aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2024-06-08i386: Add support for SUCCOR featureJohn Allen
Add cpuid bit definition for the SUCCOR feature. This cpuid bit is required to be exposed to guests to allow them to handle machine check exceptions on AMD hosts. ---- v2: - Add "succor" feature word. - Add case to kvm_arch_get_supported_cpuid for the SUCCOR feature. Reported-by: William Roche <william.roche@oracle.com> Reviewed-by: Joao Martins <joao.m.martins@oracle.com> Signed-off-by: John Allen <john.allen@amd.com> Message-ID: <20240603193622.47156-3-john.allen@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08i386: Fix MCE support for AMD hostsJohn Allen
For the most part, AMD hosts can use the same MCE injection code as Intel, but there are instances where the qemu implementation is Intel specific. First, MCE delivery works differently on AMD and does not support broadcast. Second, kvm_mce_inject generates MCEs that include a number of Intel specific status bits. Modify kvm_mce_inject to properly generate MCEs on AMD platforms. Reported-by: William Roche <william.roche@oracle.com> Signed-off-by: John Allen <john.allen@amd.com> Message-ID: <20240603193622.47156-2-john.allen@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08docs: i386: pc: Avoid mentioning limit of maximum vCPUsZhao Liu
Different versions of PC machine support different maximum vCPUs, and even different features have limits on the maximum number of vCPUs ( For example, if x2apic is not enabled in the TCG case, the maximum of 255 vCPUs are supported). It is difficult to list the maximum vCPUs under all restrictions. Thus, to avoid confusion, avoid mentioning specific maximum vCPU number limitations here. Suggested-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-ID: <20240606085436.2028900-1-zhao1.liu@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08target/i386: Add get/set/migrate support for FRED MSRsXin Li
FRED CPU states are managed in 9 new FRED MSRs, in addtion to a few existing CPU registers and MSRs, e.g., CR4.FRED and MSR_IA32_PL0_SSP. Save/restore/migrate FRED MSRs if FRED is exposed to the guest. Tested-by: Shan Kang <shan.kang@intel.com> Signed-off-by: Xin Li <xin3.li@intel.com> Message-ID: <20231109072012.8078-7-xin3.li@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08target/i386: enumerate VMX nested-exception supportXin Li
Allow VMX nested-exception support to be exposed in KVM guests, thus nested KVM guests can enumerate it. Tested-by: Shan Kang <shan.kang@intel.com> Signed-off-by: Xin Li <xin3.li@intel.com> Message-ID: <20231109072012.8078-6-xin3.li@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08vmxcap: add support for VMX FRED controlsXin Li
Report secondary vm-exit controls and the VMX controls used to save/load FRED MSRs. Tested-by: Shan Kang <shan.kang@intel.com> Signed-off-by: Xin Li <xin3.li@intel.com> Message-ID: <20231109072012.8078-5-xin3.li@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08target/i386: mark CR4.FRED not reservedXin Li
The CR4.FRED bit, i.e., CR4[32], is no longer a reserved bit when FRED is exposed to guests, otherwise it is still a reserved bit. Tested-by: Shan Kang <shan.kang@intel.com> Signed-off-by: Xin Li <xin3.li@intel.com> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Message-ID: <20231109072012.8078-3-xin3.li@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08target/i386: add support for FRED in CPUID enumerationXin Li
FRED, i.e., the Intel flexible return and event delivery architecture, defines simple new transitions that change privilege level (ring transitions). The new transitions defined by the FRED architecture are FRED event delivery and, for returning from events, two FRED return instructions. FRED event delivery can effect a transition from ring 3 to ring 0, but it is used also to deliver events incident to ring 0. One FRED instruction (ERETU) effects a return from ring 0 to ring 3, while the other (ERETS) returns while remaining in ring 0. Collectively, FRED event delivery and the FRED return instructions are FRED transitions. In addition to these transitions, the FRED architecture defines a new instruction (LKGS) for managing the state of the GS segment register. The LKGS instruction can be used by 64-bit operating systems that do not use the new FRED transitions. WRMSRNS is an instruction that behaves exactly like WRMSR, with the only difference being that it is not a serializing instruction by default. Under certain conditions, WRMSRNS may replace WRMSR to improve performance. FRED uses it to switch RSP0 in a faster manner. Search for the latest FRED spec in most search engines with this search pattern: site:intel.com FRED (flexible return and event delivery) specification The CPUID feature flag CPUID.(EAX=7,ECX=1):EAX[17] enumerates FRED, and the CPUID feature flag CPUID.(EAX=7,ECX=1):EAX[18] enumerates LKGS, and the CPUID feature flag CPUID.(EAX=7,ECX=1):EAX[19] enumerates WRMSRNS. Add CPUID definitions for FRED/LKGS/WRMSRNS, and expose them to KVM guests. Because FRED relies on LKGS and WRMSRNS, add that to feature dependency map. Tested-by: Shan Kang <shan.kang@intel.com> Signed-off-by: Xin Li <xin3.li@intel.com> Message-ID: <20231109072012.8078-2-xin3.li@intel.com> [Fix order of dependencies, add dependencies from LM to FRED. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08hvf: Makes assert_hvf_ok report failed expressionPhil Dennis-Jordan
When a macOS Hypervisor.framework call fails which is checked by assert_hvf_ok(), Qemu exits printing the error value, but not the location in the code, as regular assert() macro expansions would. This change turns assert_hvf_ok() into a macro similar to other assertions, which expands to a call to the corresponding _impl() function together with information about the expression that failed the assertion and its location in the code. Additionally, stringifying the numeric hv_return_t code is factored into a helper function that can be reused for diagnostics and debugging outside of assertions. Signed-off-by: Phil Dennis-Jordan <phil@philjordan.eu> Message-ID: <20240605112556.43193-8-phil@philjordan.eu> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08i386/hvf: Updates API usage to use modern vCPU run functionPhil Dennis-Jordan
macOS 10.15 introduced the more efficient hv_vcpu_run_until() function to supersede hv_vcpu_run(). According to the documentation, there is no longer any reason to use the latter on modern host OS versions, especially after 11.0 added support for an indefinite deadline. Observed behaviour of the newer function is that as documented, it exits much less frequently - and most of the original function’s exits seem to have been effectively pointless. Another reason to use the new function is that it is a prerequisite for using newer features such as in-kernel APIC support. (Not covered by this patch.) This change implements the upgrade by selecting one of three code paths at compile time: two static code paths for the new and old functions respectively, when building for targets where the new function is either not available, or where the built executable won’t run on older platforms lacking the new function anyway. The third code path selects dynamically based on runtime detected availability of the weakly-linked symbol. Signed-off-by: Phil Dennis-Jordan <phil@philjordan.eu> Message-ID: <20240605112556.43193-7-phil@philjordan.eu> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08i386/hvf: In kick_vcpu use hv_vcpu_interrupt to force exitPhil Dennis-Jordan
When interrupting a vCPU thread, this patch actually tells the hypervisor to stop running guest code on that vCPU. Calling hv_vcpu_interrupt actually forces a vCPU exit, analogously to hv_vcpus_exit on aarch64. Alternatively, if the vCPU thread is not running the VM, it will immediately cause an exit when it attempts to do so. Previously, hvf_kick_vcpu_thread relied upon hv_vcpu_run returning very frequently, including many spurious exits, which made it less of a problem that nothing was actively done to stop the vCPU thread running guest code. The newer, more efficient hv_vcpu_run_until exits much more rarely, so a true "kick" is needed before switching to that. Signed-off-by: Phil Dennis-Jordan <phil@philjordan.eu> Message-ID: <20240605112556.43193-6-phil@philjordan.eu> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08i386/hvf: Fixes dirty memory tracking by page granularity RX->RWX changePhil Dennis-Jordan
When using x86 macOS Hypervisor.framework as accelerator, detection of dirty memory regions is implemented by marking logged memory region slots as read-only in the EPT, then setting the dirty flag when a guest write causes a fault. The area marked dirty should then be marked writable in order for subsequent writes to succeed without a VM exit. However, dirty bits are tracked on a per-page basis, whereas the fault handler was marking the whole logged memory region as writable. This change fixes the fault handler so only the protection of the single faulting page is marked as dirty. (Note: the dirty page tracking appeared to work despite this error because HVF’s hv_vcpu_run() function generated unnecessary EPT fault exits, which ended up causing the dirty marking handler to run even when the memory region had been marked RW. When using hv_vcpu_run_until(), a change planned for a subsequent commit, these spurious exits no longer occur, so dirty memory tracking malfunctions.) Additionally, the dirty page is set to permit code execution, the same as all other guest memory; changing memory protection from RX to RW not RWX appears to have been an oversight. Signed-off-by: Phil Dennis-Jordan <phil@philjordan.eu> Reviewed-by: Roman Bolshakov <roman@roolebo.dev> Tested-by: Roman Bolshakov <roman@roolebo.dev> Message-ID: <20240605112556.43193-5-phil@philjordan.eu> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08hvf: Consistent types for vCPU handlesPhil Dennis-Jordan
macOS Hypervisor.framework uses different types for identifying vCPUs, hv_vcpu_t or hv_vcpuid_t, depending on host architecture. They are not just differently named typedefs for the same primitive type, but reference different-width integers. Instead of using an integer type and casting where necessary, this change introduces a typedef which resolves the active architecture’s hvf typedef. It also removes a now-unnecessary cast. Signed-off-by: Phil Dennis-Jordan <phil@philjordan.eu> Reviewed-by: Roman Bolshakov <roman@roolebo.dev> Tested-by: Roman Bolshakov <roman@roolebo.dev> Message-ID: <20240605112556.43193-4-phil@philjordan.eu> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08i386/hvf: Fixes some compilation warningsPhil Dennis-Jordan
A bunch of function definitions used empty parentheses instead of (void) syntax, yielding the following warning when building with clang on macOS: warning: a function declaration without a prototype is deprecated in all versions of C [-Wstrict-prototypes] In addition to fixing these function headers, it also fixes what appears to be a typo causing a variable to be unused after initialisation. warning: variable 'entry_ctls' set but not used [-Wunused-but-set-variable] Signed-off-by: Phil Dennis-Jordan <phil@philjordan.eu> Reviewed-by: Roman Bolshakov <roman@roolebo.dev> Tested-by: Roman Bolshakov <roman@roolebo.dev> Message-ID: <20240605112556.43193-3-phil@philjordan.eu> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08i386/hvf: Adds support for INVTSC cpuid bitPhil Dennis-Jordan
This patch adds the INVTSC bit to the Hypervisor.framework accelerator's CPUID bit passthrough allow-list. Previously, specifying +invtsc in the CPU configuration would fail with the following warning despite the host CPU advertising the feature: qemu-system-x86_64: warning: host doesn't support requested feature: CPUID.80000007H:EDX.invtsc [bit 8] x86 macOS itself relies on a fixed rate TSC for its own Mach absolute time timestamp mechanism, so there's no reason we can't enable this bit for guests. When the feature is enabled, a migration blocker is installed. Signed-off-by: Phil Dennis-Jordan <phil@philjordan.eu> Reviewed-by: Roman Bolshakov <roman@roolebo.dev> Tested-by: Roman Bolshakov <roman@roolebo.dev> Message-ID: <20240605112556.43193-2-phil@philjordan.eu> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08stubs/meson: Fix qemuutil build when --disable-systemZhao Liu
Compiling without system, user, tools or guest-agent fails with the following error message: ./configure --disable-system --disable-user --disable-tools \ --disable-guest-agent error message: /usr/bin/ld: libqemuutil.a.p/util_error-report.c.o: in function `error_printf': /media/liuzhao/data/qemu-cook/build/../util/error-report.c:38: undefined reference to `error_vprintf' /usr/bin/ld: libqemuutil.a.p/util_error-report.c.o: in function `vreport': /media/liuzhao/data/qemu-cook/build/../util/error-report.c:215: undefined reference to `error_vprintf' collect2: error: ld returned 1 exit status This is because tests/bench and tests/unit both need qemuutil, which requires error_vprintf stub when system is disabled. Add error_vprintf stub into stub_ss for all cases other than disabling system. Fixes: 3a15604900c4 ("stubs: include stubs only if needed") Reported-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Message-ID: <20240605152549.1795762-1-zhao1.liu@intel.com> [Include error-printf.c unconditionally. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08scsi-disk: Don't silently truncate serial numberKevin Wolf
Before this commit, scsi-disk accepts a string of arbitrary length for its "serial" property. However, the value visible on the guest is actually truncated to 36 characters. This limitation doesn't come from the SCSI specification, it is an arbitrary limit that was initially picked as 20 and later bumped to 36 by commit 48b62063. Similarly, device_id was introduced as a copy of the serial number, limited to 20 characters, but commit 48b62063 forgot to actually bump it. As long as we silently truncate the given string, extending the limit is actually not a harmless change, but break the guest ABI. This is the most important reason why commit 48b62063 was really wrong (and it's also why we can't change device_id to be in sync with the serial number again and use 36 characters now, it would be another guest ABI breakage). In order to avoid future breakage, don't silently truncate the serial number string any more, but just error out if it would be truncated. Buglink: https://issues.redhat.com/browse/RHEL-3542 Suggested-by: Peter Krempa <pkrempa@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-ID: <20240604161755.63448-1-kwolf@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08hostmem: simplify the code for merge and dump propertiesPaolo Bonzini
No semantic change, just simpler control flow. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08machine, hostmem: improve error messages for unsupported featuresPaolo Bonzini
Detect early unsupported MADV_MERGEABLE and MADV_DONTDUMP, and print a clearer error message that points to the deficiency of the host. Cc: Michal Privoznik <mprivozn@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08backends/hostmem: Report error when memory size is unalignedMichal Privoznik
If memory-backend-{file,ram} has a size that's not aligned to underlying page size it is not only wasteful, but also may lead to hard to debug behaviour. For instance, in case memory-backend-file and hugepages, madvise() and mbind() fail. Rightfully so, page is the smallest unit they can work with. And even though an error is reported, the root cause it not very clear: qemu-system-x86_64: Couldn't set property 'dump' on 'memory-backend-file': Invalid argument After this commit: qemu-system-x86_64: backend 'memory-backend-file' memory size must be multiple of 2 MiB Signed-off-by: Michal Privoznik <mprivozn@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Mario Casquero <mcasquer@redhat.com> Message-ID: <b5b9f9c6bba07879fb43f3c6f496c69867ae3716.1717584048.git.mprivozn@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08osdep: Make qemu_madvise() return ENOSYS on unsupported OSesMichal Privoznik
Not every OS is capable of madvise() or posix_madvise() even. In that case, errno should be set to ENOSYS as it reflects the cause better. Signed-off-by: Michal Privoznik <mprivozn@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: David Hildenbrand <david@redhat.com> Message-ID: <b381c23bd8f413f1453a2c1a66e0979beaf27433.1717584048.git.mprivozn@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08osdep: Make qemu_madvise() to set errno in all casesMichal Privoznik
The unspoken premise of qemu_madvise() is that errno is set on error. And it is mostly the case except for posix_madvise() which is documented to return either zero (on success) or a positive error number. This means, we must set errno ourselves. And while at it, make the function return a negative value on error, just like other error paths do. Signed-off-by: Michal Privoznik <mprivozn@redhat.com> Reviewed-by: David Hildenbrand <david@redhat.com> Message-ID: <af17113e7c1f2cc909ffd36d23f5a411b63b8764.1717584048.git.mprivozn@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08meson: Don't even detect posix_madvise() on DarwinMichal Privoznik
On Darwin, posix_madvise() has the same return semantics as plain madvise() [1]. That's not really what our usage expects. Fortunately, madvise() is available and preferred anyways so we may stop detecting posix_madvise() on Darwin. 1: https://opensource.apple.com/source/xnu/xnu-7195.81.3/bsd/man/man2/madvise.2.auto.html Signed-off-by: Michal Privoznik <mprivozn@redhat.com> Message-ID: <00f71753bdeb8c0f049fda05fb63b84bb5502fb3.1717584048.git.mprivozn@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08machine: default -M mem-merge to off is QEMU_MADV_MERGEABLE is not availablePaolo Bonzini
Otherwise, starting any guest on a non-Linux guests results in qemu-system-arm: Couldn't set property 'merge' on 'memory-backend-ram': Invalid argument Cc: Michal Privoznik <mprivozn@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08target/i386: fix size of EBP writeback in gen_enter()Mark Cave-Ayland
The calculation of FrameTemp is done using the size indicated by mo_pushpop() before being written back to EBP, but the final writeback to EBP is done using the size indicated by mo_stacksize(). In the case where mo_pushpop() is MO_32 and mo_stacksize() is MO_16 then the final writeback to EBP is done using MO_16 which can leave junk in the top 16-bits of EBP after executing ENTER. Change the writeback of EBP to use the same size indicated by mo_pushpop() to ensure that the full value is written back. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2198 Message-ID: <20240606095319.229650-5-mark.cave-ayland@ilande.co.uk> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08target/i386: fix SP when taking a memory fault during POPMark Cave-Ayland
When OS/2 Warp configures its segment descriptors, many of them are configured with the P flag clear to allow for a fault-on-demand implementation. In the case where the stack value is POPped into the segment registers, the SP is incremented before calling gen_helper_load_seg() to validate the segment descriptor: IN: 0xffef2c0c: 66 07 popl %es OP: ld_i32 loc9,env,$0xfffffffffffffff8 sub_i32 loc9,loc9,$0x1 brcond_i32 loc9,$0x0,lt,$L0 st16_i32 loc9,env,$0xfffffffffffffff8 st8_i32 $0x1,env,$0xfffffffffffffffc ---- 0000000000000c0c 0000000000000000 ext16u_i64 loc0,rsp add_i64 loc0,loc0,ss_base ext32u_i64 loc0,loc0 qemu_ld_a64_i64 loc0,loc0,noat+un+leul,5 add_i64 loc3,rsp,$0x4 deposit_i64 rsp,rsp,loc3,$0x0,$0x10 extrl_i64_i32 loc5,loc0 call load_seg,$0x0,$0,env,$0x0,loc5 add_i64 rip,rip,$0x2 ext16u_i64 rip,rip exit_tb $0x0 set_label $L0 exit_tb $0x7fff58000043 If helper_load_seg() generates a fault when validating the segment descriptor then as the SP has already been incremented, the topmost word of the stack is overwritten by the arguments pushed onto the stack by the CPU before taking the fault handler. As a consequence things rapidly go wrong upon return from the fault handler due to the corrupted stack. Update the logic for the existing writeback condition so that a POP into the segment registers also calls helper_load_seg() first before incrementing the SP, so that if a fault occurs the SP remains unaltered. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2198 Message-ID: <20240606095319.229650-4-mark.cave-ayland@ilande.co.uk> Fixes: cc1d28bdbe0 ("target/i386: move 00-5F opcodes to new decoder", 2024-05-07) Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08target/i386: use gen_writeback() within gen_POP()Mark Cave-Ayland
Instead of directly implementing the writeback using gen_op_st_v(), use the existing gen_writeback() function. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-ID: <20240606095319.229650-3-mark.cave-ayland@ilande.co.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08target/i386: use local X86DecodedOp in gen_POP()Mark Cave-Ayland
This will make subsequent changes a little easier to read. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-ID: <20240606095319.229650-2-mark.cave-ayland@ilande.co.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08target/i386: document use of DISAS_NORETURNPaolo Bonzini
DISAS_NORETURN suppresses the work normally done by gen_eob(), and therefore must be used in special cases only. Document them. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08target/i386: document incorrect semantics of watchpoint following MOV/POP SSPaolo Bonzini
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08target/i386: fix TF/RF handling for HLTPaolo Bonzini
HLT uses DISAS_NORETURN because the corresponding helper calls cpu_loop_exit(). However, while gen_eob() clears HF_RF_MASK and synthesizes a #DB exception if single-step is active, none of this is done by HLT. Note that the single-step trap is generated after the halt is finished. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08target/i386: fix INHIBIT_IRQ/TF/RF handling for PAUSEPaolo Bonzini
PAUSE uses DISAS_NORETURN because the corresponding helper calls cpu_loop_exit(). However, while HLT clear HF_INHIBIT_IRQ_MASK to correctly handle "STI; HLT", the same is missing from PAUSE. And also gen_eob() clears HF_RF_MASK and synthesizes a #DB exception if single-step is active; none of this is done by HLT and PAUSE. Start fixing PAUSE, HLT will follow. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08target/i386: fix INHIBIT_IRQ/TF/RF handling for VMRUNPaolo Bonzini
From vm entry to exit, VMRUN is handled as a single instruction. It uses DISAS_NORETURN in order to avoid processing TF or RF before the first instruction executes in the guest. However, the corresponding handling is missing in vmexit. Add it, and at the same time reorganize the comments with quotes from the manual about the tasks performed by a #VMEXIT. Another gen_eob() task that is missing in VMRUN is preparing the HF_INHIBIT_IRQ flag for the next instruction, in this case by loading it from the VMCB control state. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08target/i386: disable/enable breakpoints on vmentry/vmexitPaolo Bonzini
If the required DR7 (either from the VMCB or from the host save area) disables a breakpoint that was enabled prior to vmentry or vmexit, it is left enabled and will trigger EXCP_DEBUG. This causes a spurious #DB on the next crossing of the breakpoint. To disable it, vmentry/vmexit must use cpu_x86_update_dr7 to load DR7. Because cpu_x86_update_dr7 takes a 32-bit argument, check reserved bits prior to calling cpu_x86_update_dr7, and do the same for DR6 as well for consistency. This scenario is tested by the "host_rflags" test in kvm-unit-tests. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08target/i386: implement DR7.GDPaolo Bonzini
DR7.GD triggers a #DB exception on any access to debug registers. The GD bit is cleared so that the #DB handler itself can access the debug registers. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08target/i386: cleanup PAUSE helpersPaolo Bonzini
Use decode.c's support for intercepts, doing the check in TCG-generated code rather than the helper. This is cleaner because it allows removing the eip_addend argument to helper_pause(), even though it adds a bit of bloat for opcode 0x90's new decoding function. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08target/i386: cleanup HLT helpersPaolo Bonzini
Use decode.c's support for intercepts, doing the check in TCG-generated code rather than the helper. This is cleaner because it allows removing the eip_addend argument to helper_hlt(). Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08target/i386: fix implementation of ICEBPPaolo Bonzini
ICEBP generates a trap-like exception, while gen_exception() produces a fault. Resurrect gen_update_eip_next() to implement the desired semantics. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08target/i386: fix pushed value of EFLAGS.RFPaolo Bonzini
When preparing an exception stack frame for a fault exception, the value pushed for RF is 1. Take that into account. The same should be true of interrupts for repeated string instructions, but the situation there is complicated. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-05Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingRichard Henderson
* virtio-blk: remove SCSI passthrough functionality * require x86-64-v2 baseline ISA * SEV-SNP host support * fix xsave.flat with TCG * fixes for CPUID checks done by TCG # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmZgKVYUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroPKYgf/QkWrNXdjjD3yAsv5LbJFVTVyCYW3 # b4Iax29kEDy8k9wbzfLxOfIk9jXIjmbOMO5ZN9LFiHK6VJxbXslsMh6hm50M3xKe # 49X1Rvf9YuVA7KZX+dWkEuqLYI6Tlgj3HaCilYWfXrjyo6hY3CxzkPV/ChmaeYlV # Ad4Y8biifoUuuEK8OTeTlcDWLhOHlFXylG3AXqULsUsXp0XhWJ9juXQ60eATv/W4 # eCEH7CSmRhYFu2/rV+IrWFYMnskLRTk1OC1/m6yXGPKOzgnOcthuvQfiUgPkbR/d # llY6Ni5Aaf7+XX3S7Avcyvoq8jXzaaMzOrzL98rxYGDR1sYBYO+4h4ZToA== # =qQeP # -----END PGP SIGNATURE----- # gpg: Signature made Wed 05 Jun 2024 02:01:10 AM PDT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (46 commits) hw/i386: Add support for loading BIOS using guest_memfd hw/i386/sev: Use guest_memfd for legacy ROMs memory: Introduce memory_region_init_ram_guest_memfd() i386/sev: Allow measured direct kernel boot on SNP i386/sev: Reorder struct declarations i386/sev: Extract build_kernel_loader_hashes i386/sev: Enable KVM_HC_MAP_GPA_RANGE hcall for SNP guests i386/kvm: Add KVM_EXIT_HYPERCALL handling for KVM_HC_MAP_GPA_RANGE i386/sev: Invoke launch_updata_data() for SNP class i386/sev: Invoke launch_updata_data() for SEV class hw/i386/sev: Add support to encrypt BIOS when SEV-SNP is enabled i386/sev: Add support for SNP CPUID validation i386/sev: Add support for populating OVMF metadata pages hw/i386/sev: Add function to get SEV metadata from OVMF header i386/sev: Set CPU state to protected once SNP guest payload is finalized i386/sev: Add handling to encrypt/finalize guest launch data i386/sev: Add the SNP launch start context i386/sev: Update query-sev QAPI format to handle SEV-SNP i386/sev: Add a class method to determine KVM VM type for SNP guests i386/sev: Don't return launch measurements for SEV-SNP guests ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-06-05hw/i386: Add support for loading BIOS using guest_memfdMichael Roth
When guest_memfd is enabled, the BIOS is generally part of the initial encrypted guest image and will be accessed as private guest memory. Add the necessary changes to set up the associated RAM region with a guest_memfd backend to allow for this. Current support centers around using -bios to load the BIOS data. Support for loading the BIOS via pflash requires additional enablement since those interfaces rely on the use of ROM memory regions which make use of the KVM_MEM_READONLY memslot flag, which is not supported for guest_memfd-backed memslots. Signed-off-by: Michael Roth <michael.roth@amd.com> Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com> Message-ID: <20240530111643.1091816-29-pankaj.gupta@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-05hw/i386/sev: Use guest_memfd for legacy ROMsMichael Roth
Current SNP guest kernels will attempt to access these regions with with C-bit set, so guest_memfd is needed to handle that. Otherwise, kvm_convert_memory() will fail when the guest kernel tries to access it and QEMU attempts to call KVM_SET_MEMORY_ATTRIBUTES to set these ranges to private. Whether guests should actually try to access ROM regions in this way (or need to deal with legacy ROM regions at all), is a separate issue to be addressed on kernel side, but current SNP guest kernels will exhibit this behavior and so this handling is needed to allow QEMU to continue running existing SNP guest kernels. Signed-off-by: Michael Roth <michael.roth@amd.com> [pankaj: Added sev_snp_enabled() check] Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com> Message-ID: <20240530111643.1091816-28-pankaj.gupta@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-05memory: Introduce memory_region_init_ram_guest_memfd()Xiaoyao Li
Introduce memory_region_init_ram_guest_memfd() to allocate private guset memfd on the MemoryRegion initialization. It's for the use case of TDVF, which must be private on TDX case. Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com> Signed-off-by: Michael Roth <michael.roth@amd.com> Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com> Message-ID: <20240530111643.1091816-4-pankaj.gupta@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-05i386/sev: Allow measured direct kernel boot on SNPDov Murik
In SNP, the hashes page designated with a specific metadata entry published in AmdSev OVMF. Therefore, if the user enabled kernel hashes (for measured direct boot), QEMU should prepare the content of hashes table, and during the processing of the metadata entry it copy the content into the designated page and encrypt it. Note that in SNP (unlike SEV and SEV-ES) the measurements is done in whole 4KB pages. Therefore QEMU zeros the whole page that includes the hashes table, and fills in the kernel hashes area in that page, and then encrypts the whole page. The rest of the page is reserved for SEV launch secrets which are not usable anyway on SNP. If the user disabled kernel hashes, QEMU pre-validates the kernel hashes page as a zero page. Signed-off-by: Dov Murik <dovmurik@linux.ibm.com> Signed-off-by: Michael Roth <michael.roth@amd.com> Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com> Message-ID: <20240530111643.1091816-24-pankaj.gupta@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-05i386/sev: Reorder struct declarationsDov Murik
Move the declaration of PaddedSevHashTable before SevSnpGuest so we can add a new such field to the latter. No functional change intended. Signed-off-by: Dov Murik <dovmurik@linux.ibm.com> Signed-off-by: Michael Roth <michael.roth@amd.com> Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com> Message-ID: <20240530111643.1091816-23-pankaj.gupta@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-05i386/sev: Extract build_kernel_loader_hashesDov Murik
Extract the building of the kernel hashes table out from sev_add_kernel_loader_hashes() to allow building it in other memory areas (for SNP support). No functional change intended. Signed-off-by: Dov Murik <dovmurik@linux.ibm.com> Signed-off-by: Michael Roth <michael.roth@amd.com> Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com> Message-ID: <20240530111643.1091816-22-pankaj.gupta@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-05i386/sev: Enable KVM_HC_MAP_GPA_RANGE hcall for SNP guestsMichael Roth
KVM will forward GHCB page-state change requests to userspace in the form of KVM_HC_MAP_GPA_RANGE, so make sure the hypercall handling is enabled for SNP guests. Signed-off-by: Michael Roth <michael.roth@amd.com> Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com> Message-ID: <20240530111643.1091816-32-pankaj.gupta@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-05i386/kvm: Add KVM_EXIT_HYPERCALL handling for KVM_HC_MAP_GPA_RANGEMichael Roth
KVM_HC_MAP_GPA_RANGE will be used to send requests to userspace for private/shared memory attribute updates requested by the guest. Implement handling for that use-case along with some basic infrastructure for enabling specific hypercall events. Signed-off-by: Michael Roth <michael.roth@amd.com> Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com> Message-ID: <20240530111643.1091816-31-pankaj.gupta@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-05i386/sev: Invoke launch_updata_data() for SNP classPankaj Gupta
Invoke as sev_snp_launch_update_data() for SNP object. Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com> Message-ID: <20240530111643.1091816-27-pankaj.gupta@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-05i386/sev: Invoke launch_updata_data() for SEV classPaolo Bonzini
Add launch_update_data() in SevCommonStateClass and invoke as sev_launch_update_data() for SEV object. Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com> Message-ID: <20240530111643.1091816-26-pankaj.gupta@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-01-22 09:57:33 +0000