Commit graph

282 commits

Author SHA1 Message Date
Paolo Bonzini 2f4ae94b5c
target-i386: make cpu-qom.h not target specific
Make X86CPU an opaque type within cpu-qom.h, and move all definitions of
private methods, as well as all type definitions that require knowledge
of the layout to cpu.h. This helps making files independent of NEED_CPU_H
if they only need to pass around CPU pointers.

Backports commit 4da6f8d954429c0cd1471d25cb9dbe909607374e from qemu
2018-02-24 00:55:22 -05:00
Sergey Fedorov ffdc9d6323
tcg: Allow goto_tb to any target PC in user mode
In user mode, there's only a static address translation, TBs are always
invalidated properly and direct jumps are reset when mapping change.
Thus the destination address is always valid for direct jumps and
there's no need to restrict it to the pages the TB resides in.

Backports commit 90aa39a1cc4837360889f0e033ca25cc82100308 from qemu
2018-02-23 23:12:14 -05:00
Sergey Fedorov 73c59faad5
tcg: Clean up direct block chaining safety checks
We don't take care of direct jumps when address mapping changes. Thus we
must be sure to generate direct jumps so that they always keep valid
even if address mapping changes. Luckily, we can only allow to execute a
TB if it was generated from the pages which match with current mapping.

Document tcg_gen_goto_tb() declaration and note the reason for
destination PC limitations.

Some targets with variable length instructions allow TB to straddle a
page boundary. However, we make sure that both of TB pages match the
current address mapping when looking up TBs. So it is safe to do direct
jumps into the both pages. Correct the checks for some of those targets.

Given that, we can safely patch a TB which spans two pages. Remove the
unnecessary check in cpu_exec() and allow such TBs to be patched.

Backports commit 5b053a4a28278bca606eeff7d1c0730df1b047e9 from qemu
2018-02-23 22:26:00 -05:00
Emilio G. Cota 170f6e0b3b
tb: consistently use uint32_t for tb->flags
We are inconsistent with the type of tb->flags: usage varies loosely
between int and uint64_t. Settle to uint32_t everywhere, which is
superior to both: at least one target (aarch64) uses the most significant
bit in the u32, and uint64_t is wasteful.

Compile-tested for all targets.

Backports commit 89fee74a0f066dfd73830a7b5fa137e87888c870 from qemu
2018-02-23 21:28:11 -05:00
Dave Hansen f50acc467f
target-i386: fix typo in xsetbv implementation
QEMU 2.6 added support for the XSAVE family of instructions, which
includes the XSETBV instruction which allows setting the XCR0
register.

But, when booting Linux kernels with XSAVE support enabled, I was
getting very early crashes where the instruction pointer was set
to 0x3. I tracked it down to a jump instruction generated by this:

gen_jmp_im(s->pc - pc_start);

where s->pc is pointing to the instruction after XSETBV and pc_start
is pointing _at_ XSETBV. Subtract the two and you get 0x3. Whoops.

The fix is to replace this typo with the pattern found everywhere
else in the file when folks want to end the translation buffer.

Richard Henderson confirmed that this is a bug and that this is the
correct fix.

Backports commit 502c8e86ea07294067578292c6d402601c196019 from qemu
2018-02-23 14:15:35 -05:00
Paolo Bonzini 44c4dd02c9
target-i386: key sfence availability on CPUID_SSE, not CPUID_SSE2
sfence was introduced before lfence and mfence. This fixes Linux
2.4's measurement of checksumming speeds for the pIII_sse
algorithm:

md: linear personality registered as nr 1
md: raid0 personality registered as nr 2
md: raid1 personality registered as nr 3
md: raid5 personality registered as nr 4
raid5: measuring checksumming speed
8regs : 384.400 MB/sec
32regs : 259.200 MB/sec
invalid operand: 0000
CPU: 0
EIP: 0010:[<c0240b2a>] Not tainted
EFLAGS: 00000246
eax: c15d8000 ebx: 00000000 ecx: 00000000 edx: c15d5000
esi: 8005003b edi: 00000004 ebp: 00000000 esp: c15bdf50
ds: 0018 es: 0018 ss: 0018
Process swapper (pid: 1, stackpage=c15bd000)
Stack: 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000
00000000 00000206 c0241c6c 00001000 c15d4000 c15d7000 c15d4000
c15d4000
Call Trace: [<c0241c6c>] [<c0105000>] [<c0241db4>] [<c010503b>]
[<c0105000>]
[<c0107416>] [<c0105030>]

Code: 0f ae f8 0f 10 04 24 0f 10 4c 24 10 0f 10 54 24 20 0f 10 5c
<0>Kernel panic: Attempted to kill init!

Backports commit bd5d278668f33aa08755a982986cd1159746c037 from qemu
2018-02-23 14:03:19 -05:00
Paolo Bonzini bdcea2bcb0
target-i386: check for PKU even for non-writable pages
Xiao Guangrong ran kvm-unit-tests on an actual machine with PKU and
found that it fails:

test pte.p pte.user pde.p pde.user pde.a pde.pse pkru.wd pkey=1 user write efer.nx cr4.pke: FAIL: error code 27 expected 7
Dump mapping: address: 0x123400000000
------L4: 2ebe007
------L3: 2ebf007
------L2: 8000000020000a5

(All failures are combinations of "pde.user pde.p pkru.wd pkey=1",
plus either "pde.pse" or "pte.p pte.user", plus one of "user cr0.wp",
"cr0.wp" or "user", plus unimportant bits such as accessed/dirty or
efer.nx).

So PFEC.PKEY is set even if the ordinary check failed (which it did
because pde.w is zero). Adjust QEMU to match behavior of silicon.

Backports commit 44d066a2f770ee9d61fd1c2a609bdf2a994dfdf7 from qemu
2018-02-23 13:23:37 -05:00
Chen Fan d0621f1852
cpu: Introduce X86CPUTopoInfo structure for argument simplification
In order to simplify arguments of function, introduce a new struct
named X86CPUTopoInfo.

Backports commit ed256144cd6f0ca2ff59fc3fc8dca547506f433b from qemu
2018-02-23 10:58:43 -05:00
Paolo Bonzini 1435732c0d
target-i386: implement PKE for TCG
Backports commit 0f70ed4759a29ca932af1e9525729f4f455642f8 from qemu
2018-02-22 10:18:55 -05:00
Veronia Bahaa bafc81b1d3
util: move declarations out of qemu-common.h
Move declarations out of qemu-common.h for functions declared in
utils/ files: e.g. include/qemu/path.h for utils/path.c.
Move inline functions out of qemu-common.h and into new files (e.g.
include/qemu/bcd.h)

Backports commit f348b6d1a53e5271cf1c9f9acc4646b4b98c1771 from qemu
2018-02-22 09:25:48 -05:00
Marc-André Lureau fff79ed49b
utils: rename strtosz to use qemu prefix
Not only it makes sense, but it gets rid of checkpatch warning:
WARNING: consider using qemu_strtosz in preference to strtosz

Also remove get rid of tabs to please checkpatch.

Backports commit 4677bb40f809394bef5fa07329dea855c0371697 from qemu
2018-02-22 00:17:52 -05:00
Markus Armbruster 06668850e3
include/qemu/osdep.h: Don't include qapi/error.h
Commit 57cb38b included qapi/error.h into qemu/osdep.h to get the
Error typedef. Since then, we've moved to include qemu/osdep.h
everywhere. Its file comment explains: "To avoid getting into
possible circular include dependencies, this file should not include
any other QEMU headers, with the exceptions of config-host.h,
compiler.h, os-posix.h and os-win32.h, all of which are doing a
similar job to this file and are under similar constraints."
qapi/error.h doesn't do a similar job, and it doesn't adhere to
similar constraints: it includes qapi-types.h. That's in excess of
100KiB of crap most .c files don't actually need.

Add the typedef to qemu/typedefs.h, and include that instead of
qapi/error.h. Include qapi/error.h in .c files that need it and don't
get it now. Include qapi-types.h in qom/object.h for uint16List.

Update scripts/clean-includes accordingly. Update it further to match
reality: replace config.h by config-target.h, add sysemu/os-posix.h,
sysemu/os-win32.h. Update the list of includes in the qemu/osdep.h
comment quoted above similarly.

This reduces the number of objects depending on qapi/error.h from "all
of them" to less than a third. Unfortunately, the number depending on
qapi-types.h shrinks only a little. More work is needed for that one.

Backports commit da34e65cb4025728566d6504a99916f6e7e1dd6a from qemu
2018-02-21 23:08:18 -05:00
Richard Henderson 7775b05fb8
target-i386: Dump unknown opcodes with -d unimp
We discriminate here between opcodes that are illegal in the current
cpu mode or with illegal arguments (such as modrm.mod == 3) and
encodings that are unknown (such as an unimplemented isa extension).

Backports commit b9f9c5b41aab06479cb1695990b7cca98ef84fc7 from qemu
2018-02-21 21:37:16 -05:00
Richard Henderson 1c096b8fa2
target-i386: Fix inhibit irq mask handling
The patch in 7f0b714 was too simplistic, in that we wound up setting
the flag and then resetting it immediately in gen_eob.

Fixes the reported boot problem with Windows XP.

Backports commit f083d92c03e7a0741d2a9eba774a60d5a3ca772f from qemu
2018-02-21 21:24:50 -05:00
Richard Henderson c7d5d85979
target-i386: Use gen_nop_modrm for prefetch instructions
Backports commit 26317698ef3be5942c5ee5630997dbc98431c5f6 from qemu
2018-02-21 21:22:52 -05:00
Paolo Bonzini 55c2a21fe8
target-i386: Fix addr16 prefix
While ADDSEG will only be false in 16-bit mode for LEA, it can be
false even in other cases when 16-bit addresses are obtained via
the 67h prefix in 32-bit mode. In this case, gen_lea_v_seg forgets
to add a nonzero FS or GS base if CS/DS/ES/SS are all zero. This
case is pretty rare but happens when booting Windows 95/98, and
this patch fixes it.

The bug is visible since commit d6a291498, but it was introduced
together with gen_lea_v_seg and it probably could be reproduced
with a "addr16 gs movsb" instruction as early as in commit
ca2f29f555805d07fb0b9ebfbbfc4e3656530977.

Backports commit e2e02a820741ec4d96b8f313b06a2a7ed5e94fbd from qemu
2018-02-21 21:21:26 -05:00
Richard Henderson 085a3c9aab
target-i386: Fix SMSW for 64-bit mode
In non-64-bit modes, the instruction always stores 16 bits.
But in 64-bit mode, when the destination is a register, the
instruction can write 32 or 64 bits.

Backports commit a657f79e32422634415c09f3f15c73d610297af5 from qemu
2018-02-21 21:19:33 -05:00
Paolo Bonzini a233d7b13e
target-i386: Fix SMSW and LMSW from/to register
SMSW and LMSW accept register operands, but commit 1906b2a ("target-i386:
Rearrange processing of 0F 01", 2016-02-13) did not account for that.

Backports commit 880f8486503b32a29b653a3c0b3cfc5432012f38 from qemu
2018-02-21 21:17:45 -05:00
Paolo Bonzini bdf1189046
target-i386: Avoid repeated calls to the bnd_jmp helper
Two flags were tested the wrong way.

Backports commit 8b33e82b863d1c6fce7e69a41f6c96a8e15b73fb from qemu
2018-02-21 21:13:37 -05:00
Daniel P. Berrange b97ab59f08
qom: Allow properties to be registered against classes
When there are many instances of a given class, registering
properties against the instance is wasteful of resources. The
majority of objects have a statically defined list of possible
properties, so most of the properties are easily registerable
against the class. Only those properties which are conditionally
registered at runtime need be recorded against the klass.

Registering properties against classes also makes it possible
to provide static introspection of QOM - currently introspection
is only possible after creating an instance of a class, which
severely limits its usefulness.

This impl only supports simple scalar properties. It does not
attempt to allow child object / link object properties against
the class. There are ways to support those too, but it would
make this patch more complicated, so it is left as an exercise
for the future.

There is no equivalent to object_property_del() provided, since
classes must be immutable once they are defined.

Backports commit 16bf7f522a2ff68993f80631ed86254c71eaf5d4 from qemu
2018-02-21 21:00:56 -05:00
Lioncash 6b19f43925
tcg: Make cpu_tmp1 and cpu_tmp4 a TCGv
Commit 5d4e1a1081d3f1ec2908ff0eaebe312389971ab4 allows
making the type concrete.
2018-02-21 00:07:23 -05:00
Lioncash 7caca36070
tcg: Make cpu_cc_dst, cpu_cc_src, cpu_cc_src2, and cpu_cc_srcT a TCGv
Commit 5d4e1a1081d3f1ec2908ff0eaebe312389971ab4 allows us to make the types concrete
2018-02-21 00:00:08 -05:00
Lioncash 4062dcc9bc
tcg: Make cpu_T0 and cpu_T1 TCGv
Commit 5d4e1a1081d3f1ec2908ff0eaebe312389971ab4 allows us
to make the type concrete
2018-02-20 23:51:44 -05:00
Lioncash 72170ae5c0
tcg: Make cpu_A0 a TCGv
Commit 5d4e1a1081d3f1ec2908ff0eaebe312389971ab4 allows us to make the type concrete.
2018-02-20 23:43:58 -05:00
Lioncash ccbf1ed6ed
tcg: Make cpu_regs a TCGv array
Commit eae07f4767 allows us
to make the type concrete as opposed to using void* and malloc
2018-02-20 23:41:21 -05:00
Lioncash 02b2d3c873
tcg: Make cpu_seg_base a TCGv array
Commit eae07f4767 allows us to
use the type directly instead of casting to void and using malloc
(yay).
2018-02-20 23:34:38 -05:00
Paolo Bonzini abb0408274
target-i386: fix confusion in xcr0 bit position vs. mask
The xsave and xrstor helpers are accessing the x86_ext_save_areas array
using a bit mask instead of a bit position. Provide two sets of XSTATE_*
definitions and use XSTATE_*_BIT when a bit position is requested.

Backports commit cfc3b074de4b4ccee2540edbf8cfdb026dc19943 from qemu
2018-02-20 21:00:41 -05:00
Richard Henderson 22d4f95912
target-i386: Implement FSGSBASE
Backports commit 07929f2ab2ab9c9e01d4ae79f48f2b2476b715c8 from qemu
2018-02-20 14:45:58 -05:00
Richard Henderson 6ca787fb48
target-i386: Enable CR4/XCR0 features for user-mode
Backports commit a114d25d5b42600871d75929604c0b9fcc448ec0 from qemu
2018-02-20 14:37:33 -05:00
Richard Henderson 86cc5862a1
target-i386: Clear bndregs during legacy near jumps
Backports commit 7d117ce81ef6258cdcc0d24c774d045fa4b5fd26 from qemu
2018-02-20 14:36:11 -05:00
Richard Henderson 8ca89461b5
target-i386: Implement BNDLDX, BNDSTX
Backports commit bdd87b3b591add6e4d7c6b6125fcf0d706cc8bc4 from qemu
2018-02-20 14:32:48 -05:00
Richard Henderson f30c3efd0e
target-i386: Implement BNDLDX, BNDSTX
Backports commit bdd87b3b591add6e4d7c6b6125fcf0d706cc8bc4 from qemu
2018-02-20 14:26:18 -05:00
Richard Henderson a02626afe7
target-i386: Update BNDSTATUS for exceptions raised by BOUND
Backports commit 75d14edcf5fd9d5bb614554539799abaaeab3166 from qemu
2018-02-20 14:24:07 -05:00
Richard Henderson 554c41f05f
target-i386: Implement BNDCL, BNDCU, BNDCN
Backports commit 523e28d7614571680d21641bd0bd9b9e84570cee from qemu
2018-02-20 14:22:46 -05:00
Richard Henderson c2f92123f4
target-i386: Implement BNDMOV
Backports commit 62b58ba58bfebdb8a1c447beaa1285cc21249d15 from qemu
2018-02-20 14:14:39 -05:00
Richard Henderson 8bc3037864
target-i386: Implement BNDMK
Backports commit 149b427b32de358c3bd5bc064c50acca6e9ff78f from qemu
2018-02-20 14:02:31 -05:00
Richard Henderson e11a7bcede
target-i386: Split up gen_lea_modrm
This is immediately usable by lea and multi-byte nop,
and will be required to implement parts of the mpx spec.

Backports commit a074ce42a3186bd9f96ef541bb2e01419181dae3 from qemu
2018-02-20 13:49:05 -05:00
Richard Henderson 159e837a6c
target-i386: Perform set/reset_inhibit_irq inline
With helpers that can be reused for other things.

Backports commit 7f0b7141b4c7deab51efd8ee1e83eab2d9b7a9ea from qemu
2018-02-20 13:34:47 -05:00
Richard Henderson cacb60b57b
target-i386: Enable control registers for MPX
Enable and disable at CPL changes, MSR changes, and XRSTOR changes.

Backports commit f4f1110e4b34797ddfa87bb28f9518b9256778be from qemu
2018-02-20 13:27:46 -05:00
Richard Henderson 7a7a72f49b
target-i386: Implement XSAVEOPT
Backports commit c9cfe8f9fb21f086e24b3a8f7ccd9c06e4d8d9d6 from qemu
2018-02-20 12:52:10 -05:00
Richard Henderson 6c5b6a0e7f
target-i386: Add XSAVE extension
This includes XSAVE, XRSTOR, XGETBV, XSETBV, which are all related,
as well as the associate cpuid bits.

Backports commit 19dc85dba23c0db1ca932c62e453c37e00761628 from qemu
2018-02-20 12:47:52 -05:00
Richard Henderson 6657c0c54a
target-i386: Rearrange processing of 0F AE
Rather than nesting tests of OP, MOD, and RM, decode them all at once
with a switch. Also, add some missing #UD checks for e.g. incorrect
LOCK prefix.

Backports commit 121f3157887f92268a3d6169e2d4601f9292020b from qemu
2018-02-20 12:36:54 -05:00
Richard Henderson cb536601cb
target-i386: Rearrange processing of 0F 01
Rather than nesting tests of OP, MOD, and RM, decode them
all at once with a switch. Fixes incorrect decoding of
AMD Pacifica extensions (aka vmrun et al) via op==2 path.

Backports commit 1906b2af7c2345037d9b2fdf484b457b5acd09d1 from qemu
2018-02-20 12:32:45 -05:00
Richard Henderson b490486028
target-i386: Split fxsave/fxrstor implementation
We will be able to reuse these pieces for XSAVE/XRSTOR.

Backports commit 64dbaff09bb768dbbb13142862554f18ab642866 from qemu
2018-02-20 11:58:00 -05:00
Paolo Bonzini 98452daad6
target-i386: fix PSE36 mode
(pde & 0x1fe000) is a 32-bit integer; when shifting it
into bits 39-32 the result is zero. Fix it by making the
mask (and thus the result of the AND) a 64-bit integer.

Reported by Coverity.

Backports commit 388ee48a88e684e719660a2cae9c21897b94fa37 from qemu
2018-02-20 11:03:49 -05:00
Richard Henderson 65a78ebb26
target-i386: Deconstruct the cpu_T array
All references to cpu_T are done with a constant index. It aids
readability to decompose the array into two scalar variables.

Backports commit 1d1cc4d0f481b2939c7e9f6606e571b2fc81971a from qemu
2018-02-20 11:02:34 -05:00
Richard Henderson 5d45260df7
target-i386: Tidy gen_add_A0_im
Merge gen_op_addl_A0_im and gen_op_addq_A0_im into gen_add_A0_im
and clean up the ifdef.

Replace the one remaining user of gen_op_addl_A0_im with gen_add_A0_im.

Backports commit 4e85057b92d214decf10045d3d4faa2faf33d100 from qemu
2018-02-20 10:20:04 -05:00
Richard Henderson 0004dfcba3
target-i386: Rewrite leave
Unify the code across stack pointer widths. Fix the note about
not updating ESP before the potential exception.

Backports commit 2045f04c3ae030bda650f84035f114bbd84909a9 from qemu
2018-02-20 10:16:56 -05:00
Richard Henderson 7dd4fcc621
target-i386: Rewrite gen_enter inline
Use gen_lea_v_seg for centralized segment base knowledge. Unify
code across 32- and 64-bit. Fix note about "must save state"
before using the out-of-line helpers.

Backports commit 743e398e2fbf2f7183bf7a53c9d011fabcaa1770 from qemu
2018-02-20 10:13:43 -05:00
Richard Henderson 302752df8b
target-i386: Use gen_lea_v_seg in pusha/popa
More centralization of handling of segment bases.
Also fixes the note about 16-bit wrap around not fully handled.

Backports commit d37ea0c04723f3e15fde55fe97cff6278159929b from qemu
2018-02-20 10:07:46 -05:00