From a58506b748b8988a95f4fa1a2420ac5c17038b30 Mon Sep 17 00:00:00 2001 From: Richard Henderson Date: Tue, 2 Jan 2024 10:06:17 +1100 Subject: target/i386: Do not re-compute new pc with CF_PCREL With PCREL, we have a page-relative view of EIP, and an approximation of PC = EIP+CSBASE that is good enough to detect page crossings. If we try to recompute PC after masking EIP, we will mess up that approximation and write a corrupt value to EIP. We already handled masking properly for PCREL, so the fix in b5e0d5d2 was only needed for the !PCREL path. Cc: qemu-stable@nongnu.org Fixes: b5e0d5d22fbf ("target/i386: Fix 32-bit wrapping of pc/eip computation") Reported-by: Michael Tokarev Signed-off-by: Richard Henderson Message-ID: <20240101230617.129349-1-richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini --- target/i386/tcg/translate.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) (limited to 'target') diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c index e1eb82a5c6..d4d7e904ad 100644 --- a/target/i386/tcg/translate.c +++ b/target/i386/tcg/translate.c @@ -2866,10 +2866,6 @@ static void gen_jmp_rel(DisasContext *s, MemOp ot, int diff, int tb_num) } } new_eip &= mask; - new_pc = new_eip + s->cs_base; - if (!CODE64(s)) { - new_pc = (uint32_t)new_pc; - } gen_update_cc_op(s); set_cc_op(s, CC_OP_DYNAMIC); @@ -2885,6 +2881,8 @@ static void gen_jmp_rel(DisasContext *s, MemOp ot, int diff, int tb_num) tcg_gen_andi_tl(cpu_eip, cpu_eip, mask); use_goto_tb = false; } + } else if (!CODE64(s)) { + new_pc = (uint32_t)(new_eip + s->cs_base); } if (use_goto_tb && translator_use_goto_tb(&s->base, new_pc)) { -- cgit v1.2.3 From 2926eab8969908bc068629e973062a0fb6ff3759 Mon Sep 17 00:00:00 2001 From: guoguangyao Date: Mon, 15 Jan 2024 10:08:04 +0800 Subject: target/i386: fix incorrect EIP in PC-relative translation blocks The PCREL patches introduced a bug when updating EIP in the !CF_PCREL case. Using s->pc in func gen_update_eip_next() solves the problem. Cc: qemu-stable@nongnu.org Fixes: b5e0d5d22fbf ("target/i386: Fix 32-bit wrapping of pc/eip computation") Signed-off-by: guoguangyao Reviewed-by: Richard Henderson Message-ID: <20240115020804.30272-1-guoguangyao18@mails.ucas.ac.cn> Signed-off-by: Paolo Bonzini --- target/i386/tcg/translate.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'target') diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c index d4d7e904ad..cadf13bce4 100644 --- a/target/i386/tcg/translate.c +++ b/target/i386/tcg/translate.c @@ -567,9 +567,9 @@ static void gen_update_eip_next(DisasContext *s) if (tb_cflags(s->base.tb) & CF_PCREL) { tcg_gen_addi_tl(cpu_eip, cpu_eip, s->pc - s->pc_save); } else if (CODE64(s)) { - tcg_gen_movi_tl(cpu_eip, s->base.pc_next); + tcg_gen_movi_tl(cpu_eip, s->pc); } else { - tcg_gen_movi_tl(cpu_eip, (uint32_t)(s->base.pc_next - s->cs_base)); + tcg_gen_movi_tl(cpu_eip, (uint32_t)(s->pc - s->cs_base)); } s->pc_save = s->pc; } -- cgit v1.2.3 From 729ba8e933f8af5800c3a92b37e630e9bdaa9f1e Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Wed, 17 Jan 2024 16:27:42 +0100 Subject: target/i386: pcrel: store low bits of physical address in data[0] For PC-relative translation blocks, env->eip changes during the execution of a translation block, Therefore, QEMU must be able to recover an instruction's PC just from the TranslationBlock struct and the instruction data with. Because a TB will not span two pages, QEMU stores all the low bits of EIP in the instruction data and replaces them in x86_restore_state_to_opc. Bits 12 and higher (which may vary between executions of a PCREL TB, since these only use the physical address in the hash key) are kept unmodified from env->eip. The assumption is that these bits of EIP, unlike bits 0-11, will not change as the translation block executes. Unfortunately, this is incorrect when the CS base is not aligned to a page. Then the linear address of the instructions (i.e. the one with the CS base addred) indeed will never span two pages, but bits 12+ of EIP can actually change. For example, if CS base is 0x80262200 and EIP = 0x6FF4, the first instruction in the translation block will be at linear address 0x802691F4. Even a very small TB will cross to EIP = 0x7xxx, while the linear addresses will remain comfortably within a single page. The fix is simply to use the low bits of the linear address for data[0], since those don't change. Then x86_restore_state_to_opc uses tb->cs_base to compute a temporary linear address (referring to some unknown instruction in the TB, but with the correct values of bits 12 and higher); the low bits are replaced with data[0], and EIP is obtained by subtracting again the CS base. Huge thanks to Mark Cave-Ayland for the image and initial debugging, and to Gitlab user @kjliew for help with bisecting another occurrence of (hopefully!) the same bug. It should be relatively easy to write a testcase that performs MMIO on an EIP with different bits 12+ than the first instruction of the translation block; any help is welcome. Fixes: e3a79e0e878 ("target/i386: Enable TARGET_TB_PCREL", 2022-10-11) Cc: qemu-stable@nongnu.org Cc: Mark Cave-Ayland Cc: Richard Henderson Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1759 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1964 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2012 Signed-off-by: Paolo Bonzini --- target/i386/tcg/tcg-cpu.c | 20 ++++++++++++++++---- target/i386/tcg/translate.c | 1 - 2 files changed, 16 insertions(+), 5 deletions(-) (limited to 'target') diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c index 6e881e9e27..1d54164bdf 100644 --- a/target/i386/tcg/tcg-cpu.c +++ b/target/i386/tcg/tcg-cpu.c @@ -68,14 +68,26 @@ static void x86_restore_state_to_opc(CPUState *cs, X86CPU *cpu = X86_CPU(cs); CPUX86State *env = &cpu->env; int cc_op = data[1]; + uint64_t new_pc; if (tb_cflags(tb) & CF_PCREL) { - env->eip = (env->eip & TARGET_PAGE_MASK) | data[0]; - } else if (tb->flags & HF_CS64_MASK) { - env->eip = data[0]; + /* + * data[0] in PC-relative TBs is also a linear address, i.e. an address with + * the CS base added, because it is not guaranteed that EIP bits 12 and higher + * stay the same across the translation block. Add the CS base back before + * replacing the low bits, and subtract it below just like for !CF_PCREL. + */ + uint64_t pc = env->eip + tb->cs_base; + new_pc = (pc & TARGET_PAGE_MASK) | data[0]; } else { - env->eip = (uint32_t)(data[0] - tb->cs_base); + new_pc = data[0]; } + if (tb->flags & HF_CS64_MASK) { + env->eip = new_pc; + } else { + env->eip = (uint32_t)(new_pc - tb->cs_base); + } + if (cc_op != CC_OP_DYNAMIC) { env->cc_op = cc_op; } diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c index cadf13bce4..e193c74472 100644 --- a/target/i386/tcg/translate.c +++ b/target/i386/tcg/translate.c @@ -6996,7 +6996,6 @@ static void i386_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu) dc->prev_insn_end = tcg_last_op(); if (tb_cflags(dcbase->tb) & CF_PCREL) { - pc_arg -= dc->cs_base; pc_arg &= ~TARGET_PAGE_MASK; } tcg_gen_insn_start(pc_arg, dc->cc_op); -- cgit v1.2.3 From 592d0bc0302ff5b5209ecd7f8733f285bc008cff Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Wed, 13 Dec 2023 19:32:45 +0100 Subject: remove unnecessary casts from uintptr_t uintptr_t, or unsigned long which is equivalent on Linux I32LP64 systems, is an unsigned type and there is no need to further cast to __u64 which is another unsigned integer type; widening casts from unsigned integers zero-extend the value. Signed-off-by: Paolo Bonzini --- target/i386/sev.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'target') diff --git a/target/i386/sev.c b/target/i386/sev.c index 9a71246682..173de91afe 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -167,7 +167,7 @@ sev_ioctl(int fd, int cmd, void *data, int *error) input.id = cmd; input.sev_fd = fd; - input.data = (__u64)(unsigned long)data; + input.data = (uintptr_t)data; r = kvm_vm_ioctl(kvm_state, KVM_MEMORY_ENCRYPT_OP, &input); @@ -240,7 +240,7 @@ sev_ram_block_added(RAMBlockNotifier *n, void *host, size_t size, return; } - range.addr = (__u64)(unsigned long)host; + range.addr = (uintptr_t)host; range.size = max_size; trace_kvm_memcrypt_register_region(host, max_size); @@ -270,7 +270,7 @@ sev_ram_block_removed(RAMBlockNotifier *n, void *host, size_t size, return; } - range.addr = (__u64)(unsigned long)host; + range.addr = (uintptr_t)host; range.size = max_size; trace_kvm_memcrypt_unregister_region(host, max_size); @@ -767,7 +767,7 @@ sev_launch_update_data(SevGuestState *sev, uint8_t *addr, uint64_t len) return 1; } - update.uaddr = (__u64)(unsigned long)addr; + update.uaddr = (uintptr_t)addr; update.len = len; trace_kvm_sev_launch_update_data(addr, len); ret = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_UPDATE_DATA, -- cgit v1.2.3