + load_eflags(ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.rflags)), + ~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK)); + CC_OP = CC_OP_EFLAGS; + + SVM_LOAD_SEG(env->vm_hsave, ES, es); + SVM_LOAD_SEG(env->vm_hsave, CS, cs); + SVM_LOAD_SEG(env->vm_hsave, SS, ss); + SVM_LOAD_SEG(env->vm_hsave, DS, ds); + + EIP = ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.rip)); + ESP = ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.rsp)); + EAX = ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.rax)); + + env->dr[6] = ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.dr6)); + env->dr[7] = ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.dr7)); + + /* other setups */ + cpu_x86_set_cpl(env, 0); + stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_code_hi), (uint32_t)(exit_code >> 32)); + stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_code), exit_code); + stq_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_info_1), exit_info_1); + + helper_clgi(); + /* FIXME: Resets the current ASID register to zero (host ASID). */ + + /* Clears the V_IRQ and V_INTR_MASKING bits inside the processor. */ + + /* Clears the TSC_OFFSET inside the processor. */ + + /* If the host is in PAE mode, the processor reloads the host's PDPEs + from the page table indicated the host's CR3. If the PDPEs contain + illegal state, the processor causes a shutdown. */ + + /* Forces CR0.PE = 1, RFLAGS.VM = 0. */ + env->cr[0] |= CR0_PE_MASK; + env->eflags &= ~VM_MASK; + + /* Disables all breakpoints in the host DR7 register. */ + + /* Checks the reloaded host state for consistency. */ + + /* If the host's rIP reloaded by #VMEXIT is outside the limit of the + host's code segment or non-canonical (in the case of long mode), a + #GP fault is delivered inside the host.) */ + + /* remove any pending exception */ + env->exception_index = -1; + env->error_code = 0; + env->old_exception = -1; + + regs_to_env(); + cpu_loop_exit(); +} + +#endif diff --git a/target-i386/helper2.c b/target-i386/helper2.c index 715b289b30..541d83f927 100644 --- a/target-i386/helper2.c +++ b/target-i386/helper2.c @@ -27,6 +27,7 @@ #include "cpu.h" #include "exec-all.h" +#include "svm.h" //#define DEBUG_MMU @@ -111,10 +112,11 @@ CPUX86State *cpu_x86_init(void) CPUID_CX8 | CPUID_PGE | CPUID_CMOV | CPUID_PAT); env->pat = 0x0007040600070406ULL; + env->cpuid_ext3_features = CPUID_EXT3_SVM; env->cpuid_ext_features = CPUID_EXT_SSE3; env->cpuid_features |= CPUID_FXSR | CPUID_MMX | CPUID_SSE | CPUID_SSE2 | CPUID_PAE | CPUID_SEP; env->cpuid_features |= CPUID_APIC; - env->cpuid_xlevel = 0x80000006; + env->cpuid_xlevel = 0x8000000e; { const char *model_id = "QEMU Virtual CPU version " QEMU_VERSION; int c, len, i; @@ -131,7 +133,6 @@ CPUX86State *cpu_x86_init(void) /* currently not enabled for std i386 because not fully tested */ env->cpuid_ext2_features = (env->cpuid_features & 0x0183F3FF); env->cpuid_ext2_features |= CPUID_EXT2_LM | CPUID_EXT2_SYSCALL | CPUID_EXT2_NX; - env->cpuid_xlevel = 0x80000008; /* these features are needed for Win64 and aren't fully implemented */ env->cpuid_features |= CPUID_MTRR | CPUID_CLFLUSH | CPUID_MCA; @@ -162,6 +163,7 @@ void cpu_reset(CPUX86State *env) #ifdef CONFIG_SOFTMMU env->hflags |= HF_SOFTMMU_MASK; #endif + env->hflags |= HF_GIF_MASK; cpu_x86_update_cr0(env, 0x60000010); env->a20_mask = 0xffffffff; @@ -865,7 +867,6 @@ int cpu_x86_handle_mmu_fault(CPUX86State *env, target_ulong addr, do_fault_protect: error_code = PG_ERROR_P_MASK; do_fault: - env->cr[2] = addr; error_code |= (is_write << PG_ERROR_W_BIT); if (is_user) error_code |= PG_ERROR_U_MASK; @@ -873,8 +874,16 @@ int cpu_x86_handle_mmu_fault(CPUX86State *env, target_ulong addr, (env->efer & MSR_EFER_NXE) && (env->cr[4] & CR4_PAE_MASK)) error_code |= PG_ERROR_I_D_MASK; + if (INTERCEPTEDl(_exceptions, 1 << EXCP0E_PAGE)) { + stq_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2), addr); + } else { + env->cr[2] = addr; + } env->error_code = error_code; env->exception_index = EXCP0E_PAGE; + /* the VMM will handle this */ + if (INTERCEPTEDl(_exceptions, 1 << EXCP0E_PAGE)) + return 2; return 1; } diff --git a/target-i386/op.c b/target-i386/op.c index 9b4263ca7d..7d8950e079 100644 --- a/target-i386/op.c +++ b/target-i386/op.c @@ -513,8 +513,6 @@ typedef union UREG64 { } UREG64; #endif -#ifdef TARGET_X86_64 - #define PARAMQ1 \ ({\ UREG64 __p;\ @@ -523,6 +521,8 @@ typedef union UREG64 { __p.q;\ }) +#ifdef TARGET_X86_64 + void OPPROTO op_movq_T0_im64(void) { T0 = PARAMQ1; @@ -1242,12 +1242,52 @@ void OPPROTO op_ltr_T0(void) helper_ltr_T0(); } -/* CR registers access */ +/* CR registers access. */ void OPPROTO op_movl_crN_T0(void) { helper_movl_crN_T0(PARAM1); } +/* These pseudo-opcodes check for SVM intercepts. */ +void OPPROTO op_svm_check_intercept(void) +{ + A0 = PARAM1 & PARAM2; + svm_check_intercept(PARAMQ1); +} + +void OPPROTO op_svm_check_intercept_param(void) +{ + A0 = PARAM1 & PARAM2; + svm_check_intercept_param(PARAMQ1, T1); +} + +void OPPROTO op_svm_vmexit(void) +{ + A0 = PARAM1 & PARAM2; + vmexit(PARAMQ1, T1); +} + +void OPPROTO op_geneflags(void) +{ + CC_SRC = cc_table[CC_OP].compute_all(); +} + +/* This pseudo-opcode checks for IO intercepts. */ +#if !defined(CONFIG_USER_ONLY) +void OPPROTO op_svm_check_intercept_io(void) +{ + A0 = PARAM1 & PARAM2; + /* PARAMQ1 = TYPE (0 = OUT, 1 = IN; 4 = STRING; 8 = REP) + T0 = PORT + T1 = next eip */ + stq_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2), T1); + /* ASIZE does not appear on real hw */ + svm_check_intercept_param(SVM_EXIT_IOIO, + (PARAMQ1 & ~SVM_IOIO_ASIZE_MASK) | + ((T0 & 0xffff) << 16)); +} +#endif + #if !defined(CONFIG_USER_ONLY) void OPPROTO op_movtl_T0_cr8(void) { @@ -2452,3 +2492,45 @@ void OPPROTO op_emms(void) #define SHIFT 1 #include "ops_sse.h" + +/* Secure Virtual Machine ops */ + +void OPPROTO op_vmrun(void) +{ + helper_vmrun(EAX); +} + +void OPPROTO op_vmmcall(void) +{ + helper_vmmcall(); +} + +void OPPROTO op_vmload(void) +{ + helper_vmload(EAX); +} + +void OPPROTO op_vmsave(void) +{ + helper_vmsave(EAX); +} + +void OPPROTO op_stgi(void) +{ + helper_stgi(); +} + +void OPPROTO op_clgi(void) +{ + helper_clgi(); +} + +void OPPROTO op_skinit(void) +{ + helper_skinit(); +} + +void OPPROTO op_invlpga(void) +{ + helper_invlpga(); +} diff --git a/target-i386/translate.c b/target-i386/translate.c index 028cdac9ad..d62d563bd9 100644 --- a/target-i386/translate.c +++ b/target-i386/translate.c @@ -1995,6 +1995,98 @@ static void gen_movl_seg_T0(DisasContext *s, int seg_reg, target_ulong cur_eip) } } +#ifdef TARGET_X86_64 +#define SVM_movq_T1_im(x) gen_op_movq_T1_im64((x) >> 32, x) +#else +#define SVM_movq_T1_im(x) gen_op_movl_T1_im(x) +#endif + +static inline int +gen_svm_check_io(DisasContext *s, target_ulong pc_start, uint64_t type) +{ +#if !defined(CONFIG_USER_ONLY) + if(s->flags & (1ULL << INTERCEPT_IOIO_PROT)) { + if (s->cc_op != CC_OP_DYNAMIC) + gen_op_set_cc_op(s->cc_op); + SVM_movq_T1_im(s->pc - s->cs_base); + gen_jmp_im(pc_start - s->cs_base); + gen_op_geneflags(); + gen_op_svm_check_intercept_io((uint32_t)(type >> 32), (uint32_t)type); + s->cc_op = CC_OP_DYNAMIC; + /* FIXME: maybe we could move the io intercept vector to the TB as well + so we know if this is an EOB or not ... let's assume it's not + for now. */ + } +#endif + return 0; +} + +static inline int svm_is_rep(int prefixes) +{ + return ((prefixes & (PREFIX_REPZ | PREFIX_REPNZ)) ? 8 : 0); +} + +static inline int +gen_svm_check_intercept_param(DisasContext *s, target_ulong pc_start, + uint64_t type, uint64_t param) +{ + if(!(s->flags & (INTERCEPT_SVM_MASK))) + /* no SVM activated */ + return 0; + switch(type) { + /* CRx and DRx reads/writes */ + case SVM_EXIT_READ_CR0 ... SVM_EXIT_EXCP_BASE - 1: + if (s->cc_op != CC_OP_DYNAMIC) { + gen_op_set_cc_op(s->cc_op); + s->cc_op = CC_OP_DYNAMIC; + } + gen_jmp_im(pc_start - s->cs_base); + SVM_movq_T1_im(param); + gen_op_geneflags(); + gen_op_svm_check_intercept_param((uint32_t)(type >> 32), (uint32_t)type); + /* this is a special case as we do not know if the interception occurs + so we assume there was none */ + return 0; + case SVM_EXIT_MSR: + if(s->flags & (1ULL << INTERCEPT_MSR_PROT)) { + if (s->cc_op != CC_OP_DYNAMIC) { + gen_op_set_cc_op(s->cc_op); + s->cc_op = CC_OP_DYNAMIC; + } + gen_jmp_im(pc_start - s->cs_base); + SVM_movq_T1_im(param); + gen_op_geneflags(); + gen_op_svm_check_intercept_param((uint32_t)(type >> 32), (uint32_t)type); + /* this is a special case as we do not know if the interception occurs + so we assume there was none */ + return 0; + } + break; + default: + if(s->flags & (1ULL << ((type - SVM_EXIT_INTR) + INTERCEPT_INTR))) { + if (s->cc_op != CC_OP_DYNAMIC) { + gen_op_set_cc_op(s->cc_op); + s->cc_op = CC_OP_EFLAGS; + } + gen_jmp_im(pc_start - s->cs_base); + SVM_movq_T1_im(param); + gen_op_geneflags(); + gen_op_svm_vmexit(type >> 32, type); + /* we can optimize this one so TBs don't get longer + than up to vmexit */ + gen_eob(s); + return 1; + } + } + return 0; +} + +static inline int +gen_svm_check_intercept(DisasContext *s, target_ulong pc_start, uint64_t type) +{ + return gen_svm_check_intercept_param(s, pc_start, type, 0); +} + static inline void gen_stack_update(DisasContext *s, int addend) { #ifdef TARGET_X86_64 @@ -4880,6 +4972,12 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) else ot = dflag ? OT_LONG : OT_WORD; gen_check_io(s, ot, 1, pc_start - s->cs_base); + gen_op_mov_TN_reg[OT_WORD][0][R_EDX](); + gen_op_andl_T0_ffff(); + if (gen_svm_check_io(s, pc_start, + SVM_IOIO_TYPE_MASK | (1 << (4+ot)) | + svm_is_rep(prefixes) | 4 | (1 << (7+s->aflag)))) + break; if (prefixes & (PREFIX_REPZ | PREFIX_REPNZ)) { gen_repz_ins(s, ot, pc_start - s->cs_base, s->pc - s->cs_base); } else { @@ -4893,6 +4991,12 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) else ot = dflag ? OT_LONG : OT_WORD; gen_check_io(s, ot, 1, pc_start - s->cs_base); + gen_op_mov_TN_reg[OT_WORD][0][R_EDX](); + gen_op_andl_T0_ffff(); + if (gen_svm_check_io(s, pc_start, + (1 << (4+ot)) | svm_is_rep(prefixes) | + 4 | (1 << (7+s->aflag)))) + break; if (prefixes & (PREFIX_REPZ | PREFIX_REPNZ)) { gen_repz_outs(s, ot, pc_start - s->cs_base, s->pc - s->cs_base); } else { @@ -4902,6 +5006,7 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) /************************/ /* port I/O */ + case 0xe4: case 0xe5: if ((b & 1) == 0) @@ -4911,6 +5016,10 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) val = ldub_code(s->pc++); gen_op_movl_T0_im(val); gen_check_io(s, ot, 0, pc_start - s->cs_base); + if (gen_svm_check_io(s, pc_start, + SVM_IOIO_TYPE_MASK | svm_is_rep(prefixes) | + (1 << (4+ot)))) + break; gen_op_in[ot](); gen_op_mov_reg_T1[ot][R_EAX](); break; @@ -4923,6 +5032,9 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) val = ldub_code(s->pc++); gen_op_movl_T0_im(val); gen_check_io(s, ot, 0, pc_start - s->cs_base); + if (gen_svm_check_io(s, pc_start, svm_is_rep(prefixes) | + (1 << (4+ot)))) + break; gen_op_mov_TN_reg[ot][1][R_EAX](); gen_op_out[ot](); break; @@ -4935,6 +5047,10 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) gen_op_mov_TN_reg[OT_WORD][0][R_EDX](); gen_op_andl_T0_ffff(); gen_check_io(s, ot, 0, pc_start - s->cs_base); + if (gen_svm_check_io(s, pc_start, + SVM_IOIO_TYPE_MASK | svm_is_rep(prefixes) | + (1 << (4+ot)))) + break; gen_op_in[ot](); gen_op_mov_reg_T1[ot][R_EAX](); break; @@ -4947,6 +5063,9 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) gen_op_mov_TN_reg[OT_WORD][0][R_EDX](); gen_op_andl_T0_ffff(); gen_check_io(s, ot, 0, pc_start - s->cs_base); + if (gen_svm_check_io(s, pc_start, + svm_is_rep(prefixes) | (1 << (4+ot)))) + break; gen_op_mov_TN_reg[ot][1][R_EAX](); gen_op_out[ot](); break; @@ -5004,6 +5123,8 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) val = 0; goto do_lret; case 0xcf: /* iret */ + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_IRET)) + break; if (!s->pe) { /* real mode */ gen_op_iret_real(s->dflag); @@ -5125,6 +5246,8 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) /************************/ /* flags */ case 0x9c: /* pushf */ + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_PUSHF)) + break; if (s->vm86 && s->iopl != 3) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); } else { @@ -5135,6 +5258,8 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) } break; case 0x9d: /* popf */ + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_POPF)) + break; if (s->vm86 && s->iopl != 3) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); } else { @@ -5348,6 +5473,9 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) /* XXX: correct lock test for all insn */ if (prefixes & PREFIX_LOCK) goto illegal_op; + if (prefixes & PREFIX_REPZ) { + gen_svm_check_intercept(s, pc_start, SVM_EXIT_PAUSE); + } break; case 0x9b: /* fwait */ if ((s->flags & (HF_MP_MASK | HF_TS_MASK)) == @@ -5361,10 +5489,14 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) } break; case 0xcc: /* int3 */ + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_SWINT)) + break; gen_interrupt(s, EXCP03_INT3, pc_start - s->cs_base, s->pc - s->cs_base); break; case 0xcd: /* int N */ val = ldub_code(s->pc++); + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_SWINT)) + break; if (s->vm86 && s->iopl != 3) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); } else { @@ -5374,12 +5506,16 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) case 0xce: /* into */ if (CODE64(s)) goto illegal_op; + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_SWINT)) + break; if (s->cc_op != CC_OP_DYNAMIC) gen_op_set_cc_op(s->cc_op); gen_jmp_im(pc_start - s->cs_base); gen_op_into(s->pc - pc_start); break; case 0xf1: /* icebp (undocumented, exits to external debugger) */ + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_ICEBP)) + break; #if 1 gen_debug(s, pc_start - s->cs_base); #else @@ -5415,6 +5551,8 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) gen_op_set_inhibit_irq(); /* give a chance to handle pending irqs */ gen_jmp_im(s->pc - s->cs_base); + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_VINTR)) + break; gen_eob(s); } else { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); @@ -5507,13 +5645,21 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) if (s->cpl != 0) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); } else { - if (b & 2) + int retval = 0; + if (b & 2) { + retval = gen_svm_check_intercept_param(s, pc_start, SVM_EXIT_MSR, 0); gen_op_rdmsr(); - else + } else { + retval = gen_svm_check_intercept_param(s, pc_start, SVM_EXIT_MSR, 1); gen_op_wrmsr(); + } + if(retval) + gen_eob(s); } break; case 0x131: /* rdtsc */ + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_RDTSC)) + break; gen_jmp_im(pc_start - s->cs_base); gen_op_rdtsc(); break; @@ -5576,12 +5722,16 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) break; #endif case 0x1a2: /* cpuid */ + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_CPUID)) + break; gen_op_cpuid(); break; case 0xf4: /* hlt */ if (s->cpl != 0) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); } else { + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_HLT)) + break; if (s->cc_op != CC_OP_DYNAMIC) gen_op_set_cc_op(s->cc_op); gen_jmp_im(s->pc - s->cs_base); @@ -5597,6 +5747,8 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) case 0: /* sldt */ if (!s->pe || s->vm86) goto illegal_op; + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_LDTR_READ)) + break; gen_op_movl_T0_env(offsetof(CPUX86State,ldt.selector)); ot = OT_WORD; if (mod == 3) @@ -5609,6 +5761,8 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) if (s->cpl != 0) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); } else { + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_LDTR_WRITE)) + break; gen_ldst_modrm(s, modrm, OT_WORD, OR_TMP0, 0); gen_jmp_im(pc_start - s->cs_base); gen_op_lldt_T0(); @@ -5617,6 +5771,8 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) case 1: /* str */ if (!s->pe || s->vm86) goto illegal_op; + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_TR_READ)) + break; gen_op_movl_T0_env(offsetof(CPUX86State,tr.selector)); ot = OT_WORD; if (mod == 3) @@ -5629,6 +5785,8 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) if (s->cpl != 0) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); } else { + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_TR_WRITE)) + break; gen_ldst_modrm(s, modrm, OT_WORD, OR_TMP0, 0); gen_jmp_im(pc_start - s->cs_base); gen_op_ltr_T0(); @@ -5660,6 +5818,8 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) case 0: /* sgdt */ if (mod == 3) goto illegal_op; + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_GDTR_READ)) + break; gen_lea_modrm(s, modrm, ®_addr, &offset_addr); gen_op_movl_T0_env(offsetof(CPUX86State, gdt.limit)); gen_op_st_T0_A0[OT_WORD + s->mem_index](); @@ -5676,6 +5836,8 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) if (!(s->cpuid_ext_features & CPUID_EXT_MONITOR) || s->cpl != 0) goto illegal_op; + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_MONITOR)) + break; gen_jmp_im(pc_start - s->cs_base); #ifdef TARGET_X86_64 if (s->aflag == 2) { @@ -5700,6 +5862,8 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) gen_op_set_cc_op(s->cc_op); s->cc_op = CC_OP_DYNAMIC; } + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_MWAIT)) + break; gen_jmp_im(s->pc - s->cs_base); gen_op_mwait(); gen_eob(s); @@ -5708,6 +5872,8 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) goto illegal_op; } } else { /* sidt */ + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_IDTR_READ)) + break; gen_lea_modrm(s, modrm, ®_addr, &offset_addr); gen_op_movl_T0_env(offsetof(CPUX86State, idt.limit)); gen_op_st_T0_A0[OT_WORD + s->mem_index](); @@ -5720,11 +5886,63 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) break; case 2: /* lgdt */ case 3: /* lidt */ - if (mod == 3) - goto illegal_op; - if (s->cpl != 0) { + if (mod == 3) { + switch(rm) { + case 0: /* VMRUN */ + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_VMRUN)) + break; + if (s->cc_op != CC_OP_DYNAMIC) + gen_op_set_cc_op(s->cc_op); + gen_jmp_im(s->pc - s->cs_base); + gen_op_vmrun(); + s->cc_op = CC_OP_EFLAGS; + gen_eob(s); + break; + case 1: /* VMMCALL */ + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_VMMCALL)) + break; + /* FIXME: cause #UD if hflags & SVM */ + gen_op_vmmcall(); + break; + case 2: /* VMLOAD */ + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_VMLOAD)) + break; + gen_op_vmload(); + break; + case 3: /* VMSAVE */ + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_VMSAVE)) + break; + gen_op_vmsave(); + break; + case 4: /* STGI */ + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_STGI)) + break; + gen_op_stgi(); + break; + case 5: /* CLGI */ + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_CLGI)) + break; + gen_op_clgi(); + break; + case 6: /* SKINIT */ + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_SKINIT)) + break; + gen_op_skinit(); + break; + case 7: /* INVLPGA */ + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_INVLPGA)) + break; + gen_op_invlpga(); + break; + default: + goto illegal_op; + } + } else if (s->cpl != 0) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); } else { + if (gen_svm_check_intercept(s, pc_start, + op==2 ? SVM_EXIT_GDTR_WRITE : SVM_EXIT_IDTR_WRITE)) + break; gen_lea_modrm(s, modrm, ®_addr, &offset_addr); gen_op_ld_T1_A0[OT_WORD + s->mem_index](); gen_add_A0_im(s, 2); @@ -5741,6 +5959,8 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) } break; case 4: /* smsw */ + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_READ_CR0)) + break; gen_op_movl_T0_env(offsetof(CPUX86State,cr[0])); gen_ldst_modrm(s, modrm, OT_WORD, OR_TMP0, 1); break; @@ -5748,6 +5968,8 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) if (s->cpl != 0) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); } else { + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_WRITE_CR0)) + break; gen_ldst_modrm(s, modrm, OT_WORD, OR_TMP0, 0); gen_op_lmsw_T0(); gen_jmp_im(s->pc - s->cs_base); @@ -5772,6 +5994,8 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) goto illegal_op; } } else { + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_INVLPG)) + break; gen_lea_modrm(s, modrm, ®_addr, &offset_addr); gen_op_invlpg_A0(); gen_jmp_im(s->pc - s->cs_base); @@ -5788,6 +6012,8 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) if (s->cpl != 0) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); } else { + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_INVD)) + break; /* nothing to do */ } break; @@ -5908,11 +6134,13 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) case 4: case 8: if (b & 2) { + gen_svm_check_intercept(s, pc_start, SVM_EXIT_WRITE_CR0 + reg); gen_op_mov_TN_reg[ot][0][rm](); gen_op_movl_crN_T0(reg); gen_jmp_im(s->pc - s->cs_base); gen_eob(s); } else { + gen_svm_check_intercept(s, pc_start, SVM_EXIT_READ_CR0 + reg); #if !defined(CONFIG_USER_ONLY) if (reg == 8) gen_op_movtl_T0_cr8(); @@ -5945,11 +6173,13 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) if (reg == 4 || reg == 5 || reg >= 8) goto illegal_op; if (b & 2) { + gen_svm_check_intercept(s, pc_start, SVM_EXIT_WRITE_DR0 + reg); gen_op_mov_TN_reg[ot][0][rm](); gen_op_movl_drN_T0(reg); gen_jmp_im(s->pc - s->cs_base); gen_eob(s); } else { + gen_svm_check_intercept(s, pc_start, SVM_EXIT_READ_DR0 + reg); gen_op_movtl_T0_env(offsetof(CPUX86State,dr[reg])); gen_op_mov_reg_T0[ot][rm](); } @@ -5959,6 +6189,7 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) if (s->cpl != 0) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); } else { + gen_svm_check_intercept(s, pc_start, SVM_EXIT_WRITE_CR0); gen_op_clts(); /* abort block because static cpu state changed */ gen_jmp_im(s->pc - s->cs_base); @@ -6050,6 +6281,8 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start) /* ignore for now */ break; case 0x1aa: /* rsm */ + if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_RSM)) + break; if (!(s->flags & HF_SMM_MASK)) goto illegal_op; if (s->cc_op != CC_OP_DYNAMIC) { |