Commit 65c9d60a authored by Paolo Bonzini's avatar Paolo Bonzini
Browse files

target-i386: correctly propagate retaddr into SVM helpers 



Commit 2afbdf84 ("target-i386: exception handling for memory helpers",
2015-09-15) changed tlb_fill's cpu_restore_state+raise_exception_err
to raise_exception_err_ra.  After this change, the cpu_restore_state
and raise_exception_err's cpu_loop_exit are merged into
raise_exception_err_ra's cpu_loop_exit_restore.

This actually fixed some bugs, but when SVM is enabled there is a
second path from raise_exception_err_ra to cpu_loop_exit.  This is
the VMEXIT path, and now cpu_vmexit is called without a
cpu_restore_state before.

The fix is to pass the retaddr to cpu_vmexit (via
cpu_svm_check_intercept_param).  All helpers can now use GETPC() to pass
the correct retaddr, too.

Cc: qemu-stable@nongnu.org
Fixes: 2afbdf84
Reported-by: default avatarAlexander Boettcher <alexander.boettcher@genode-labs.com>
Tested-by: default avatarAlexander Boettcher <alexander.boettcher@genode-labs.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent f47291b7

cpu-exec.c

+1 −1
Original line number Diff line number Diff line
@@ -491,7 +491,7 @@ static inline bool cpu_handle_interrupt(CPUState *cpu, 
            X86CPU *x86_cpu = X86_CPU(cpu);

            CPUArchState *env = &x86_cpu->env;

            replay_interrupt();

            cpu_svm_check_intercept_param(env, SVM_EXIT_INIT, 0);

            cpu_svm_check_intercept_param(env, SVM_EXIT_INIT, 0, 0);

            do_cpu_init(x86_cpu);

            cpu->exception_index = EXCP_HALTED;

            return true;

target/i386/cpu.h

+3 −2
Original line number Diff line number Diff line
@@ -1621,8 +1621,9 @@ void helper_lock_init(void); 


/* svm_helper.c */

void cpu_svm_check_intercept_param(CPUX86State *env1, uint32_t type,

                                   uint64_t param);

void cpu_vmexit(CPUX86State *nenv, uint32_t exit_code, uint64_t exit_info_1);

                                   uint64_t param, uintptr_t retaddr);

void cpu_vmexit(CPUX86State *nenv, uint32_t exit_code, uint64_t exit_info_1,

                uintptr_t retaddr);



/* seg_helper.c */

void do_interrupt_x86_hardirq(CPUX86State *env, int intno, int is_hw);

target/i386/excp_helper.c

+6 −5
Original line number Diff line number Diff line
@@ -39,7 +39,8 @@ void helper_raise_exception(CPUX86State *env, int exception_index) 
 * needed. It should only be called, if this is not an interrupt.

 * Returns the new exception number.

 */

static int check_exception(CPUX86State *env, int intno, int *error_code)

static int check_exception(CPUX86State *env, int intno, int *error_code,

                           uintptr_t retaddr)

{

    int first_contributory = env->old_exception == 0 ||

                              (env->old_exception >= 10 &&
@@ -53,7 +54,7 @@ static int check_exception(CPUX86State *env, int intno, int *error_code) 
#if !defined(CONFIG_USER_ONLY)

    if (env->old_exception == EXCP08_DBLE) {

        if (env->hflags & HF_SVMI_MASK) {

            cpu_vmexit(env, SVM_EXIT_SHUTDOWN, 0); /* does not return */

            cpu_vmexit(env, SVM_EXIT_SHUTDOWN, 0, retaddr); /* does not return */

        }



        qemu_log_mask(CPU_LOG_RESET, "Triple fault\n");
@@ -93,10 +94,10 @@ static void QEMU_NORETURN raise_interrupt2(CPUX86State *env, int intno, 


    if (!is_int) {

        cpu_svm_check_intercept_param(env, SVM_EXIT_EXCP_BASE + intno,

                                      error_code);

        intno = check_exception(env, intno, &error_code);

                                      error_code, retaddr);

        intno = check_exception(env, intno, &error_code, retaddr);

    } else {

        cpu_svm_check_intercept_param(env, SVM_EXIT_SWINT, 0);

        cpu_svm_check_intercept_param(env, SVM_EXIT_SWINT, 0, retaddr);

    }



    cs->exception_index = intno;

target/i386/helper.h

+0 −1
Original line number Diff line number Diff line
@@ -99,7 +99,6 @@ DEF_HELPER_2(inl, tl, env, i32) 
DEF_HELPER_FLAGS_4(bpt_io, TCG_CALL_NO_WG, void, env, i32, i32, tl)



DEF_HELPER_3(svm_check_intercept_param, void, env, i32, i64)

DEF_HELPER_3(vmexit, void, env, i32, i64)

DEF_HELPER_4(svm_check_io, void, env, i32, i32, i32)

DEF_HELPER_3(vmrun, void, env, int, int)

DEF_HELPER_1(vmmcall, void, env)

target/i386/misc_helper.c

+12 −12
Original line number Diff line number Diff line
@@ -101,7 +101,7 @@ void helper_cpuid(CPUX86State *env) 
{

    uint32_t eax, ebx, ecx, edx;



    cpu_svm_check_intercept_param(env, SVM_EXIT_CPUID, 0);

    cpu_svm_check_intercept_param(env, SVM_EXIT_CPUID, 0, GETPC());



    cpu_x86_cpuid(env, (uint32_t)env->regs[R_EAX], (uint32_t)env->regs[R_ECX],

                  &eax, &ebx, &ecx, &edx);
@@ -125,7 +125,7 @@ target_ulong helper_read_crN(CPUX86State *env, int reg) 
{

    target_ulong val;



    cpu_svm_check_intercept_param(env, SVM_EXIT_READ_CR0 + reg, 0);

    cpu_svm_check_intercept_param(env, SVM_EXIT_READ_CR0 + reg, 0, GETPC());

    switch (reg) {

    default:

        val = env->cr[reg];
@@ -143,7 +143,7 @@ target_ulong helper_read_crN(CPUX86State *env, int reg) 


void helper_write_crN(CPUX86State *env, int reg, target_ulong t0)

{

    cpu_svm_check_intercept_param(env, SVM_EXIT_WRITE_CR0 + reg, 0);

    cpu_svm_check_intercept_param(env, SVM_EXIT_WRITE_CR0 + reg, 0, GETPC());

    switch (reg) {

    case 0:

        cpu_x86_update_cr0(env, t0);
@@ -179,7 +179,7 @@ void helper_invlpg(CPUX86State *env, target_ulong addr) 
{

    X86CPU *cpu = x86_env_get_cpu(env);



    cpu_svm_check_intercept_param(env, SVM_EXIT_INVLPG, 0);

    cpu_svm_check_intercept_param(env, SVM_EXIT_INVLPG, 0, GETPC());

    tlb_flush_page(CPU(cpu), addr);

}
@@ -190,7 +190,7 @@ void helper_rdtsc(CPUX86State *env) 
    if ((env->cr[4] & CR4_TSD_MASK) && ((env->hflags & HF_CPL_MASK) != 0)) {

        raise_exception_ra(env, EXCP0D_GPF, GETPC());

    }

    cpu_svm_check_intercept_param(env, SVM_EXIT_RDTSC, 0);

    cpu_svm_check_intercept_param(env, SVM_EXIT_RDTSC, 0, GETPC());



    val = cpu_get_tsc(env) + env->tsc_offset;

    env->regs[R_EAX] = (uint32_t)(val);
@@ -208,7 +208,7 @@ void helper_rdpmc(CPUX86State *env) 
    if ((env->cr[4] & CR4_PCE_MASK) && ((env->hflags & HF_CPL_MASK) != 0)) {

        raise_exception_ra(env, EXCP0D_GPF, GETPC());

    }

    cpu_svm_check_intercept_param(env, SVM_EXIT_RDPMC, 0);

    cpu_svm_check_intercept_param(env, SVM_EXIT_RDPMC, 0, GETPC());



    /* currently unimplemented */

    qemu_log_mask(LOG_UNIMP, "x86: unimplemented rdpmc\n");
@@ -228,7 +228,7 @@ void helper_wrmsr(CPUX86State *env) 
{

    uint64_t val;



    cpu_svm_check_intercept_param(env, SVM_EXIT_MSR, 1);

    cpu_svm_check_intercept_param(env, SVM_EXIT_MSR, 1, GETPC());



    val = ((uint32_t)env->regs[R_EAX]) |

        ((uint64_t)((uint32_t)env->regs[R_EDX]) << 32);
@@ -388,7 +388,7 @@ void helper_rdmsr(CPUX86State *env) 
{

    uint64_t val;



    cpu_svm_check_intercept_param(env, SVM_EXIT_MSR, 0);

    cpu_svm_check_intercept_param(env, SVM_EXIT_MSR, 0, GETPC());



    switch ((uint32_t)env->regs[R_ECX]) {

    case MSR_IA32_SYSENTER_CS:
@@ -557,7 +557,7 @@ void helper_hlt(CPUX86State *env, int next_eip_addend) 
{

    X86CPU *cpu = x86_env_get_cpu(env);



    cpu_svm_check_intercept_param(env, SVM_EXIT_HLT, 0);

    cpu_svm_check_intercept_param(env, SVM_EXIT_HLT, 0, GETPC());

    env->eip += next_eip_addend;



    do_hlt(cpu);
@@ -569,7 +569,7 @@ void helper_monitor(CPUX86State *env, target_ulong ptr) 
        raise_exception_ra(env, EXCP0D_GPF, GETPC());

    }

    /* XXX: store address? */

    cpu_svm_check_intercept_param(env, SVM_EXIT_MONITOR, 0);

    cpu_svm_check_intercept_param(env, SVM_EXIT_MONITOR, 0, GETPC());

}



void helper_mwait(CPUX86State *env, int next_eip_addend)
@@ -580,7 +580,7 @@ void helper_mwait(CPUX86State *env, int next_eip_addend) 
    if ((uint32_t)env->regs[R_ECX] != 0) {

        raise_exception_ra(env, EXCP0D_GPF, GETPC());

    }

    cpu_svm_check_intercept_param(env, SVM_EXIT_MWAIT, 0);

    cpu_svm_check_intercept_param(env, SVM_EXIT_MWAIT, 0, GETPC());

    env->eip += next_eip_addend;



    cpu = x86_env_get_cpu(env);
@@ -597,7 +597,7 @@ void helper_pause(CPUX86State *env, int next_eip_addend) 
{

    X86CPU *cpu = x86_env_get_cpu(env);



    cpu_svm_check_intercept_param(env, SVM_EXIT_PAUSE, 0);

    cpu_svm_check_intercept_param(env, SVM_EXIT_PAUSE, 0, GETPC());

    env->eip += next_eip_addend;



    do_pause(cpu);