Commit graph

137 commits

Author SHA1 Message Date
Eduardo Habkost dcb82d69e1
i386: Rename enum CacheType members
Rename DCACHE to DATA_CACHE and ICACHE to INSTRUCTION_CACHE.
This avoids conflict with Linux asm/cachectl.h macros and fixes
build failure on mips hosts.

Backports commit 5f00335aecafc9ad56592d943619d3252f8941f1 from qemu
2018-07-24 21:34:10 -04:00
Jan Kiszka f5f1d9f86b
target-i386: Add NPT support
This implements NPT suport for SVM by hooking into
x86_cpu_handle_mmu_fault where it reads the stage-1 page table. Whether
we need to perform this 2nd stage translation, and how, is decided
during vmrun and stored in hflags2, along with nested_cr3 and
nested_pg_mode.

As get_hphys performs a direct cpu_vmexit in case of NPT faults, we need
retaddr in that function. To avoid changing the signature of
cpu_handle_mmu_fault, this passes the value from tlb_fill to get_hphys
via the CPU state.

This was tested successfully via the Jailhouse hypervisor.

Backports commit fe441054bb3f0c75ff23335790342c0408e11c3a from qemu
2018-07-03 19:52:56 -04:00
Philippe Mathieu-Daudé f5698ff9a5
x86/cpu: Use definitions from qemu/units.h
Backports commit 6a4e0614c3e2ca01ac030e9c486c77d4d7225021 from qemu
2018-07-03 19:48:38 -04:00
Jan Kiszka a27161c7a0
target-i386: Mark cpu_vmexit noreturn
It calls cpu_loop_exit in system emulation mode (and should never be
called in user emulation mode).

Backports commit 50b3de6e5cd464dcc20e3a48f5a09e0299a184ac from qemu
2018-07-03 01:30:01 -04:00
Jan Kiszka fab6f4cd3a
target-i386: Allow interrupt injection after STGI
We need to terminate the translation block after STGI so that pending
interrupts can be injected.

This fixes pending NMI injection for Jailhouse which uses "stgi; clgi"
to open a brief injection window.

Backports commit df2518aa587a0157bbfbc635fe47295629d9914a from qemu
2018-07-03 01:29:43 -04:00
Jan Kiszka 7c01627388
target-i386: Add NMI interception to SVM
Check for SVM interception prior to injecting an NMI. Tested via the
Jailhouse hypervisor.

Backports commit 02f7fd25a446a220905c2e5cb0fc3655d7f63b29 from qemu
2018-07-03 01:25:29 -04:00
Richard Henderson 91359e67f9
target/i386: Fix BLSR and BLSI
The implementation of these two instructions was swapped.
At the same time, unify the setup of eflags for the insn group.

Backports commit 13672386a93fef64cfd33bd72fbf3d80f2c00e94 from qemu
2018-07-03 01:22:04 -04:00
Babu Moger ec6b1f1554
i386: Enable TOPOEXT feature on AMD EPYC CPU
Enable TOPOEXT feature on EPYC CPU. This is required to support
hyperthreading on VM guests. Also extend xlevel to 0x8000001E.

Disable topoext on PC_COMPAT_2_12 and keep xlevel 0x8000000a.

Backports commit e00516475c270dcb6705753da96063f95699abf2 from qemu
2018-07-03 00:32:50 -04:00
Babu Moger b5f47a4884
i386: Fix up the Node id for CPUID_8000_001E
This is part of topoext support. To keep the compatibility, it is better
we support all the combination of nr_cores and nr_threads currently
supported. By allowing more nr_cores and nr_threads, we might end up with
more nodes than we can actually support with the real hardware. We need to
fix up the node id to make this work. We can achieve this by shifting the
socket_id bits left to address more nodes.

Backports commit 631be32155dbafa1fe886f2488127956c9120ba6 from qemu
2018-07-03 00:31:38 -04:00
Konrad Rzeszutek Wilk 475062aca9
i386: Define AMD's no SSB mitigation needed.
AMD future CPUs expose a mechanism to tell the guest that the
Speculative Store Bypass Disable is not needed and that the
CPU is all good.

This is exposed via the CPUID 8000_0008.EBX[26] bit.

See 124441_AMD64_SpeculativeStoreBypassDisable_Whitepaper_final.pdf

A copy of this document is available at
https://bugzilla.kernel.org/show_bug.cgi?id=199889

Backports commit 254790a909a2f153d689bfa7d8e8f0386cda870d from qemu
2018-07-03 00:24:58 -04:00
Konrad Rzeszutek Wilk 0023d048aa
i386: define the AMD 'amd-ssbd' CPUID feature bit
AMD future CPUs expose _two_ ways to utilize the Intel equivalant
of the Speculative Store Bypass Disable. The first is via
the virtualized VIRT_SPEC CTRL MSR (0xC001_011f) and the second
is via the SPEC_CTRL MSR (0x48). The document titled:
124441_AMD64_SpeculativeStoreBypassDisable_Whitepaper_final.pdf

gives priority of SPEC CTRL MSR over the VIRT SPEC CTRL MSR.

A copy of this document is available at
https://bugzilla.kernel.org/show_bug.cgi?id=199889

Anyhow, this means that on future AMD CPUs there will be _two_ ways to
deal with SSBD.

Backports commit a764f3f7197f4d7ad8fe8424269933de912224cb from qemu
2018-07-03 00:24:24 -04:00
Eduardo Habkost bffd8c6244
i386: Remove ospke CPUID flag name
OSPKE is not a static feature flag: it changes dynamically at
runtime depending on CR4, and it was never configurable: KVM
never returned OSPKE on GET_SUPPORTED_CPUID, and on TCG enables
it automatically if CR4_PKE_MASK is set.

Remove OSPKE from the feature name array so users don't try to
configure it manually.

Backports commit 9ccb9784b57804f5c74434ad6ccb66650a015ffc from qemu
2018-07-03 00:23:33 -04:00
Eduardo Habkost f294aa7cb5
i386: Remove osxsave CPUID flag name
OSXAVE is not a static feature flag: it changes dynamically at
runtime depending on CR4, and it was never configurable: KVM
never returned OSXSAVE on GET_SUPPORTED_CPUID, and it is not
included in TCG_EXT_FEATURES.

Remove OSXSAVE from the feature name array so users don't try to
configure it manually.

Backports commit f1a23522b03a569f13aad49294bb4c4b1a9500c7 from qemu
2018-07-03 00:22:32 -04:00
Babu Moger c07a5c06e7
i386: Add support for CPUID_8000_001E for AMD
Add support for cpuid leaf CPUID_8000_001E. Build the config that closely
match the underlying hardware. Please refer to the Processor Programming
Reference (PPR) for AMD Family 17h Model for more details.

Backports commit ed78467a214595a63af7800a073a03ffe37cd7db from qemu
2018-07-03 00:21:23 -04:00
Babu Moger d4ad9e37a2
i386: Populate AMD Processor Cache Information for cpuid 0x8000001D
Add information for cpuid 0x8000001D leaf. Populate cache topology information
for different cache types (Data Cache, Instruction Cache, L2 and L3) supported
by 0x8000001D leaf. Please refer to the Processor Programming Reference (PPR)
for AMD Family 17h Model for more details.

Backports commit 8f4202fb1080f86958782b1fca0bf0279f67d136 from qemu
2018-06-15 11:52:28 -04:00
Eduardo Habkost 7837f23cd9
i386: Clean up cache CPUID code
Always initialize CPUCaches structs with cache information, even
if legacy_cache=true. Use different CPUCaches struct for
CPUID[2], CPUID[4], and the AMD CPUID leaves.

This will simplify a lot the logic inside cpu_x86_cpuid()

Backports commit a9f27ea9adc8c695197bd08f2e938ef7b4183f07 from qemu
2018-06-15 11:51:09 -04:00
Richard Henderson 10e2b13650
tcg: Pass tb and index to tcg_gen_exit_tb separately
Do the cast to uintptr_t within the helper, so that the compiler
can type check the pointer argument. We can also do some more
sanity checking of the index argument.

Backports commit 07ea28b41830f946de3841b0ac61a3413679feb9 from qemu
2018-06-07 11:56:32 -04:00
Konrad Rzeszutek Wilk a08dcb8aa6
i386: define the AMD 'virt-ssbd' CPUID feature bit (CVE-2018-3639)
AMD Zen expose the Intel equivalant to Speculative Store Bypass Disable
via the 0x80000008_EBX[25] CPUID feature bit.

This needs to be exposed to guest OS to allow them to protect
against CVE-2018-3639.

Backports commit 403503b162ffc33fb64cfefdf7b880acf41772cd from qemu
2018-05-22 16:58:25 -04:00
Konrad Rzeszutek Wilk 860411e045
i386: Define the Virt SSBD MSR and handling of it (CVE-2018-3639)
"Some AMD processors only support a non-architectural means of enabling
speculative store bypass disable (SSBD). To allow a simplified view of
this to a guest, an architectural definition has been created through a new
CPUID bit, 0x80000008_EBX[25], and a new MSR, 0xc001011f. With this, a
hypervisor can virtualize the existence of this definition and provide an
architectural method for using SSBD to a guest.

Add the new CPUID feature, the new MSR and update the existing SSBD
support to use this MSR when present." (from x86/speculation: Add virtualized
speculative store bypass disable support in Linux).

Backports commit cfeea0c021db6234c154dbc723730e81553924ff from qemu
2018-05-22 16:57:39 -04:00
Daniel P. Berrangé 795bcc7de3
i386: define the 'ssbd' CPUID feature bit (CVE-2018-3639)
New microcode introduces the "Speculative Store Bypass Disable"
CPUID feature bit. This needs to be exposed to guest OS to allow
them to protect against CVE-2018-3639.

Backports commit d19d1f965904a533998739698020ff4ee8a103da from qemu
2018-05-22 16:56:41 -04:00
Emilio G. Cota 7e8902eccc
tcg: fix s/compliment/complement/ typos
Backports commit 1d349821551c2da4dfefe36c6ac17319f33ebbd5 from qemu
2018-05-22 00:29:51 -04:00
Babu Moger 5091ebe6fb
i386: Add new property to control cache info
The property legacy-cache will be used to control the cache information.
If user passes "-cpu legacy-cache" then older information will
be displayed even if the hardware supports new information. Otherwise
use the statically loaded cache definitions if available.

Renamed the previous cache structures to legacy_*. If there is any change in
the cache information, then it needs to be initialized in builtin_x86_defs.

Backports commit ab8f992e3e63e91be257e4e343d386dae7be4bcb from qemu
2018-05-17 19:04:56 -04:00
Babu Moger 1add2da704
i386: Initialize cache information for EPYC family processors
Initialize pre-determined cache information for EPYC processors.

Backports commit fe52acd2a054b97765963a42037f2f886545e30c from qemu
2018-05-17 19:01:19 -04:00
Babu Moger c5b8a6a704
i386: Add cache information in X86CPUDefinition
Add cache information in X86CPUDefinition and CPUX86State.

Backports commit 6aaeb05492ef668f415324f43e7d875c0f1e90b3 from qemu
2018-05-17 18:56:12 -04:00
Eduardo Habkost db87beaaa6
i386: Helpers to encode cache information consistently
Instead of having a collection of macros that need to be used in
complex expressions to build CPUID data, define a CPUCacheInfo
struct that can hold information about a given cache. Helper
functions will take a CPUCacheInfo struct as input to encode
CPUID leaves for a cache.

This will help us ensure consistency between cache information
CPUID leaves, and make the existing inconsistencies in CPUID info
more visible.

Backports commit 7e3482f824809e1f6ffeb5bb8103ba27a7d1a52a from qemu
2018-05-17 18:54:29 -04:00
Jingqi Liu 9c93f3f530
x86/cpu: Enable CLDEMOTE(Demote Cache Line) cpu feature
The CLDEMOTE instruction hints to hardware that the cache line that
contains the linear address should be moved("demoted") from
the cache(s) closest to the processor core to a level more distant
from the processor core. This may accelerate subsequent accesses
to the line by other cores in the same coherence domain,
especially if the line was written by the core that demotes the line.

Intel Snow Ridge has added new cpu feature, CLDEMOTE.
The new cpu feature needs to be exposed to guest VM.

The bit definition:
CPUID.(EAX=7,ECX=0):ECX[bit 25] CLDEMOTE

The release document ref below link:
https://software.intel.com/sites/default/files/managed/c5/15/\
architecture-instruction-set-extensions-programming-reference.pdf

Backports commit 0da0fb062841d0dcd8ba47e4a989d2e952cdf0ff from qemu
2018-05-17 18:37:17 -04:00
Boqun Feng 09b42d05fe
i386: add KnightsMill cpu model
A new cpu model called "KnightsMill" is added to model Knights Mill
processors. Compared to "Skylake-Server" cpu model, the following
features are added:

avx512_4vnniw avx512_4fmaps avx512pf avx512er avx512_vpopcntdq

and the following features are removed:

pcid invpcid clflushopt avx512dq avx512bw clwb smap rtm mpx
xsavec xgetbv1 hle

Backports commit a18495159a35e9c5973d9aa0f612a97318bf684d from qemu
2018-05-17 18:35:37 -04:00
Emilio G. Cota d26bf1d446
translator: merge max_insns into DisasContextBase
While at it, use int for both num_insns and max_insns to make
sure we have same-type comparisons.

Backports commit b542683d77b4f56cef0221b267c341616d87bce9 from qemu
2018-05-11 13:59:17 -04:00
Pavel Dovgalyuk b4bf3c776b
icount: fix cpu_restore_state_from_tb for non-tb-exit cases
In icount mode, instructions that access io memory spaces in the middle
of the translation block invoke TB recompilation. After recompilation,
such instructions become last in the TB and are allowed to access io
memory spaces.

When the code includes instruction like i386 'xchg eax, 0xffffd080'
which accesses APIC, QEMU goes into an infinite loop of the recompilation.

This instruction includes two memory accesses - one read and one write.
After the first access, APIC calls cpu_report_tpr_access, which restores
the CPU state to get the current eip. But cpu_restore_state_from_tb
resets the cpu->can_do_io flag which makes the second memory access invalid.
Therefore the second memory access causes a recompilation of the block.
Then these operations repeat again and again.

This patch moves resetting cpu->can_do_io flag from
cpu_restore_state_from_tb to cpu_loop_exit* functions.

It also adds a parameter for cpu_restore_state which controls restoring
icount. There is no need to restore icount when we only query CPU state
without breaking the TB. Restoring it in such cases leads to the
incorrect flow of the virtual time.

In most cases new parameter is true (icount should be recalculated).
But there are two cases in i386 and openrisc when the CPU state is only
queried without the need to break the TB. This patch fixes both of
these cases.

Backports commit afd46fcad2dceffda35c0586f5723c127b6e09d8 from qemu
2018-04-11 20:05:40 -04:00
Eugene Minibaev 87180dd231
Add missing bit for SSE instr in VEX decoding
The 2-byte VEX prefix imples a leading 0Fh opcode byte.

Backports commit e0014d4b3a955cfd8d517674703bfa87f340290a from qemu
2018-04-10 08:49:15 -04:00
Alexandro Sanchez Bach 4a1de154ef
target/i386: Fix andn instruction
In commit 7073fbada733c8d10992f00772c9b9299d740e9b, the `andn` instruction
was implemented via `tcg_gen_andc` but passes the operands in the wrong
order:
- X86 defines `andn dest,src1,src2` as: dest = ~src1 & src2
- TCG defines `andc dest,src1,src2` as: dest = src1 & ~src2

The following simple test shows the issue:

int main(void) {
uint32_t ret = 0;
__asm (
"mov $0xFF00, %%ecx\n"
"mov $0x0F0F, %%eax\n"
"andn %%ecx, %%eax, %%ecx\n"
"mov %%ecx, %0\n"
: "=r" (ret));
printf("%08X\n", ret);
return 0;
}

This patch fixes the problem by simply swapping the order of the two last
arguments in `tcg_gen_andc_tl`.

Backports commit 5cd10051c2e02b7a86eae49919d6c65a87dbea46 from qemu
2018-04-10 08:48:05 -04:00
Bharata B Rao e373c001fa
cpu: Add Error argument to cpu_exec_init()
Add an Error argument to cpu_exec_init() to let users collect the
error. This is in preparation to change the CPU enumeration logic
in cpu_exec_init(). With the new enumeration logic, cpu_exec_init()
can fail if cpu_index values corresponding to max_cpus have already
been handed out.

Since all current callers of cpu_exec_init() are from instance_init,
use error_abort Error argument to abort in case of an error.

Backports commit 5a790cc4b942e651fec7edc597c19b637fad5a76 from qemu
2018-03-21 07:50:33 -04:00
Luwei Kang 30d878a0ef
i386: Disable Intel PT if packets IP payloads have LIP values
Intel processor trace should be disabled when
CPUID.(EAX=14H,ECX=0H).ECX.[bit31] is set.
Generated packets which contain IP payloads will have LIP
values when this bit is set, or IP payloads will have RIP
values.
Currently, The information of CPUID 14H is constant to make
live migration safty and this bit is always 0 in guest even
if host support LIP values.
Guest sees the bit is 0 will expect IP payloads with RIP
values, but the host CPU will generate IP payloads with
LIP values if this bit is set in HW.
To make sure the value of IP payloads correctly, Intel PT
should be disabled when bit[31] is set.

Backports relevant parts of commit c078ca968c6c7cb62781c1843d840cb0f5c72781 from qemu
2018-03-20 14:25:40 -04:00
Igor Mammedov cd27da0d88
cpu: get rid of unused cpu_init() defines
cpu_init(cpu_model) were replaced by cpu_create(cpu_type) so
no users are left, remove it.

Backports commit 3f71e724e283233753f1b5b3d6a30948d3084636 from qemu
2018-03-20 14:21:45 -04:00
Igor Mammedov 20f67e8f9a
pc: use generic cpu_model parsing
define default CPU type in generic way in pc_machine_class_init()
and let common machine code to handle cpu_model parsing

Patch also introduces TARGET_DEFAULT_CPU_TYPE define for 2 purposes:
* make foo_machine_class_init() look uniform on every target
* use define in [bsd|linux]-user targets to pick default
cpu type

Backports commit 311ca98d16bbb6a2a38b38ba898baa4a4d4ab9a7 from qemu
2018-03-20 13:22:05 -04:00
Igor Mammedov 9c5153270f
i386: keep cpu_model field in MachineState uptodate
Considering that features are converted to global properties and
global properties are automatically applied to every new instance
of created CPU (at object_new() time), there is no point in
parsing cpu_model string every time a CPU created. So move
parsing outside CPU creation loop and do it only once.

Parsing also should be done before any CPU is created so that
features would affect the first CPU a well.

Backports commit 6aff24c6a61c6fec31e555c7748ba6085b7b2c06 from qemu
2018-03-20 12:40:35 -04:00
Igor Mammedov 8344a5a63c
pc: Parse CPU features only once
Considering that features are converted to global properties and
global properties are automatically applied to every new instance
of created CPU (at object_new() time), there is no point in
parsing cpu_model string every time a CPU created. So move
parsing outside CPU creation loop and do it only once.

Parsing also should be done before any CPU is created so that
features would affect the first CPU a well.

Backports commit 6aff24c6a61c6fec31e555c7748ba6085b7b2c06 from qemu
2018-03-20 12:27:44 -04:00
Igor Mammedov 87db6e033b
cpu: Use CPUClass->parse_features() as convertor to global properties
Currently CPUClass->parse_features() is used to parse -cpu
features string and set properties on created CPU instances.

But considering that features specified by -cpu apply to every
created CPU instance, it doesn't make sense to parse the same
features string for every CPU created. It also makes every target
that cares about parsing features string explicitly call
CPUClass->parse_features() parser, which gets in a way if we
consider using generic device_add for CPU hotplug as device_add
has not a clue about CPU specific hooks.

Turns out we can use global properties mechanism to set
properties on every created CPU instance for a given type. That
way it's possible to convert CPU features into a set of global
properties for CPU type specified by -cpu cpu_model and common
Device.device_post_init() will apply them to CPU of given type
automatically regardless whether it's manually created CPU or CPU
created with help of device_add.

Backports commits 62a48a2a5798425997152dea3fc48708f9116c04 and
f313369fdb78f849ecbbd8e5d88f01ddf38786c8 from qemu
2018-03-20 12:00:27 -04:00
Igor Mammedov f86355f82c
cpu: add CPU_RESOLVING_TYPE macro
it will be used for providing to cpu name resolving class for
parsing cpu model for system and user emulation code.

Along with change add target to null-machine tests, so
that when switch to CPU_RESOLVING_TYPE happens,
it would ensure that null-machine usecase still works.

Backports commit 0dacec874fa3b3fd34b0d0670fa257efdcbbebd0 from qemu
2018-03-20 11:28:13 -04:00
Eduardo Habkost 074865ff98
cpu: Generify CPU init functions
Backports commits 2994fd96d986578a342f2342501b4ad30f6d0a85,
701e3c78ce45fa630ffc6826c4b9a4218954bc7f, and
d1853231c60d16af78cf4d1608d043614bfbac0b from qemuu
2018-03-20 08:21:51 -04:00
Peter Crosthwaite ce1831bfb4
target-*: Don't redefine cpu_exec()
This function needs to be converted to QOM hook and virtualised for
multi-arch. This rename interferes, as cpu-qom will not have access
to the renaming causing name divergence. This rename doesn't really do
anything anyway so just delete it.

Backports commit 8642c1b81e0418df066a7960a7426d85a923a253 from qemu
2018-03-20 07:02:47 -04:00
Igor Mammedov 15eb359656
numa: move numa_node from CPUState into target specific classes
Move vcpu's associated numa_node field out of generic CPUState
into inherited classes that actually care about cpu<->numa mapping,
i.e: ARMCPU, PowerPCCPU, X86CPU.

Backports relevant parts of commit 15f8b14228b856850df3fa5ba999ad96521f2208 from qemu
2018-03-20 06:46:20 -04:00
Chao Peng a64b7f0d3f
i386: Add support to get/set/migrate Intel Processor Trace feature
Add Intel Processor Trace related definition. It also add
corresponding part to kvm_get/set_msr and vmstate.

Backports commit b77146e9a129bcdb60edc23639211679ae846a92 from qemu
2018-03-17 19:11:21 -04:00
Chao Peng da2d5108ee
i386: Add Intel Processor Trace feature support
Expose Intel Processor Trace feature to guest.

To make Intel PT live migration safe and get same CPUID information
with same CPU model on diffrent host. CPUID[14] is constant in this
patch. Intel PT use EPT is first supported in IceLake, the CPUID[14]
get on this machine as default value. Intel PT would be disabled
if any machine don't support this minial feature list.

Backports commit e37a5c7fa459558b5020588994707fe3fdd6616e from qemu
2018-03-17 19:10:30 -04:00
Wanpeng Li f0701e6dd5
target-i386: add KVM_HINTS_DEDICATED performance hint
Add KVM_HINTS_DEDICATED performance hint, guest checks this feature bit
to determine if they run on dedicated vCPUs, allowing optimizations such
as usage of qspinlocks.

Backports commit be7773268d98176489483a315d3e2323cb0615b9 from qemu
2018-03-17 19:07:19 -04:00
Liran Alon 9fbdd8d885
KVM: x86: Add support for save/load MSR_SMI_COUNT
This MSR returns the number of #SMIs that occurred on
CPU since boot.

KVM commit 52797bf9a875 ("KVM: x86: Add emulation of MSR_SMI_COUNT")
introduced support for emulating this MSR.

This commit adds support for QEMU to save/load this
MSR for migration purposes.

Backports relevant parts of commit e13713db5b609d9a83c9cfc8ba389d4215d4ba29 from qemu
2018-03-17 19:02:31 -04:00
Brijesh Singh 624391bdc8
cpu/i386: populate CPUID 0x8000_001F when SEV is active
When SEV is enabled, CPUID 0x8000_001F should provide additional
information regarding the feature (such as which page table bit is used
to mark the pages as encrypted etc).

The details for memory encryption CPUID is available in AMD APM
(https://support.amd.com/TechDocs/24594.pdf) Section E.4.17

Backports relevant parts of commit 6cb8f2a663a47c6e0da17fc4fb9e06abfda2bd48 from qemu
2018-03-17 19:00:59 -04:00
Lioncash c169f3dc5d
target/i386: Correct X86_CPU macro parameters in x86_cpu_handle_mmu_fault() in helper.c 2018-03-17 18:30:46 -04:00
Lioncash e9d9ed5eaa
target/i386/bpt_helper: Perform comparison pass with qemu
Keep formatting and code in sync where applicable
2018-03-12 13:28:50 -04:00
Lioncash fc7eaf7f77
target/i386/svm_helper: Perform comparison pass with qemu
Keep code and formatting in sync where applicable
2018-03-12 13:27:03 -04:00