aboutsummaryrefslogtreecommitdiff
path: root/target/i386/tcg/sysemu
AgeCommit message (Collapse)Author
2021-11-08target-i386: mmu: fix handling of noncanonical virtual addressesPaolo Bonzini
mmu_translate is supposed to return an error code for page faults; it is not able to handle other exceptions. The #GP case for noncanonical virtual addresses is not handled correctly, and incorrectly raised as a page fault with error code 1. Since it cannot happen for nested page tables, move it directly to handle_mmu_fault, even before the invocation of mmu_translate. Fixes: #676 Fixes: 661ff4879e ("target/i386: extract mmu_translate", 2021-05-11) Cc: qemu-stable@nongnu.org Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-11-08target-i386: mmu: use pg_mode instead of HF_LMA_MASKPaolo Bonzini
Correctly look up the paging mode of the hypervisor when it is using 64-bit mode but the guest is not. Fixes: 68746930ae ("target/i386: use mmu_translate for NPT walk", 2021-05-11) Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-09-14target/i386: Move x86_cpu_exec_interrupt() under sysemu/ folderPhilippe Mathieu-Daudé
Following the logic of commit 30493a030ff ("i386: split seg_helper into user-only and sysemu parts"), move x86_cpu_exec_interrupt() under sysemu/seg_helper.c. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-By: Warner Losh <imp@bsdimp.com> Message-Id: <20210911165434.531552-12-f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-09-13target/i386: Added vVMLOAD and vVMSAVE featureLara Lazier
The feature allows the VMSAVE and VMLOAD instructions to execute in guest mode without causing a VMEXIT. (APM2 15.33.1) Signed-off-by: Lara Lazier <laramglazier@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-09-13target/i386: Added changed priority check for VIRQLara Lazier
Writes to cr8 affect v_tpr. This could set or unset an interrupt request as the priority might have changed. Signed-off-by: Lara Lazier <laramglazier@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-09-13target/i386: Added ignore TPR check in ctl_has_irqLara Lazier
The APM2 states that if V_IGN_TPR is nonzero, the current virtual interrupt ignores the (virtual) TPR. Signed-off-by: Lara Lazier <laramglazier@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-09-13target/i386: Added VGIF V_IRQ masking capabilityLara Lazier
VGIF provides masking capability for when virtual interrupts are taken. (APM2) Signed-off-by: Lara Lazier <laramglazier@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-09-13target/i386: Moved int_ctl into CPUX86State structureLara Lazier
Moved int_ctl into the CPUX86State structure. It removes some unnecessary stores and loads, and prepares for tracking the vIRQ state even when it is masked due to vGIF. Signed-off-by: Lara Lazier <laramglazier@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-09-13target/i386: Added VGIF featureLara Lazier
VGIF allows STGI and CLGI to execute in guest mode and control virtual interrupts in guest mode. When the VGIF feature is enabled then: * executing STGI in the guest sets bit 9 of the VMCB offset 60h. * executing CLGI in the guest clears bit 9 of the VMCB offset 60h. Signed-off-by: Lara Lazier <laramglazier@gmail.com> Message-Id: <20210730070742.9674-1-laramglazier@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-09-13target/i386: VMRUN and VMLOAD canonicalizationsLara Lazier
APM2 requires that VMRUN and VMLOAD canonicalize (sign extend to 63 from 48/57) all base addresses in the segment registers that have been respectively loaded. Signed-off-by: Lara Lazier <laramglazier@gmail.com> Message-Id: <20210804113058.45186-1-laramglazier@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-08-13target/i386: Fixed size of constant for WindowsLara Lazier
~0UL has 64 bits on Linux and 32 bits on Windows. Fixes: https://gitlab.com/qemu-project/qemu/-/issues/512 Reported-by: Volker Rümelin <vr_qemu@t-online.de> Signed-off-by: Lara Lazier <laramglazier@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210812111056.26926-1-laramglazier@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-07-29target/i386: fix typo in ctl_has_irqPaolo Bonzini
The shift constant was incorrect, causing int_prio to always be zero. Signed-off-by: Lara Lazier <laramglazier@gmail.com> [Rewritten commit message since v1 had already been included. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-07-29target/i386: Added consistency checks for event injectionLara Lazier
VMRUN exits with SVM_EXIT_ERR if either: * The event injected has a reserved type. * When the event injected is of type 3 (exception), and the vector that has been specified does not correspond to an exception. This does not fix the entire exc_inj test in kvm-unit-tests. Signed-off-by: Lara Lazier <laramglazier@gmail.com> Message-Id: <20210725090855.19713-1-laramglazier@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-07-23target/i386: Added consistency checks for CR3Lara Lazier
All MBZ in CR3 must be zero (APM2 15.5) Added checks in both helper_vmrun and helper_write_crN. When EFER.LMA is zero the upper 32 bits needs to be zeroed. Signed-off-by: Lara Lazier <laramglazier@gmail.com> Message-Id: <20210723112740.45962-1-laramglazier@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-07-22target/i386: Added consistency checks for EFERLara Lazier
EFER.SVME has to be set, and EFER reserved bits must be zero. In addition the combinations * EFER.LMA or EFER.LME is non-zero and the processor does not support LM * non-zero EFER.LME and CR0.PG and zero CR4.PAE * non-zero EFER.LME and CR0.PG and zero CR0.PE * non-zero EFER.LME, CR0.PG, CR4.PAE, CS.L and CS.D are all invalid. (AMD64 Architecture Programmer's Manual, V2, 15.5) Signed-off-by: Lara Lazier <laramglazier@gmail.com> Message-Id: <20210721152651.14683-3-laramglazier@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-07-22target/i386: Added consistency checks for CR4Lara Lazier
All MBZ bits in CR4 must be zero. (APM2 15.5) Added reserved bitmask and added checks in both helper_vmrun and helper_write_crN. Signed-off-by: Lara Lazier <laramglazier@gmail.com> Message-Id: <20210721152651.14683-2-laramglazier@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-07-22target/i386: Added V_INTR_PRIO check to virtual interruptsLara Lazier
The APM2 states that The processor takes a virtual INTR interrupt if V_IRQ and V_INTR_PRIO indicate that there is a virtual interrupt pending whose priority is greater than the value in V_TPR. Signed-off-by: Lara Lazier <laramglazier@gmail.com> Message-Id: <20210721152651.14683-1-laramglazier@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-07-13target/i386: Tidy hw_breakpoint_removeDmitry Voronetskiy
Since cpu_breakpoint and cpu_watchpoint are in a union, the code should access only one of them. Signed-off-by: Dmitry Voronetskiy <davoronetskiy@gmail.com> Message-Id: <20210613180838.21349-1-davoronetskiy@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-07-12Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-tcg-20210710' ↵Peter Maydell
into staging Add translator_use_goto_tb. Cleanups in prep of breakpoint fixes. Misc fixes. # gpg: Signature made Sat 10 Jul 2021 16:29:14 BST # gpg: using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F # gpg: issuer "richard.henderson@linaro.org" # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [full] # Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A 05C0 64DF 38E8 AF7E 215F * remotes/rth-gitlab/tags/pull-tcg-20210710: (41 commits) cpu: Add breakpoint tracepoints tcg: Remove TCG_TARGET_HAS_goto_ptr accel/tcg: Log tb->cflags with -d exec accel/tcg: Split out log_cpu_exec accel/tcg: Move tb_lookup to cpu-exec.c accel/tcg: Move helper_lookup_tb_ptr to cpu-exec.c target/i386: Use cpu_breakpoint_test in breakpoint_handler tcg: Fix prologue disassembly target/xtensa: Use translator_use_goto_tb target/tricore: Use tcg_gen_lookup_and_goto_ptr target/tricore: Use translator_use_goto_tb target/sparc: Use translator_use_goto_tb target/sh4: Use translator_use_goto_tb target/s390x: Remove use_exit_tb target/s390x: Use translator_use_goto_tb target/rx: Use translator_use_goto_tb target/riscv: Use translator_use_goto_tb target/ppc: Use translator_use_goto_tb target/openrisc: Use translator_use_goto_tb target/nios2: Use translator_use_goto_tb ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-09target/i386: Use cpu_breakpoint_test in breakpoint_handlerRichard Henderson
The loop is performing a simple boolean test for the existence of a BP_CPU breakpoint at EIP. Plus it gets the iteration wrong, if we happen to have a BP_GDB breakpoint at the same address. We have a function for this: cpu_breakpoint_test. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20210620062317.1399034-1-richard.henderson@linaro.org>
2021-07-09target/i386: fix exceptions for MOV to DRPaolo Bonzini
Use raise_exception_ra (without error code) when raising the illegal opcode operation; raise #GP when setting bits 63:32 of DR6 or DR7. Move helper_get_dr to sysemu/ since it is a privileged instruction that is not needed on user-mode emulators. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-07-09target/i386: Added DR6 and DR7 consistency checksLara Lazier
DR6[63:32] and DR7[63:32] are reserved and need to be zero. (AMD64 Architecture Programmer's Manual, V2, 15.5) Signed-off-by: Lara Lazier <laramglazier@gmail.com> Message-Id: <20210705081802.18960-3-laramglazier@gmail.com> [Ignore for 32-bit builds. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-07-09target/i386: Added MSRPM and IOPM size checkLara Lazier
The address of the last entry in the MSRPM and in the IOPM must be smaller than the largest physical address. (APM2 15.10-15.11) Signed-off-by: Lara Lazier <laramglazier@gmail.com> Message-Id: <20210705081802.18960-2-laramglazier@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-06-16target/i386: Added Intercept CR0 writes checkLara Lazier
When the selective CR0 write intercept is set, all writes to bits in CR0 other than CR0.TS or CR0.MP cause a VMEXIT. Signed-off-by: Lara Lazier <laramglazier@gmail.com> Message-Id: <20210616123907.17765-5-laramglazier@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-06-16target/i386: Added consistency checks for CR0Lara Lazier
The combination of unset CD and set NW bit in CR0 is illegal. CR0[63:32] are also reserved and need to be zero. (AMD64 Architecture Programmer's Manual, V2, 15.5) Signed-off-by: Lara Lazier <laramglazier@gmail.com> Message-Id: <20210616123907.17765-4-laramglazier@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-06-16target/i386: Added consistency checks for VMRUN intercept and ASIDLara Lazier
Zero VMRUN intercept and ASID should cause an immediate VMEXIT during the consistency checks performed by VMRUN. (AMD64 Architecture Programmer's Manual, V2, 15.5) Signed-off-by: Lara Lazier <laramglazier@gmail.com> Message-Id: <20210616123907.17765-3-laramglazier@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-06-16target/i386: Refactored intercept checks into cpu_svm_has_interceptLara Lazier
Added cpu_svm_has_intercept to reduce duplication when checking the corresponding intercept bit outside of cpu_svm_check_intercept_param Signed-off-by: Lara Lazier <laramglazier@gmail.com> Message-Id: <20210616123907.17765-2-laramglazier@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-05-19target/i386: Move helper_check_io to sysemuRichard Henderson
The we never allow i/o from user-only, and the tss check that helper_check_io does will always fail. Use an ifdef within gen_check_io and return false, indicating that an exception is known to be raised. Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20210514151342.384376-50-richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-05-19target/i386: Unify invlpg, invlpgaRichard Henderson
Use a single helper, flush_page, to do the work. Use gen_svm_check_intercept. Perform the zero-extension for invlpga inline. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20210514151342.384376-43-richard.henderson@linaro.org>
2021-05-19target/i386: Move invlpg, hlt, monitor, mwait to sysemuRichard Henderson
These instructions are all privileged. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20210514151342.384376-42-richard.henderson@linaro.org>
2021-05-19target/i386: Cleanup read_crN, write_crN, lmswRichard Henderson
Pull the svm intercept check into the translator. Pull the entire implementation of lmsw into the translator. Push the check for CR8LEG into the regno validation switch. Unify the gen_io_start check between read/write. Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210514151342.384376-40-richard.henderson@linaro.org>
2021-05-19target/i386: Tidy svm_check_intercept from tcgRichard Henderson
The param argument to helper_svm_check_intercept_param is always 0; eliminate it and rename to helper_svm_check_intercept. Fold gen_svm_check_intercept_param into gen_svm_check_intercept. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20210514151342.384376-37-richard.henderson@linaro.org>
2021-05-19target/i386: Implement skinit in translate.cRichard Henderson
Our sysemu implementation is a stub. We can already intercept instructions for vmexit, and raising #UD is trivial. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20210514151342.384376-33-richard.henderson@linaro.org>
2021-05-11target/i386: use mmu_translate for NPT walkPaolo Bonzini
Unify the duplicate code between get_hphys and mmu_translate, by simply making get_hphys call mmu_translate. This also fixes the support for 5-level nested page tables. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-05-11target/i386: allow customizing the next phase of the translationPaolo Bonzini
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-05-11target/i386: extend pg_mode to more CR0 and CR4 bitsPaolo Bonzini
In order to unify the two stages of page table lookup, we need mmu_translate to use either the host CR0/EFER/CR4 or the guest's. To do so, make mmu_translate use the same pg_mode constants that were used for the NPT lookup. This also prepares for adding 5-level NPT support, which however does not work yet. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-05-11target/i386: pass cr3 to mmu_translatePaolo Bonzini
First step in unifying the nested and regular page table walk. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-05-11target/i386: extract mmu_translatePaolo Bonzini
Extract the page table lookup out of handle_mmu_fault, which only has to invoke mmu_translate and either fill the TLB or deliver the page fault. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-05-11target/i386: move paging mode constants from SVM to cpu.hPaolo Bonzini
We will reuse the page walker for both SVM and regular accesses. To do so we will build a function that receives the currently active paging mode; start by including in cpu.h the constants and the function to go from cr4/hflags/efer to the paging mode. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-05-11target/i386: merge SVM_NPTEXIT_* with PF_ERROR_* constantsPaolo Bonzini
They are the same value, and are so by design. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-05-10i386: split seg_helper into user-only and sysemu partsClaudio Fontana
Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> [claudio]: Rebased on commit 68775856 ("target/i386: svm: do not discard high 32 bits") Signed-off-by: Claudio Fontana <cfontana@suse.de> Message-Id: <20210322132800.7470-18-cfontana@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-05-10i386: split svm_helper into sysemu and stub-only userClaudio Fontana
For now we just copy over the previous user stubs, but really, everything that requires s->cpl == 0 should be impossible to trigger from user-mode emulation. Later on we should add a check that asserts this easily f.e.: static bool check_cpl0(DisasContext *s) { int cpl = s->cpl; #ifdef CONFIG_USER_ONLY assert(cpl == 3); #endif if (cpl != 0) { gen_exception(s, EXCP0D_GPF, s->pc_start - s->cs_base); return false; } return true; } Signed-off-by: Claudio Fontana <cfontana@suse.de> Cc: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210322132800.7470-17-cfontana@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-05-10i386: separate fpu_helper sysemu-only partsClaudio Fontana
create a separate tcg/sysemu/fpu_helper.c for the sysemu-only parts. For user mode, some small #ifdefs remain in tcg/fpu_helper.c which do not seem worth splitting into their own user-mode module. Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210322132800.7470-16-cfontana@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-05-10i386: split misc helper user stubs and sysemu partClaudio Fontana
Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> [claudio]: Rebased on da3f3b02("target/i386: fail if toggling LA57 in 64-bitmode") Signed-off-by: Claudio Fontana <cfontana@suse.de> Message-Id: <20210322132800.7470-15-cfontana@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-05-10i386: move TCG bpt_helper into sysemu/Claudio Fontana
for user-mode, assert that the hidden IOBPT flags are not set while attempting to generate io_bpt helpers. Signed-off-by: Claudio Fontana <cfontana@suse.de> Cc: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210322132800.7470-14-cfontana@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-05-10i386: split tcg excp_helper into sysemu and user partsClaudio Fontana
Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> [claudio]: Rebased on commit b8184135 ("target/i386: allow modifying TCG phys-addr-bits") Signed-off-by: Claudio Fontana <cfontana@suse.de> Message-Id: <20210322132800.7470-13-cfontana@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-05-10i386: split smm helper (sysemu)Claudio Fontana
smm is only really useful for sysemu, split in two modules around the CONFIG_USER_ONLY, in order to remove the ifdef and use the build system instead. add cpu_abort() when detecting attempts to enter SMM mode via SMI interrupt in user-mode, and assert that the cpu is not in SMM mode while translating RSM instructions. Signed-off-by: Claudio Fontana <cfontana@suse.de> Cc: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210322132800.7470-12-cfontana@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-05-10i386: split off sysemu-only functionality in tcg-cpuPaolo Bonzini
Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210322132800.7470-11-cfontana@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-18 06:38:40 +0000