aboutsummaryrefslogtreecommitdiff
path: root/target/i386/tcg
AgeCommit message (Collapse)Author
2021-05-10i386: split misc helper user stubs and sysemu partClaudio Fontana
Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> [claudio]: Rebased on da3f3b02("target/i386: fail if toggling LA57 in 64-bitmode") Signed-off-by: Claudio Fontana <cfontana@suse.de> Message-Id: <20210322132800.7470-15-cfontana@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-05-10i386: move TCG bpt_helper into sysemu/Claudio Fontana
for user-mode, assert that the hidden IOBPT flags are not set while attempting to generate io_bpt helpers. Signed-off-by: Claudio Fontana <cfontana@suse.de> Cc: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210322132800.7470-14-cfontana@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-05-10i386: split tcg excp_helper into sysemu and user partsClaudio Fontana
Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> [claudio]: Rebased on commit b8184135 ("target/i386: allow modifying TCG phys-addr-bits") Signed-off-by: Claudio Fontana <cfontana@suse.de> Message-Id: <20210322132800.7470-13-cfontana@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-05-10i386: split smm helper (sysemu)Claudio Fontana
smm is only really useful for sysemu, split in two modules around the CONFIG_USER_ONLY, in order to remove the ifdef and use the build system instead. add cpu_abort() when detecting attempts to enter SMM mode via SMI interrupt in user-mode, and assert that the cpu is not in SMM mode while translating RSM instructions. Signed-off-by: Claudio Fontana <cfontana@suse.de> Cc: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210322132800.7470-12-cfontana@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-05-10i386: split off sysemu-only functionality in tcg-cpuPaolo Bonzini
Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210322132800.7470-11-cfontana@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-05-10accel-cpu: make cpu_realizefn return a boolClaudio Fontana
overall, all devices' realize functions take an Error **errp, but return void. hw/core/qdev.c code, which realizes devices, therefore does: local_err = NULL; dc->realize(dev, &local_err); if (local_err != NULL) { goto fail; } However, we can improve at least accel_cpu to return a meaningful bool value. Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210322132800.7470-9-cfontana@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-05-10i386: split cpu accelerators from cpu.c, using AccelCPUClassClaudio Fontana
i386 is the first user of AccelCPUClass, allowing to split cpu.c into: cpu.c cpuid and common x86 cpu functionality host-cpu.c host x86 cpu functions and "host" cpu type kvm/kvm-cpu.c KVM x86 AccelCPUClass hvf/hvf-cpu.c HVF x86 AccelCPUClass tcg/tcg-cpu.c TCG x86 AccelCPUClass Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> [claudio]: Rebased on commit b8184135 ("target/i386: allow modifying TCG phys-addr-bits") Signed-off-by: Claudio Fontana <cfontana@suse.de> Message-Id: <20210322132800.7470-5-cfontana@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-05-10target/i386: Split out do_fsave, do_frstor, do_fxsave, do_fxrstorRichard Henderson
The helper_* functions must use GETPC() to unwind from TCG. The cpu_x86_* functions cannot, and directly calling the helper_* functions is a bug. Split out new functions that perform the work and can be used by both. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Claudio Fontana <cfontana@suse.de> Tested-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20210322132800.7470-4-cfontana@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-05-10target/i386: Rename helper_fldt, helper_fsttRichard Henderson
Change the prefix from "helper" to "do". The former should be reserved for those functions that are called from TCG; the latter is in use within the file already for those functions that are called from the helper functions, adding a "retaddr" argument. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Claudio Fontana <cfontana@suse.de> Tested-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20210322132800.7470-3-cfontana@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-04-01target/i386: Verify memory operand for lcall and ljmpRichard Henderson
These two opcodes only allow a memory operand. Lacking the check for a register operand, we used the A0 temp without initialization, which led to a tcg abort. Buglink: https://bugs.launchpad.net/qemu/+bug/1921138 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210324164650.128608-1-richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-03-19target/i386: svm: do not discard high 32 bits of EXITINFO1Paolo Bonzini
env->error_code is only 32-bits wide, so the high 32 bits of EXITINFO1 are being lost. However, even though saving guest state and restoring host state must be delayed to do_vmexit, because they might take tb_lock, it is always possible to write to the VMCB. So do this for the exit code and EXITINFO1, just like it is already being done for EXITINFO2. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-03-19target/i386: fail if toggling LA57 in 64-bit modePaolo Bonzini
This fixes kvm-unit-tests access.flat with -cpu qemu64,la57. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-03-19target/i386: allow modifying TCG phys-addr-bitsPaolo Bonzini
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-02-25tcg/i386: rdpmc: fix the the condtionsZheng Zhan Liang
Signed-off-by: Zheng Zhan Liang <linuxmaker@163.com> Message-Id: <20210225054756.35962-1-linuxmaker@163.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-02-16exec: Use cpu_untagged_addr in g2h; split out g2h_untaggedRichard Henderson
Use g2h_untagged in contexts that have no cpu, e.g. the binary loaders that operate before the primary cpu is created. As a colollary, target_mmap and friends must use untagged addresses, since they are used by the loaders. Use g2h_untagged on values returned from target_mmap, as the kernel never applies a tag itself. Use g2h_untagged on all pc values. The only current user of tags, aarch64, removes tags from code addresses upon branch, so "pc" is always untagged. Use g2h with the cpu context on hand wherever possible. Use g2h_untagged in lock_user, which will be updated soon. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210212184902.1251044-13-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-08target/i86: implement PKSPaolo Bonzini
Protection Keys for Supervisor-mode pages is a simple extension of the PKU feature that QEMU already implements. For supervisor-mode pages, protection key restrictions come from a new MSR. The MSR has no XSAVE state associated to it. PKS is only respected in long mode. However, in principle it is possible to set the MSR even outside long mode, and in fact even the XSAVE state for PKRU could be set outside long mode using XRSTOR. So do not limit the migration subsections for PKRU and PKRS to long mode. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-02-08target/i386: Fix decoding of certain BMI instructionsDavid Greenaway
This patch fixes a translation bug for a subset of x86 BMI instructions such as the following: c4 e2 f9 f7 c0 shlxq %rax, %rax, %rax Currently, these incorrectly generate an undefined instruction exception when SSE is disabled via CR4, while instructions like "shrxq" work fine. The problem appears to be related to BMI instructions encoded using VEX and with a mandatory prefix of "0x66" (data). Instructions with this data prefix (such as shlxq) are currently rejected. Instructions with other mandatory prefixes (such as shrxq) translate as expected. This patch removes the incorrect check in "gen_sse" that causes the exception to be generated. For the non-BMI cases, the check is redundant: prefixes are already checked at line 3696. Buglink: https://bugs.launchpad.net/qemu/+bug/1748296 Signed-off-by: David Greenaway <dgreenaway@google.com> Message-Id: <20210114063958.1508050-1-dgreenaway@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-02-05cpu: tcg_ops: move to tcg-cpu-ops.h, keep a pointer in CPUClassClaudio Fontana
we cannot in principle make the TCG Operations field definitions conditional on CONFIG_TCG in code that is included by both common_ss and specific_ss modules. Therefore, what we can do safely to restrict the TCG fields to TCG-only builds, is to move all tcg cpu operations into a separate header file, which is only included by TCG, target-specific code. This leaves just a NULL pointer in the cpu.h for the non-TCG builds. This also tidies up the code in all targets a bit, having all TCG cpu operations neatly contained by a dedicated data struct. Signed-off-by: Claudio Fontana <cfontana@suse.de> Message-Id: <20210204163931.7358-16-cfontana@suse.de> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-05cpu: move cc->do_interrupt to tcg_opsClaudio Fontana
Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210204163931.7358-10-cfontana@suse.de> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-05cpu: Move debug_excp_handler to tcg_opsEduardo Habkost
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210204163931.7358-8-cfontana@suse.de> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-05cpu: Move tlb_fill to tcg_opsEduardo Habkost
[claudio: wrapped target code in CONFIG_TCG] Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210204163931.7358-7-cfontana@suse.de> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-05cpu: Move cpu_exec_* to tcg_opsEduardo Habkost
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> [claudio: wrapped target code in CONFIG_TCG] Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210204163931.7358-6-cfontana@suse.de> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-05cpu: Move synchronize_from_tb() to tcg_opsEduardo Habkost
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> [claudio: wrapped target code in CONFIG_TCG, reworded comments] Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20210204163931.7358-5-cfontana@suse.de> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-05cpu: Introduce TCGCpuOperations structEduardo Habkost
The TCG-specific CPU methods will be moved to a separate struct, to make it easier to move accel-specific code outside generic CPU code in the future. Start by moving tcg_initialize(). The new CPUClass.tcg_opts field may eventually become a pointer, but keep it an embedded struct for now, to make code conversion easier. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> [claudio: move TCGCpuOperations inside include/hw/core/cpu.h] Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20210204163931.7358-2-cfontana@suse.de> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-01-12target/i386: Use X86Seg enum for segment registersPhilippe Mathieu-Daudé
Use the dedicated X86Seg enum type for segment registers. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210109233427.749748-1-f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-01-07tcg: Make tb arg to synchronize_from_tb constRichard Henderson
There is nothing within the translators that ought to be changing the TranslationBlock data, so make it const. This does not actually use the read-only copy of the data structure that exists within the rx region. Reviewed-by: Joelle van Dyne <j@getutm.app> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-01-02target/i386: Check privilege level for protected mode 'int N' task gatePeter Maydell
When the 'int N' instruction is executed in protected mode, the pseudocode in the architecture manual specifies that we need to check: * vector number within IDT limits * selected IDT descriptor is a valid type (interrupt, trap or task gate) * if this was a software interrupt then gate DPL < CPL The way we had structured the code meant that the privilege check for software interrupts ended up not in the code path taken for task gate handling, because all of the task gate handling code was in the 'case 5' of the switch which was checking "is this descriptor a valid type". Move the task gate handling code out of that switch (so that it is now purely doing the "valid type?" check) and below the software interrupt privilege check. The effect of this missing check was that in a guest userspace binary executing 'int 8' would cause a guest kernel panic rather than the userspace binary being handed a SEGV. This is essentially the same bug fixed in VirtualBox in 2012: https://www.halfdog.net/Security/2012/VirtualBoxSoftwareInterrupt0x8GuestCrash/ Note that for QEMU this is not a security issue because it is only present when using TCG. Fixes: https://bugs.launchpad.net/qemu/+bug/1813201 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20201121224445.16236-1-peter.maydell@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2020-12-18target/i386: silence the compiler warnings in gen_shiftd_rm_T1Chen Qun
The current "#ifdef TARGET_X86_64" statement affects the compiler's determination of fall through. When using -Wimplicit-fallthrough in our CFLAGS, the compiler showed warning: target/i386/translate.c: In function ‘gen_shiftd_rm_T1’: target/i386/translate.c:1773:12: warning: this statement may fall through [-Wimplicit-fallthrough=] if (is_right) { ^ target/i386/translate.c:1782:5: note: here case MO_32: ^~~~ Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20201211152426.350966-6-thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2020-12-16i386: tcg: remove inline from cpu_load_eflagsClaudio Fontana
make it a regular function. Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20201212155530.23098-9-cfontana@suse.de> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2020-12-16i386: move TCG cpu class initialization to tcg/Claudio Fontana
to do this, we need to take code out of cpu.c and helper.c, and also move some prototypes from cpu.h, for code that is needed in tcg/xxx_helper.c, and which in turn is part of the callbacks registered by the class initialization. Therefore, do some shuffling of the parts of cpu.h that are only relevant for tcg/, and put them in tcg/helper-tcg.h For FT0 and similar macros, put them in tcg/fpu-helper.c since they are used only there. Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20201212155530.23098-8-cfontana@suse.de> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2020-12-16i386: move TCG accel files into tcg/Claudio Fontana
Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> [claudio: moved cc_helper_template.h to tcg/ too] Signed-off-by: Claudio Fontana <cfontana@suse.de> Message-Id: <20201212155530.23098-6-cfontana@suse.de> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-16 21:59:04 +0000