[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH] SVM support
|
From: |
Alexander Graf |
|
Subject: |
[Qemu-devel] [PATCH] SVM support |
|
Date: |
Thu, 30 Aug 2007 16:54:15 +0200 |
|
User-agent: |
Thunderbird 2.0.0.4 (X11/20070613) |
Hi,
after a lot of struggling I finally got everything working smoothly
(special thanks to Fabrice and Avi), so I believe this patch is ready to
be taken upstream.
CC_DST was never a problem, as everything I did in the eflags area
already worked. I managed to clobber the segment attributes though, so
that was the real problem here.
Nevertheless there is still a lot of functionality missing, whereas none
of that is used in kvm by now, so that works already.
So there are still missing parts that I will list here:
- NPT support
- Everything related to device virtualisation
- The "Secure" part of the extension (would need TPM emulation for that)
- Debugging support (maybe it does work, I actually have never tried to
debug a kvm virtualised machine)
- TSC_OFFSET
- ASID support
- Sanity checks
- Task switch and Ferr_Freeze Intercepts
- VMMCALL
- SMM support
- SVM-Lock
Most of these features are optional or not used by any software I know
of today, so it does not hurt (yet).
I'm really sorry that this patch is so big. I already tried to make it
as small as I could, but this feature is heavy.
In case it is too big, I can try to split it up into several patches.
Thanks a lot,
Alexander Graf
Index: qemu/target-i386/helper2.c
===================================================================
--- qemu.orig/target-i386/helper2.c
+++ qemu/target-i386/helper2.c
@@ -27,6 +27,7 @@
#include "cpu.h"
#include "exec-all.h"
+#include "svm.h"
//#define DEBUG_MMU
@@ -111,6 +112,7 @@ CPUX86State *cpu_x86_init(void)
CPUID_CX8 | CPUID_PGE | CPUID_CMOV |
CPUID_PAT);
env->pat = 0x0007040600070406ULL;
+ env->cpuid_ext3_features = CPUID_EXT3_SVM;
env->cpuid_ext_features = CPUID_EXT_SSE3;
env->cpuid_features |= CPUID_FXSR | CPUID_MMX | CPUID_SSE | CPUID_SSE2
| CPUID_PAE | CPUID_SEP;
env->cpuid_features |= CPUID_APIC;
@@ -131,7 +133,7 @@ CPUX86State *cpu_x86_init(void)
/* currently not enabled for std i386 because not fully tested */
env->cpuid_ext2_features = (env->cpuid_features & 0x0183F3FF);
env->cpuid_ext2_features |= CPUID_EXT2_LM | CPUID_EXT2_SYSCALL |
CPUID_EXT2_NX;
- env->cpuid_xlevel = 0x80000008;
+ env->cpuid_xlevel = 0x8000000a;
/* these features are needed for Win64 and aren't fully implemented */
env->cpuid_features |= CPUID_MTRR | CPUID_CLFLUSH | CPUID_MCA;
@@ -160,6 +162,7 @@ void cpu_reset(CPUX86State *env)
#ifdef CONFIG_SOFTMMU
env->hflags |= HF_SOFTMMU_MASK;
#endif
+ env->hflags |= HF_GIF_MASK;
cpu_x86_update_cr0(env, 0x60000010);
env->a20_mask = 0xffffffff;
@@ -863,7 +866,6 @@ int cpu_x86_handle_mmu_fault(CPUX86State
do_fault_protect:
error_code = PG_ERROR_P_MASK;
do_fault:
- env->cr[2] = addr;
error_code |= (is_write << PG_ERROR_W_BIT);
if (is_user)
error_code |= PG_ERROR_U_MASK;
@@ -871,8 +873,15 @@ int cpu_x86_handle_mmu_fault(CPUX86State
(env->efer & MSR_EFER_NXE) &&
(env->cr[4] & CR4_PAE_MASK))
error_code |= PG_ERROR_I_D_MASK;
+ if (INTERCEPTEDl(_exceptions, 1 << EXCP0E_PAGE)) {
+ stq_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2),
addr);
+ } else {
+ env->cr[2] = addr;
+ }
env->error_code = error_code;
env->exception_index = EXCP0E_PAGE;
+ if (INTERCEPTEDl(_exceptions, 1 << EXCP0E_PAGE)) // the VMM will handle
this
+ return 2;
return 1;
}
Index: qemu/target-i386/translate.c
===================================================================
--- qemu.orig/target-i386/translate.c
+++ qemu/target-i386/translate.c
@@ -77,6 +77,7 @@ typedef struct DisasContext {
static state change (stop translation) */
/* current block context */
target_ulong cs_base; /* base of CS segment */
+ uint64_t intercept; /* SVM intercept vector */
int pe; /* protected mode */
int code32; /* 32 bit code segment */
#ifdef TARGET_X86_64
@@ -1995,6 +1996,84 @@ static void gen_movl_seg_T0(DisasContext
}
}
+#ifdef TARGET_X86_64
+#define SVM_movq_T1_im(x) gen_op_movq_T1_im64((x) >> 32, x)
+#else
+#define SVM_movq_T1_im(x) gen_op_movq_T1_im(x)
+#endif
+
+static inline int gen_svm_check_io(DisasContext *s, target_ulong pc_start,
uint64_t type) {
+ if(s->intercept & (1ULL << INTERCEPT_IOIO_PROT)) {
+ if (s->cc_op != CC_OP_DYNAMIC)
+ gen_op_set_cc_op(s->cc_op);
+ SVM_movq_T1_im(s->pc - s->cs_base);
+ gen_jmp_im(pc_start - s->cs_base);
+ gen_op_geneflags();
+ gen_op_svm_check_intercept_io((uint32_t)(type >> 32), (uint32_t)type);
+ s->cc_op = CC_OP_DYNAMIC;
+ // FIXME: maybe we could move the io intercept vector to env as well
+ // so we know if this is an EOB or not ... let's assume it's not
+ // for now
+ }
+ return 0;
+}
+
+static inline int svm_is_rep(int prefixes) {
+ return ((prefixes & (PREFIX_REPZ | PREFIX_REPNZ)) ? 8 : 0);
+}
+
+static inline int gen_svm_check_intercept_param(DisasContext *s, target_ulong
pc_start, uint64_t type, uint64_t param) {
+ if(!(s->intercept & (INTERCEPT_SVM_MASK))) return 0; // no SVM activated
+ switch(type) {
+ case SVM_EXIT_READ_CR0 ... SVM_EXIT_EXCP_BASE - 1: // CRx and DRx
reads/writes
+ if (s->cc_op != CC_OP_DYNAMIC) {
+ gen_op_set_cc_op(s->cc_op);
+ s->cc_op = CC_OP_DYNAMIC;
+ }
+ gen_jmp_im(pc_start - s->cs_base);
+ SVM_movq_T1_im(param);
+ gen_op_geneflags();
+ gen_op_svm_check_intercept_param((uint32_t)(type >> 32),
(uint32_t)type);
+ // this is a special case as we do not know if the interception
occurs
+ // so we assume there was none
+ return 0;
+ case SVM_EXIT_MSR:
+ if(s->intercept & (1ULL << INTERCEPT_MSR_PROT)) {
+ if (s->cc_op != CC_OP_DYNAMIC) {
+ gen_op_set_cc_op(s->cc_op);
+ s->cc_op = CC_OP_DYNAMIC;
+ }
+ gen_jmp_im(pc_start - s->cs_base);
+ SVM_movq_T1_im(param);
+ gen_op_geneflags();
+ gen_op_svm_check_intercept_param((uint32_t)(type >> 32),
(uint32_t)type);
+ // this is a special case as we do not know if the
interception occurs
+ // so we assume there was none
+ return 0;
+ }
+ break;
+ default:
+ if(s->intercept & (1ULL << (type - SVM_EXIT_INTR))) {
+ if (s->cc_op != CC_OP_DYNAMIC) {
+ gen_op_set_cc_op(s->cc_op);
+ s->cc_op = CC_OP_EFLAGS;
+ }
+ gen_jmp_im(pc_start - s->cs_base);
+ SVM_movq_T1_im(param);
+ gen_op_geneflags();
+ gen_op_svm_vmexit(type >> 32, type);
+ // we can optimize this one so TBs don't get longer than up to
vmexit
+ gen_eob(s);
+ return 1;
+ }
+ }
+ return 0;
+}
+
+static inline int gen_svm_check_intercept(DisasContext *s, target_ulong
pc_start, uint64_t type) {
+ return gen_svm_check_intercept_param(s, pc_start, type, 0);
+}
+
static inline void gen_stack_update(DisasContext *s, int addend)
{
#ifdef TARGET_X86_64
@@ -4880,6 +4959,9 @@ static target_ulong disas_insn(DisasCont
else
ot = dflag ? OT_LONG : OT_WORD;
gen_check_io(s, ot, 1, pc_start - s->cs_base);
+ gen_op_mov_TN_reg[OT_WORD][0][R_EDX]();
+ gen_op_andl_T0_ffff();
+ if(gen_svm_check_io(s, pc_start, SVM_IOIO_TYPE_MASK | (1 << (4+ot)) |
svm_is_rep(prefixes )| 4 | (1 << (7+s->aflag)))) break;
if (prefixes & (PREFIX_REPZ | PREFIX_REPNZ)) {
gen_repz_ins(s, ot, pc_start - s->cs_base, s->pc - s->cs_base);
} else {
@@ -4893,6 +4975,9 @@ static target_ulong disas_insn(DisasCont
else
ot = dflag ? OT_LONG : OT_WORD;
gen_check_io(s, ot, 1, pc_start - s->cs_base);
+ gen_op_mov_TN_reg[OT_WORD][0][R_EDX]();
+ gen_op_andl_T0_ffff();
+ if(gen_svm_check_io(s, pc_start, (1 << (4+ot)) | svm_is_rep(prefixes)
| 4 | (1 << (7+s->aflag)))) break;
if (prefixes & (PREFIX_REPZ | PREFIX_REPNZ)) {
gen_repz_outs(s, ot, pc_start - s->cs_base, s->pc - s->cs_base);
} else {
@@ -4902,6 +4987,7 @@ static target_ulong disas_insn(DisasCont
/************************/
/* port I/O */
+
case 0xe4:
case 0xe5:
if ((b & 1) == 0)
@@ -4911,6 +4997,7 @@ static target_ulong disas_insn(DisasCont
val = ldub_code(s->pc++);
gen_op_movl_T0_im(val);
gen_check_io(s, ot, 0, pc_start - s->cs_base);
+ if(gen_svm_check_io(s, pc_start, SVM_IOIO_TYPE_MASK |
svm_is_rep(prefixes) | (1 << (4+ot)))) break;
gen_op_in[ot]();
gen_op_mov_reg_T1[ot][R_EAX]();
break;
@@ -4923,6 +5010,7 @@ static target_ulong disas_insn(DisasCont
val = ldub_code(s->pc++);
gen_op_movl_T0_im(val);
gen_check_io(s, ot, 0, pc_start - s->cs_base);
+ if(gen_svm_check_io(s, pc_start, svm_is_rep(prefixes) | (1 <<
(4+ot)))) break;
gen_op_mov_TN_reg[ot][1][R_EAX]();
gen_op_out[ot]();
break;
@@ -4935,6 +5023,7 @@ static target_ulong disas_insn(DisasCont
gen_op_mov_TN_reg[OT_WORD][0][R_EDX]();
gen_op_andl_T0_ffff();
gen_check_io(s, ot, 0, pc_start - s->cs_base);
+ if(gen_svm_check_io(s, pc_start, SVM_IOIO_TYPE_MASK |
svm_is_rep(prefixes) | (1 << (4+ot)))) break;
gen_op_in[ot]();
gen_op_mov_reg_T1[ot][R_EAX]();
break;
@@ -4947,6 +5036,7 @@ static target_ulong disas_insn(DisasCont
gen_op_mov_TN_reg[OT_WORD][0][R_EDX]();
gen_op_andl_T0_ffff();
gen_check_io(s, ot, 0, pc_start - s->cs_base);
+ if(gen_svm_check_io(s, pc_start, svm_is_rep(prefixes) | (1 <<
(4+ot)))) break;
gen_op_mov_TN_reg[ot][1][R_EAX]();
gen_op_out[ot]();
break;
@@ -5004,6 +5094,7 @@ static target_ulong disas_insn(DisasCont
val = 0;
goto do_lret;
case 0xcf: /* iret */
+ if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_IRET)) break;
if (!s->pe) {
/* real mode */
gen_op_iret_real(s->dflag);
@@ -5125,6 +5216,7 @@ static target_ulong disas_insn(DisasCont
/************************/
/* flags */
case 0x9c: /* pushf */
+ if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_PUSHF)) break;
if (s->vm86 && s->iopl != 3) {
gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
} else {
@@ -5135,6 +5227,7 @@ static target_ulong disas_insn(DisasCont
}
break;
case 0x9d: /* popf */
+ if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_POPF)) break;
if (s->vm86 && s->iopl != 3) {
gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
} else {
@@ -5344,6 +5437,9 @@ static target_ulong disas_insn(DisasCont
/* XXX: correct lock test for all insn */
if (prefixes & PREFIX_LOCK)
goto illegal_op;
+ if (prefixes & PREFIX_REPZ) {
+ gen_svm_check_intercept(s, pc_start, SVM_EXIT_PAUSE);
+ }
break;
case 0x9b: /* fwait */
if ((s->flags & (HF_MP_MASK | HF_TS_MASK)) ==
@@ -5357,11 +5453,13 @@ static target_ulong disas_insn(DisasCont
}
break;
case 0xcc: /* int3 */
+ if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_SWINT)) break;
gen_interrupt(s, EXCP03_INT3, pc_start - s->cs_base, s->pc -
s->cs_base);
break;
case 0xcd: /* int N */
val = ldub_code(s->pc++);
- if (s->vm86 && s->iopl != 3) {
+ if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_SWINT)) break;
+ if (s->vm86 && s->iopl != 3) {
gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
} else {
gen_interrupt(s, val, pc_start - s->cs_base, s->pc - s->cs_base);
@@ -5370,12 +5468,14 @@ static target_ulong disas_insn(DisasCont
case 0xce: /* into */
if (CODE64(s))
goto illegal_op;
+ if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_SWINT)) break;
if (s->cc_op != CC_OP_DYNAMIC)
gen_op_set_cc_op(s->cc_op);
gen_jmp_im(pc_start - s->cs_base);
gen_op_into(s->pc - pc_start);
break;
case 0xf1: /* icebp (undocumented, exits to external debugger) */
+ if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_ICEBP)) break;
#if 1
gen_debug(s, pc_start - s->cs_base);
#else
@@ -5503,13 +5603,20 @@ static target_ulong disas_insn(DisasCont
if (s->cpl != 0) {
gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
} else {
- if (b & 2)
+ int retval = 0;
+ if (b & 2) {
+ retval = gen_svm_check_intercept_param(s, pc_start,
SVM_EXIT_MSR, 0);
gen_op_rdmsr();
- else
+ } else {
+ retval = gen_svm_check_intercept_param(s, pc_start,
SVM_EXIT_MSR, 1);
gen_op_wrmsr();
+ }
+ if(retval)
+ gen_eob(s);
}
break;
case 0x131: /* rdtsc */
+ if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_RDTSC)) break;
gen_jmp_im(pc_start - s->cs_base);
gen_op_rdtsc();
break;
@@ -5572,12 +5679,14 @@ static target_ulong disas_insn(DisasCont
break;
#endif
case 0x1a2: /* cpuid */
+ if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_CPUID)) break;
gen_op_cpuid();
break;
case 0xf4: /* hlt */
if (s->cpl != 0) {
gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
} else {
+ if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_HLT)) break;
if (s->cc_op != CC_OP_DYNAMIC)
gen_op_set_cc_op(s->cc_op);
gen_jmp_im(s->pc - s->cs_base);
@@ -5593,6 +5702,7 @@ static target_ulong disas_insn(DisasCont
case 0: /* sldt */
if (!s->pe || s->vm86)
goto illegal_op;
+ if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_LDTR_READ)) break;
gen_op_movl_T0_env(offsetof(CPUX86State,ldt.selector));
ot = OT_WORD;
if (mod == 3)
@@ -5605,6 +5715,7 @@ static target_ulong disas_insn(DisasCont
if (s->cpl != 0) {
gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
} else {
+ if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_LDTR_WRITE))
break;
gen_ldst_modrm(s, modrm, OT_WORD, OR_TMP0, 0);
gen_jmp_im(pc_start - s->cs_base);
gen_op_lldt_T0();
@@ -5613,6 +5724,7 @@ static target_ulong disas_insn(DisasCont
case 1: /* str */
if (!s->pe || s->vm86)
goto illegal_op;
+ if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_TR_READ)) break;
gen_op_movl_T0_env(offsetof(CPUX86State,tr.selector));
ot = OT_WORD;
if (mod == 3)
@@ -5625,6 +5737,7 @@ static target_ulong disas_insn(DisasCont
if (s->cpl != 0) {
gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
} else {
+ if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_TR_WRITE))
break;
gen_ldst_modrm(s, modrm, OT_WORD, OR_TMP0, 0);
gen_jmp_im(pc_start - s->cs_base);
gen_op_ltr_T0();
@@ -5656,6 +5769,7 @@ static target_ulong disas_insn(DisasCont
case 0: /* sgdt */
if (mod == 3)
goto illegal_op;
+ if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_GDTR_READ)) break;
gen_lea_modrm(s, modrm, ®_addr, &offset_addr);
gen_op_movl_T0_env(offsetof(CPUX86State, gdt.limit));
gen_op_st_T0_A0[OT_WORD + s->mem_index]();
@@ -5672,6 +5786,7 @@ static target_ulong disas_insn(DisasCont
if (!(s->cpuid_ext_features & CPUID_EXT_MONITOR) ||
s->cpl != 0)
goto illegal_op;
+ if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_MONITOR))
break;
gen_jmp_im(pc_start - s->cs_base);
#ifdef TARGET_X86_64
if (s->aflag == 2) {
@@ -5696,6 +5811,7 @@ static target_ulong disas_insn(DisasCont
gen_op_set_cc_op(s->cc_op);
s->cc_op = CC_OP_DYNAMIC;
}
+ if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_MWAIT))
break;
gen_jmp_im(s->pc - s->cs_base);
gen_op_mwait();
gen_eob(s);
@@ -5704,6 +5820,7 @@ static target_ulong disas_insn(DisasCont
goto illegal_op;
}
} else { /* sidt */
+ if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_IDTR_READ))
break;
gen_lea_modrm(s, modrm, ®_addr, &offset_addr);
gen_op_movl_T0_env(offsetof(CPUX86State, idt.limit));
gen_op_st_T0_A0[OT_WORD + s->mem_index]();
@@ -5716,11 +5833,53 @@ static target_ulong disas_insn(DisasCont
break;
case 2: /* lgdt */
case 3: /* lidt */
- if (mod == 3)
- goto illegal_op;
- if (s->cpl != 0) {
+ if (mod == 3) {
+ switch(rm) {
+ case 0: /* VMRUN */
+ if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_VMRUN))
break;
+ if (s->cc_op != CC_OP_DYNAMIC)
+ gen_op_set_cc_op(s->cc_op);
+ gen_jmp_im(s->pc - s->cs_base);
+ gen_op_vmrun();
+ s->cc_op = CC_OP_EFLAGS;
+ gen_eob(s);
+ break;
+ case 1: /* VMMCALL */
+ if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_VMMCALL))
break;
+ // FIXME: cause #UD if hflags & SVM
+ gen_op_vmmcall();
+ break;
+ case 2: /* VMLOAD */
+ if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_VMLOAD))
break;
+ gen_op_vmload();
+ break;
+ case 3: /* VMSAVE */
+ if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_VMSAVE))
break;
+ gen_op_vmsave();
+ break;
+ case 4: /* STGI */
+ if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_STGI))
break;
+ gen_op_stgi();
+ break;
+ case 5: /* CLGI */
+ if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_CLGI))
break;
+ gen_op_clgi();
+ break;
+ case 6: /* SKINIT */
+ if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_SKINIT))
break;
+ gen_op_skinit();
+ break;
+ case 7: /* INVLPGA */
+ if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_INVLPGA))
break;
+ gen_op_invlpga();
+ break;
+ default:
+ goto illegal_op;
+ }
+ } else if (s->cpl != 0) {
gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
} else {
+ if(gen_svm_check_intercept(s, pc_start, op==2 ?
SVM_EXIT_GDTR_WRITE : SVM_EXIT_IDTR_WRITE)) break;
gen_lea_modrm(s, modrm, ®_addr, &offset_addr);
gen_op_ld_T1_A0[OT_WORD + s->mem_index]();
gen_add_A0_im(s, 2);
@@ -5737,6 +5896,7 @@ static target_ulong disas_insn(DisasCont
}
break;
case 4: /* smsw */
+ if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_READ_CR0)) break;
gen_op_movl_T0_env(offsetof(CPUX86State,cr[0]));
gen_ldst_modrm(s, modrm, OT_WORD, OR_TMP0, 1);
break;
@@ -5744,6 +5904,7 @@ static target_ulong disas_insn(DisasCont
if (s->cpl != 0) {
gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
} else {
+ if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_WRITE_CR0))
break;
gen_ldst_modrm(s, modrm, OT_WORD, OR_TMP0, 0);
gen_op_lmsw_T0();
gen_jmp_im(s->pc - s->cs_base);
@@ -5768,6 +5929,7 @@ static target_ulong disas_insn(DisasCont
goto illegal_op;
}
} else {
+ if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_INVLPG))
break;
gen_lea_modrm(s, modrm, ®_addr, &offset_addr);
gen_op_invlpg_A0();
gen_jmp_im(s->pc - s->cs_base);
@@ -5784,6 +5946,7 @@ static target_ulong disas_insn(DisasCont
if (s->cpl != 0) {
gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
} else {
+ if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_INVD)) break;
/* nothing to do */
}
break;
@@ -5904,17 +6067,20 @@ static target_ulong disas_insn(DisasCont
case 4:
case 8:
if (b & 2) {
+ gen_svm_check_intercept(s, pc_start, SVM_EXIT_WRITE_CR0 +
reg);
gen_op_mov_TN_reg[ot][0][rm]();
gen_op_movl_crN_T0(reg);
gen_jmp_im(s->pc - s->cs_base);
gen_eob(s);
} else {
+ gen_svm_check_intercept(s, pc_start, SVM_EXIT_READ_CR0 +
reg);
#if !defined(CONFIG_USER_ONLY)
if (reg == 8)
gen_op_movtl_T0_cr8();
- else
+ else {
#endif
gen_op_movtl_T0_env(offsetof(CPUX86State,cr[reg]));
+ }
gen_op_mov_reg_T0[ot][rm]();
}
break;
@@ -5941,11 +6107,13 @@ static target_ulong disas_insn(DisasCont
if (reg == 4 || reg == 5 || reg >= 8)
goto illegal_op;
if (b & 2) {
+ gen_svm_check_intercept(s, pc_start, SVM_EXIT_WRITE_DR0 + reg);
gen_op_mov_TN_reg[ot][0][rm]();
gen_op_movl_drN_T0(reg);
gen_jmp_im(s->pc - s->cs_base);
gen_eob(s);
} else {
+ gen_svm_check_intercept(s, pc_start, SVM_EXIT_READ_DR0 + reg);
gen_op_movtl_T0_env(offsetof(CPUX86State,dr[reg]));
gen_op_mov_reg_T0[ot][rm]();
}
@@ -5955,6 +6123,7 @@ static target_ulong disas_insn(DisasCont
if (s->cpl != 0) {
gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
} else {
+ gen_svm_check_intercept(s, pc_start, SVM_EXIT_WRITE_CR0);
gen_op_clts();
/* abort block because static cpu state changed */
gen_jmp_im(s->pc - s->cs_base);
@@ -6046,6 +6215,7 @@ static target_ulong disas_insn(DisasCont
/* ignore for now */
break;
case 0x1aa: /* rsm */
+ if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_RSM)) break;
if (!(s->flags & HF_SMM_MASK))
goto illegal_op;
if (s->cc_op != CC_OP_DYNAMIC) {
@@ -6480,6 +6650,7 @@ static inline int gen_intermediate_code_
dc->singlestep_enabled = env->singlestep_enabled;
dc->cc_op = CC_OP_DYNAMIC;
dc->cs_base = cs_base;
+ dc->intercept = tb->intercept;
dc->tb = tb;
dc->popl_esp_hack = 0;
/* select memory access functions */
Index: qemu/target-i386/cpu.h
===================================================================
--- qemu.orig/target-i386/cpu.h
+++ qemu/target-i386/cpu.h
@@ -46,6 +46,8 @@
#include "softfloat.h"
+#include "svm.h"
+
#if defined(__i386__) && !defined(CONFIG_SOFTMMU) && !defined(__APPLE__)
#define USE_CODE_COPY
#endif
@@ -84,6 +86,7 @@
#define DESC_AVL_MASK (1 << 20)
#define DESC_P_MASK (1 << 15)
#define DESC_DPL_SHIFT 13
+#define DESC_DPL_MASK (1 << DESC_DPL_SHIFT)
#define DESC_S_MASK (1 << 12)
#define DESC_TYPE_SHIFT 8
#define DESC_A_MASK (1 << 8)
@@ -149,6 +152,8 @@
#define HF_VM_SHIFT 17 /* must be same as eflags */
#define HF_HALTED_SHIFT 18 /* CPU halted */
#define HF_SMM_SHIFT 19 /* CPU in SMM mode */
+#define HF_GIF_SHIFT 20 /* if set CPU takes interrupts */
+#define HF_HIF_SHIFT 21 /* shadow copy of IF_MASK when in SVM */
#define HF_CPL_MASK (3 << HF_CPL_SHIFT)
#define HF_SOFTMMU_MASK (1 << HF_SOFTMMU_SHIFT)
@@ -166,6 +171,8 @@
#define HF_OSFXSR_MASK (1 << HF_OSFXSR_SHIFT)
#define HF_HALTED_MASK (1 << HF_HALTED_SHIFT)
#define HF_SMM_MASK (1 << HF_SMM_SHIFT)
+#define HF_GIF_MASK (1 << HF_GIF_SHIFT)
+#define HF_HIF_MASK (1 << HF_HIF_SHIFT)
#define CR0_PE_MASK (1 << 0)
#define CR0_MP_MASK (1 << 1)
@@ -249,6 +256,8 @@
#define MSR_GSBASE 0xc0000101
#define MSR_KERNELGSBASE 0xc0000102
+#define MSR_VM_HSAVE_PA 0xc0010117
+
/* cpuid_features bits */
#define CPUID_FP87 (1 << 0)
#define CPUID_VME (1 << 1)
@@ -283,6 +292,8 @@
#define CPUID_EXT2_FFXSR (1 << 25)
#define CPUID_EXT2_LM (1 << 29)
+#define CPUID_EXT3_SVM (1 << 2)
+
#define EXCP00_DIVZ 0
#define EXCP01_SSTP 1
#define EXCP02_NMI 2
@@ -489,6 +500,16 @@ typedef struct CPUX86State {
uint32_t sysenter_eip;
uint64_t efer;
uint64_t star;
+
+ target_phys_addr_t vm_hsave;
+ target_phys_addr_t vm_vmcb;
+ uint64_t intercept;
+ uint16_t intercept_cr_read;
+ uint16_t intercept_cr_write;
+ uint16_t intercept_dr_read;
+ uint16_t intercept_dr_write;
+ uint32_t intercept_exceptions;
+
#ifdef TARGET_X86_64
target_ulong lstar;
target_ulong cstar;
Index: qemu/target-i386/op.c
===================================================================
--- qemu.orig/target-i386/op.c
+++ qemu/target-i386/op.c
@@ -1243,6 +1243,38 @@ void OPPROTO op_movl_crN_T0(void)
helper_movl_crN_T0(PARAM1);
}
+// these pseudo-opcodes check for SVM intercepts
+void OPPROTO op_svm_check_intercept(void)
+{
+ svm_check_intercept(PARAMQ1);
+}
+
+void OPPROTO op_svm_check_intercept_param(void)
+{
+ svm_check_intercept_param(PARAMQ1, T1);
+}
+
+void OPPROTO op_svm_vmexit(void)
+{
+ vmexit(PARAMQ1, T1);
+}
+
+void OPPROTO op_geneflags(void)
+{
+ CC_SRC = cc_table[CC_OP].compute_all();
+}
+
+// this pseudo-opcode checks for IO intercepts
+void OPPROTO op_svm_check_intercept_io(void)
+{
+ // PARAM1 = TYPE (0 = OUT, 1 = IN; 4 = STRING; 8 = REP)
+ // T0 = PORT
+ // T1 = next eip
+ stq_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2), T1);
+ // ASIZE does not appear on real hw
+ svm_check_intercept_param(SVM_EXIT_IOIO, (PARAMQ1 & ~SVM_IOIO_ASIZE_MASK)
| ((T0 & 0xffff) << 16));
+}
+
#if !defined(CONFIG_USER_ONLY)
void OPPROTO op_movtl_T0_cr8(void)
{
@@ -2447,3 +2479,45 @@ void OPPROTO op_emms(void)
#define SHIFT 1
#include "ops_sse.h"
+
+/* Secure Virtual Machine ops */
+
+void OPPROTO op_vmrun(void)
+{
+ helper_vmrun(EAX);
+}
+
+void OPPROTO op_vmmcall(void)
+{
+ helper_vmmcall();
+}
+
+void OPPROTO op_vmload(void)
+{
+ helper_vmload(EAX);
+}
+
+void OPPROTO op_vmsave(void)
+{
+ helper_vmsave(EAX);
+}
+
+void OPPROTO op_stgi(void)
+{
+ helper_stgi();
+}
+
+void OPPROTO op_clgi(void)
+{
+ helper_clgi();
+}
+
+void OPPROTO op_skinit(void)
+{
+ helper_skinit();
+}
+
+void OPPROTO op_invlpga(void)
+{
+ helper_invlpga();
+}
Index: qemu/target-i386/helper.c
===================================================================
--- qemu.orig/target-i386/helper.c
+++ qemu/target-i386/helper.c
@@ -594,7 +594,18 @@ static void do_interrupt_protected(int i
int has_error_code, new_stack, shift;
uint32_t e1, e2, offset, ss, esp, ss_e1, ss_e2;
uint32_t old_eip, sp_mask;
+ int svm_should_check = 1;
+ if((env->intercept & INTERCEPT_SVM_MASK) && !is_int && next_eip==-1) {
+ next_eip = EIP;
+ svm_should_check = 0;
+ }
+
+ if(svm_should_check
+ && (INTERCEPTEDl(_exceptions, 1 << intno)
+ && !is_int)) {
+ raise_interrupt(intno, is_int, error_code, 0);
+ }
has_error_code = 0;
if (!is_int && !is_hw) {
switch(intno) {
@@ -830,7 +841,17 @@ static void do_interrupt64(int intno, in
int has_error_code, new_stack;
uint32_t e1, e2, e3, ss;
target_ulong old_eip, esp, offset;
+ int svm_should_check = 1;
+ if((env->intercept & INTERCEPT_SVM_MASK) && !is_int && next_eip==-1) {
+ next_eip = EIP;
+ svm_should_check = 0;
+ }
+ if(svm_should_check
+ && INTERCEPTEDl(_exceptions, 1 << intno)
+ && !is_int) {
+ raise_interrupt(intno, is_int, error_code, 0);
+ }
has_error_code = 0;
if (!is_int && !is_hw) {
switch(intno) {
@@ -1077,7 +1098,17 @@ static void do_interrupt_real(int intno,
int selector;
uint32_t offset, esp;
uint32_t old_cs, old_eip;
+ int svm_should_check = 1;
+ if((env->intercept & INTERCEPT_SVM_MASK) && !is_int && next_eip==-1) {
+ next_eip = EIP;
+ svm_should_check = 0;
+ }
+ if(svm_should_check
+ && INTERCEPTEDl(_exceptions, 1 << intno)
+ && !is_int) {
+ raise_interrupt(intno, is_int, error_code, 0);
+ }
/* real mode (simpler !) */
dt = &env->idt;
if (intno * 4 + 3 > dt->limit)
@@ -1227,13 +1258,16 @@ int check_exception(int intno, int *erro
void raise_interrupt(int intno, int is_int, int error_code,
int next_eip_addend)
{
- if (!is_int)
+ if (!is_int) {
+ svm_check_intercept_param(SVM_EXIT_EXCP_BASE + intno, error_code);
intno = check_exception(intno, &error_code);
+ }
env->exception_index = intno;
env->error_code = error_code;
env->exception_is_int = is_int;
env->exception_next_eip = env->eip + next_eip_addend;
+
cpu_loop_exit();
}
@@ -1665,7 +1699,7 @@ void helper_cpuid(void)
case 0x80000001:
EAX = env->cpuid_features;
EBX = 0;
- ECX = 0;
+ ECX = env->cpuid_ext3_features;
EDX = env->cpuid_ext2_features;
break;
case 0x80000002:
@@ -2739,6 +2773,9 @@ void helper_wrmsr(void)
case MSR_PAT:
env->pat = val;
break;
+ case MSR_VM_HSAVE_PA:
+ env->vm_hsave = val;
+ break;
#ifdef TARGET_X86_64
case MSR_LSTAR:
env->lstar = val;
@@ -2790,6 +2827,9 @@ void helper_rdmsr(void)
case MSR_PAT:
val = env->pat;
break;
+ case MSR_VM_HSAVE_PA:
+ val = env->vm_hsave;
+ break;
#ifdef TARGET_X86_64
case MSR_LSTAR:
val = env->lstar;
@@ -3871,3 +3911,433 @@ void tlb_fill(target_ulong addr, int is_
}
env = saved_env;
}
+
+
+/* Secure Virtual Machine helpers */
+
+static inline uint32_t vmcb2cpu_attrib(uint16_t vmcb_attrib, uint32_t
vmcb_base, uint32_t vmcb_limit) {
+ return ((vmcb_attrib & 0x00ff) << 8) // Type, S, DPL, P
+ | ((vmcb_attrib & 0x0f00) << 12) // AVL, L, DB, G
+ | ((vmcb_base >> 16) & 0xff) // Base 23-16
+ | (vmcb_base & 0xff000000) // Base 31-24
+ | (vmcb_limit & 0xf0000); // Limit 19-16
+}
+
+static inline uint16_t cpu2vmcb_attrib(uint32_t cpu_attrib) {
+ return ((cpu_attrib >> 8) & 0xff) // Type, S, DPL, P
+ | ((cpu_attrib & 0xf00000) >> 12); // AVL, L, DB, G
+}
+
+extern uint8_t *phys_ram_base;
+void helper_vmrun(target_ulong addr)
+{
+ uint32_t event_inj;
+ uint32_t int_ctl;
+
+ if (loglevel & CPU_LOG_TB_IN_ASM) fprintf(logfile,"vmrun! %#lx\n", addr);
+
+ env->vm_vmcb = addr;
+ regs_to_env();
+
+ // save the current CPU state in the hsave page
+ stq_phys(env->vm_hsave + offsetof(struct vmcb, save.gdtr.base),
env->gdt.base);
+ stl_phys(env->vm_hsave + offsetof(struct vmcb, save.gdtr.limit),
env->gdt.limit);
+
+ stq_phys(env->vm_hsave + offsetof(struct vmcb, save.idtr.base),
env->idt.base);
+ stl_phys(env->vm_hsave + offsetof(struct vmcb, save.idtr.limit),
env->idt.limit);
+
+ stq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr0), env->cr[0]);
+ stq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr2), env->cr[2]);
+ stq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr3), env->cr[3]);
+ stq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr4), env->cr[4]);
+ stq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr8), env->cr[8]);
+ stq_phys(env->vm_hsave + offsetof(struct vmcb, save.dr6), env->dr[6]);
+ stq_phys(env->vm_hsave + offsetof(struct vmcb, save.dr7), env->dr[7]);
+
+ stq_phys(env->vm_hsave + offsetof(struct vmcb, save.efer), env->efer);
+ stq_phys(env->vm_hsave + offsetof(struct vmcb, save.rflags),
compute_eflags());
+
+ SVM_SAVE_SEG(env->vm_hsave, segs[R_ES], es);
+ SVM_SAVE_SEG(env->vm_hsave, segs[R_CS], cs);
+ SVM_SAVE_SEG(env->vm_hsave, segs[R_SS], ss);
+ SVM_SAVE_SEG(env->vm_hsave, segs[R_DS], ds);
+
+ stq_phys(env->vm_hsave + offsetof(struct vmcb, save.rip), EIP);
+ stq_phys(env->vm_hsave + offsetof(struct vmcb, save.rsp), ESP);
+ stq_phys(env->vm_hsave + offsetof(struct vmcb, save.rax), EAX);
+
+ // load the interception bitmaps so we do not need to access the vmcb in
svm mode
+ env->intercept = ldq_phys(env->vm_vmcb + offsetof(struct vmcb,
control.intercept)) | INTERCEPT_SVM_MASK;
+ env->intercept_cr_read = lduw_phys(env->vm_vmcb + offsetof(struct vmcb,
control.intercept_cr_read));
+ env->intercept_cr_write = lduw_phys(env->vm_vmcb + offsetof(struct vmcb,
control.intercept_cr_write));
+ env->intercept_dr_read = lduw_phys(env->vm_vmcb + offsetof(struct vmcb,
control.intercept_dr_read));
+ env->intercept_dr_write = lduw_phys(env->vm_vmcb + offsetof(struct vmcb,
control.intercept_dr_write));
+ env->intercept_exceptions = ldl_phys(env->vm_vmcb + offsetof(struct vmcb,
control.intercept_exceptions));
+
+ env->gdt.base = ldq_phys(env->vm_vmcb + offsetof(struct vmcb,
save.gdtr.base));
+ env->gdt.limit = ldl_phys(env->vm_vmcb + offsetof(struct vmcb,
save.gdtr.limit));
+
+ env->idt.base = ldq_phys(env->vm_vmcb + offsetof(struct vmcb,
save.idtr.base));
+ env->idt.limit = ldl_phys(env->vm_vmcb + offsetof(struct vmcb,
save.idtr.limit));
+
+ // clear exit_info_2 so we behave like the real hardware
+ stq_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2), 0);
+
+ cpu_x86_update_cr0(env, ldq_phys(env->vm_vmcb + offsetof(struct vmcb,
save.cr0)));
+ cpu_x86_update_cr4(env, ldq_phys(env->vm_vmcb + offsetof(struct vmcb,
save.cr4)));
+ cpu_x86_update_cr3(env, ldq_phys(env->vm_vmcb + offsetof(struct vmcb,
save.cr3)));
+ env->cr[2] = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr2));
+ int_ctl = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_ctl));
+ if(int_ctl & V_INTR_MASKING_MASK) {
+ env->cr[8] = int_ctl & V_TPR_MASK;
+ if(env->eflags & IF_MASK) env->hflags |= HF_HIF_MASK;
+ }
+
+#ifdef TARGET_X86_64
+ env->efer = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.efer));
+ env->hflags &= ~HF_LMA_MASK;
+ if (env->efer & MSR_EFER_LMA)
+ env->hflags |= HF_LMA_MASK;
+#endif
+ env->eflags = 0;
+ load_eflags(ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rflags)),
~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK));
+ CC_OP = CC_OP_EFLAGS;
+ CC_DST = 0xffffffff;
+
+ SVM_LOAD_SEG(env->vm_vmcb, ES, es);
+ SVM_LOAD_SEG(env->vm_vmcb, CS, cs);
+ SVM_LOAD_SEG(env->vm_vmcb, SS, ss);
+ SVM_LOAD_SEG(env->vm_vmcb, DS, ds);
+
+ EIP = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rip));
+ env->eip = EIP;
+ ESP = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rsp));
+ EAX = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rax));
+ env->dr[7] = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.dr7));
+ env->dr[6] = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.dr6));
+ cpu_x86_set_cpl(env, ldub_phys(env->vm_vmcb + offsetof(struct vmcb,
save.cpl)));
+
+ // FIXME: guest state consistency checks
+
+ switch(ldub_phys(env->vm_vmcb + offsetof(struct vmcb, control.tlb_ctl))) {
+ case TLB_CONTROL_DO_NOTHING:
+ break;
+ case TLB_CONTROL_FLUSH_ALL_ASID:
+ // FIXME: this is not 100% correct but should work for now
+ tlb_flush(env, 1);
+ break;
+ }
+
+ helper_stgi();
+
+ regs_to_env();
+
+ // maybe we need to inject an event
+ event_inj = ldl_phys(env->vm_vmcb + offsetof(struct vmcb,
control.event_inj));
+ if(event_inj & SVM_EVTINJ_VALID) {
+ uint8_t vector = event_inj & SVM_EVTINJ_VEC_MASK;
+ uint16_t valid_err = event_inj & SVM_EVTINJ_VALID_ERR;
+ uint32_t event_inj_err = ldl_phys(env->vm_vmcb + offsetof(struct vmcb,
control.event_inj_err));
+ stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj),
event_inj & ~SVM_EVTINJ_VALID);
+
+ if (loglevel & CPU_LOG_TB_IN_ASM) fprintf(logfile, "Injecting(%#hx):
", valid_err);
+ // FIXME: need to implement valid_err
+ switch(event_inj & SVM_EVTINJ_TYPE_MASK) {
+ case SVM_EVTINJ_TYPE_INTR:
+ env->exception_index = vector;
+ env->error_code = event_inj_err;
+ env->exception_is_int = 1;
+ env->exception_next_eip = -1;
+ if (loglevel & CPU_LOG_TB_IN_ASM) fprintf(logfile,
"INTR");
+ break;
+ case SVM_EVTINJ_TYPE_NMI:
+ env->exception_index = vector;
+ env->error_code = event_inj_err;
+ env->exception_is_int = 1;
+ env->exception_next_eip = EIP;
+ if (loglevel & CPU_LOG_TB_IN_ASM) fprintf(logfile,
"NMI");
+ break;
+ case SVM_EVTINJ_TYPE_EXEPT:
+ env->exception_index = vector;
+ env->error_code = event_inj_err;
+ env->exception_is_int = 0;
+ env->exception_next_eip = -1;
+ if (loglevel & CPU_LOG_TB_IN_ASM) fprintf(logfile,
"EXEPT");
+ break;
+ case SVM_EVTINJ_TYPE_SOFT:
+ env->exception_index = vector;
+ env->error_code = event_inj_err;
+ env->exception_is_int = 1;
+ env->exception_next_eip = EIP;
+ if (loglevel & CPU_LOG_TB_IN_ASM) fprintf(logfile,
"SOFT");
+ break;
+ }
+ if (loglevel & CPU_LOG_TB_IN_ASM) fprintf(logfile, " %#x %#x\n",
env->exception_index, env->error_code);
+ }
+ if (int_ctl & V_IRQ_MASK)
+ env->interrupt_request |= CPU_INTERRUPT_VIRQ;
+
+ cpu_loop_exit();
+}
+
+void helper_vmmcall()
+{
+ if (loglevel & CPU_LOG_TB_IN_ASM) fprintf(logfile,"vmmcall!\n");
+}
+
+void helper_vmload(target_ulong addr)
+{
+ if (loglevel & CPU_LOG_TB_IN_ASM) fprintf(logfile,"vmload! %#lx\nFS: %#lx
| %#lx\n", addr, ldq_phys(addr + offsetof(struct vmcb, save.fs.base)),
env->segs[R_FS].base);
+
+ SVM_LOAD_SEG2(addr, segs[R_FS], fs);
+ SVM_LOAD_SEG2(addr, segs[R_GS], gs);
+ SVM_LOAD_SEG2(addr, tr, tr);
+ SVM_LOAD_SEG2(addr, ldt, ldtr);
+
+#ifdef TARGET_X86_64
+ env->kernelgsbase = ldq_phys(addr + offsetof(struct vmcb,
save.kernel_gs_base));
+ env->lstar = ldq_phys(addr + offsetof(struct vmcb, save.lstar));
+ env->cstar = ldq_phys(addr + offsetof(struct vmcb, save.cstar));
+ env->fmask = ldq_phys(addr + offsetof(struct vmcb, save.sfmask));
+#endif
+ env->star = ldq_phys(addr + offsetof(struct vmcb, save.star));
+ env->sysenter_cs = ldq_phys(addr + offsetof(struct vmcb,
save.sysenter_cs));
+ env->sysenter_esp = ldq_phys(addr + offsetof(struct vmcb,
save.sysenter_esp));
+ env->sysenter_eip = ldq_phys(addr + offsetof(struct vmcb,
save.sysenter_eip));
+}
+
+void helper_vmsave(target_ulong addr)
+{
+ if (loglevel & CPU_LOG_TB_IN_ASM) fprintf(logfile,"vmsave! %#lx\nFS: %#lx
| %#lx\n", addr, ldq_phys(addr + offsetof(struct vmcb, save.fs.base)),
env->segs[R_FS].base);
+
+ SVM_SAVE_SEG(addr, segs[R_FS], fs);
+ SVM_SAVE_SEG(addr, segs[R_GS], gs);
+ SVM_SAVE_SEG(addr, tr, tr);
+ SVM_SAVE_SEG(addr, ldt, ldtr);
+
+#ifdef TARGET_X86_64
+ stq_phys(addr + offsetof(struct vmcb, save.kernel_gs_base),
env->kernelgsbase);
+ stq_phys(addr + offsetof(struct vmcb, save.lstar), env->lstar);
+ stq_phys(addr + offsetof(struct vmcb, save.cstar), env->cstar);
+ stq_phys(addr + offsetof(struct vmcb, save.sfmask), env->fmask);
+#endif
+ stq_phys(addr + offsetof(struct vmcb, save.star), env->star);
+ stq_phys(addr + offsetof(struct vmcb, save.sysenter_cs), env->sysenter_cs);
+ stq_phys(addr + offsetof(struct vmcb, save.sysenter_esp),
env->sysenter_esp);
+ stq_phys(addr + offsetof(struct vmcb, save.sysenter_eip),
env->sysenter_eip);
+}
+
+void helper_stgi()
+{
+ env->hflags |= HF_GIF_MASK;
+}
+
+void helper_clgi()
+{
+ env->hflags &= ~HF_GIF_MASK;
+}
+
+void helper_skinit()
+{
+ if (loglevel & CPU_LOG_TB_IN_ASM) fprintf(logfile,"skinit!\n");
+}
+
+void helper_invlpga()
+{
+ tlb_flush(env, 0);
+}
+
+int svm_check_intercept_param(uint32_t type, uint64_t param) {
+ switch(type) {
+ case SVM_EXIT_READ_CR0 ... SVM_EXIT_READ_CR0 + 8:
+ if (INTERCEPTEDw(_cr_read, (1 << (type - SVM_EXIT_READ_CR0)))) {
+ vmexit(type, param);
+ return 1;
+ }
+ break;
+ case SVM_EXIT_READ_DR0 ... SVM_EXIT_READ_DR0 + 8:
+ if (INTERCEPTEDw(_dr_read, (1 << (type - SVM_EXIT_READ_DR0)))) {
+ vmexit(type, param);
+ return 1;
+ }
+ break;
+ case SVM_EXIT_WRITE_CR0 ... SVM_EXIT_WRITE_CR0 + 8:
+ if (INTERCEPTEDw(_cr_write, (1 << (type - SVM_EXIT_WRITE_CR0)))) {
+ vmexit(type, param);
+ return 1;
+ }
+ break;
+ case SVM_EXIT_WRITE_DR0 ... SVM_EXIT_WRITE_DR0 + 8:
+ if (INTERCEPTEDw(_dr_write, (1 << (type - SVM_EXIT_WRITE_DR0)))) {
+ vmexit(type, param);
+ return 1;
+ }
+ break;
+ case SVM_EXIT_EXCP_BASE ... SVM_EXIT_EXCP_BASE + 16:
+ if (INTERCEPTEDl(_exceptions, (1 << (type - SVM_EXIT_EXCP_BASE))))
{
+ vmexit(type, param);
+ return 1;
+ }
+ break;
+ case SVM_EXIT_IOIO:
+ if (INTERCEPTED(INTERCEPT_IOIO_PROT)) {
+ // FIXME: this should be read in at vmrun (faster this way?)
+ uint64_t addr = ldq_phys(env->vm_vmcb + offsetof(struct vmcb,
control.iopm_base_pa));
+ uint16_t port = (uint16_t) (param >> 16);
+
+ if(ldub_phys(addr + port / 8) & (1 << (port % 8)))
+ vmexit(type, param);
+ }
+ break;
+
+ case SVM_EXIT_MSR:
+ if (INTERCEPTED(1L << INTERCEPT_MSR_PROT)) {
+ // FIXME: this should be read in at vmrun (faster this way?)
+ uint64_t addr = ldq_phys(env->vm_vmcb + offsetof(struct vmcb,
control.msrpm_base_pa));
+ switch((uint32_t)ECX) {
+ case 0 ... 0x1fff:
+ T0 = (ECX * 2) % 8;
+ T1 = ECX / 8;
+ break;
+ case 0xc0000000 ... 0xc0001fff:
+ T0 = (8192 + ECX - 0xc0000000) * 2;
+ T1 = (T0 / 8);
+ T0 %= 8;
+ break;
+ case 0xc0010000 ... 0xc0011fff:
+ T0 = (16384 + ECX - 0xc0010000) * 2;
+ T1 = (T0 / 8);
+ T0 %= 8;
+ break;
+ default:
+ vmexit(type, param);
+ return 1;
+ }
+ if (ldub_phys(addr + T1) & ((1 << param) << T0))
+ vmexit(type, param);
+ return 1;
+ }
+ break;
+ default:
+ if (INTERCEPTED((1 << (type - SVM_EXIT_INTR)))) {
+ vmexit(type, param);
+ return 1;
+ }
+ break;
+ }
+ return 0;
+}
+
+void vmexit(uint64_t exit_code, uint64_t exit_info_1)
+{
+ uint32_t int_ctl;
+
+ if (loglevel & CPU_LOG_TB_IN_ASM) fprintf(logfile,"vmexit(%#lx, %#lx,
%#lx, %#lx)!\n", exit_code, exit_info_1, ldq_phys(env->vm_vmcb +
offsetof(struct vmcb, control.exit_info_2)), EIP);
+
+// Save the VM state in the vmcb
+ SVM_SAVE_SEG(env->vm_vmcb, segs[R_ES], es);
+ SVM_SAVE_SEG(env->vm_vmcb, segs[R_CS], cs);
+ SVM_SAVE_SEG(env->vm_vmcb, segs[R_SS], ss);
+ SVM_SAVE_SEG(env->vm_vmcb, segs[R_DS], ds);
+
+ stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.gdtr.base),
env->gdt.base);
+ stl_phys(env->vm_vmcb + offsetof(struct vmcb, save.gdtr.limit),
env->gdt.limit);
+
+ stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.idtr.base),
env->idt.base);
+ stl_phys(env->vm_vmcb + offsetof(struct vmcb, save.idtr.limit),
env->idt.limit);
+
+ stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.efer), env->efer);
+ stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr0), env->cr[0]);
+ stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr2), env->cr[2]);
+ stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr3), env->cr[3]);
+ stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr4), env->cr[4]);
+
+ if((int_ctl = ldl_phys(env->vm_vmcb + offsetof(struct vmcb,
control.int_ctl))) & V_INTR_MASKING_MASK) {
+ int_ctl &= ~V_TPR_MASK;
+ int_ctl |= env->cr[8] & V_TPR_MASK;
+ stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_ctl),
int_ctl);
+ }
+
+ stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rflags),
compute_eflags());
+ stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rip), env->eip);
+ stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rsp), ESP);
+ stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rax), EAX);
+ stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.dr7), env->dr[7]);
+ stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.dr6), env->dr[6]);
+ stb_phys(env->vm_vmcb + offsetof(struct vmcb, save.cpl), env->hflags &
HF_CPL_MASK);
+
+// Reload the host state from vm_hsave
+ env->hflags &= ~HF_HIF_MASK;
+ env->intercept = 0;
+ env->intercept_exceptions = 0;
+ env->interrupt_request &= ~CPU_INTERRUPT_VIRQ;
+
+ env->gdt.base = ldq_phys(env->vm_hsave + offsetof(struct vmcb,
save.gdtr.base));
+ env->gdt.limit = ldl_phys(env->vm_hsave + offsetof(struct vmcb,
save.gdtr.limit));
+
+ env->idt.base = ldq_phys(env->vm_hsave + offsetof(struct vmcb,
save.idtr.base));
+ env->idt.limit = ldl_phys(env->vm_hsave + offsetof(struct vmcb,
save.idtr.limit));
+
+ cpu_x86_update_cr0(env, ldq_phys(env->vm_hsave + offsetof(struct vmcb,
save.cr0)) | CR0_PE_MASK);
+ cpu_x86_update_cr4(env, ldq_phys(env->vm_hsave + offsetof(struct vmcb,
save.cr4)));
+ cpu_x86_update_cr3(env, ldq_phys(env->vm_hsave + offsetof(struct vmcb,
save.cr3)));
+ if(int_ctl & V_INTR_MASKING_MASK)
+ env->cr[8] = ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr8));
+ // we need to set the efer after the crs so the hidden flags get set
properly
+#ifdef TARGET_X86_64
+ env->efer = ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.efer));
+ env->hflags &= ~HF_LMA_MASK;
+ if (env->efer & MSR_EFER_LMA)
+ env->hflags |= HF_LMA_MASK;
+#endif
+
+ env->eflags = 0;
+ load_eflags(ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.rflags)),
~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK));
+ CC_OP = CC_OP_EFLAGS;
+
+ SVM_LOAD_SEG(env->vm_hsave, ES, es);
+ SVM_LOAD_SEG(env->vm_hsave, CS, cs);
+ SVM_LOAD_SEG(env->vm_hsave, SS, ss);
+ SVM_LOAD_SEG(env->vm_hsave, DS, ds);
+
+ EIP = ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.rip));
+ ESP = ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.rsp));
+ EAX = ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.rax));
+
+ env->dr[6] = ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.dr6));
+ env->dr[7] = ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.dr7));
+
+// other setups
+ cpu_x86_set_cpl(env, 0);
+ stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_code_hi),
(uint32_t)(exit_code >> 32));
+ stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_code),
exit_code);
+ stq_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_info_1),
exit_info_1);
+
+ helper_clgi();
+ // FIXME: Resets the current ASID register to zero (host ASID).
+
+ // Clears the V_IRQ and V_INTR_MASKING bits inside the processor.
+
+ // Clears the TSC_OFFSET inside the processor.
+
+ // If the host is in PAE mode, the processor reloads the host's PDPEs from
the page table indicated the host's CR3. If the PDPEs contain illegal state,
the processor causes a shutdown.
+
+ // Forces CR0.PE = 1, RFLAGS.VM = 0.
+ env->cr[0] |= CR0_PE_MASK;
+ env->eflags &= ~VM_MASK;
+
+ // Disables all breakpoints in the host DR7 register.
+
+ // Checks the reloaded host state for consistency;
+
+ // If the hostâs rIP reloaded by #VMEXIT is outside the limit of the
hostâs code segment or non-canonical (in the case of long mode), a #GP fault
is delivered inside the host.)
+
+ // remove any pending exception
+ env->exception_index = -1;
+ env->error_code = 0;
+ env->old_exception = -1;
+
+ regs_to_env();
+ cpu_loop_exit();
+}
+
Index: qemu/target-i386/svm.h
===================================================================
--- /dev/null
+++ qemu/target-i386/svm.h
@@ -0,0 +1,373 @@
+#ifndef __SVM_H
+#define __SVM_H
+
+enum {
+ INTERCEPT_INTR,
+ INTERCEPT_NMI,
+ INTERCEPT_SMI,
+ INTERCEPT_INIT,
+ INTERCEPT_VINTR,
+ INTERCEPT_SELECTIVE_CR0,
+ INTERCEPT_STORE_IDTR,
+ INTERCEPT_STORE_GDTR,
+ INTERCEPT_STORE_LDTR,
+ INTERCEPT_STORE_TR,
+ INTERCEPT_LOAD_IDTR,
+ INTERCEPT_LOAD_GDTR,
+ INTERCEPT_LOAD_LDTR,
+ INTERCEPT_LOAD_TR,
+ INTERCEPT_RDTSC,
+ INTERCEPT_RDPMC,
+ INTERCEPT_PUSHF,
+ INTERCEPT_POPF,
+ INTERCEPT_CPUID,
+ INTERCEPT_RSM,
+ INTERCEPT_IRET,
+ INTERCEPT_INTn,
+ INTERCEPT_INVD,
+ INTERCEPT_PAUSE,
+ INTERCEPT_HLT,
+ INTERCEPT_INVLPG,
+ INTERCEPT_INVLPGA,
+ INTERCEPT_IOIO_PROT,
+ INTERCEPT_MSR_PROT,
+ INTERCEPT_TASK_SWITCH,
+ INTERCEPT_FERR_FREEZE,
+ INTERCEPT_SHUTDOWN,
+ INTERCEPT_VMRUN,
+ INTERCEPT_VMMCALL,
+ INTERCEPT_VMLOAD,
+ INTERCEPT_VMSAVE,
+ INTERCEPT_STGI,
+ INTERCEPT_CLGI,
+ INTERCEPT_SKINIT,
+ INTERCEPT_RDTSCP,
+ INTERCEPT_ICEBP,
+ INTERCEPT_WBINVD,
+};
+// This is not really an intercept but rather a placeholder to
+// show that we are in an SVM (just like a hidden flag, but keeps the
+// TBs clean)
+#define INTERCEPT_SVM 63
+#define INTERCEPT_SVM_MASK (1L << INTERCEPT_SVM)
+
+struct __attribute__ ((__packed__)) vmcb_control_area {
+ uint16_t intercept_cr_read;
+ uint16_t intercept_cr_write;
+ uint16_t intercept_dr_read;
+ uint16_t intercept_dr_write;
+ uint32_t intercept_exceptions;
+ uint64_t intercept;
+ uint8_t reserved_1[44];
+ uint64_t iopm_base_pa;
+ uint64_t msrpm_base_pa;
+ uint64_t tsc_offset;
+ uint32_t asid;
+ uint8_t tlb_ctl;
+ uint8_t reserved_2[3];
+ uint32_t int_ctl;
+ uint32_t int_vector;
+ uint32_t int_state;
+ uint8_t reserved_3[4];
+ uint32_t exit_code;
+ uint32_t exit_code_hi;
+ uint64_t exit_info_1;
+ uint64_t exit_info_2;
+ uint32_t exit_int_info;
+ uint32_t exit_int_info_err;
+ uint64_t nested_ctl;
+ uint8_t reserved_4[16];
+ uint32_t event_inj;
+ uint32_t event_inj_err;
+ uint64_t nested_cr3;
+ uint64_t lbr_ctl;
+ uint8_t reserved_5[832];
+};
+
+
+#define TLB_CONTROL_DO_NOTHING 0
+#define TLB_CONTROL_FLUSH_ALL_ASID 1
+
+#define V_TPR_MASK 0x0f
+
+#define V_IRQ_SHIFT 8
+#define V_IRQ_MASK (1 << V_IRQ_SHIFT)
+
+#define V_INTR_PRIO_SHIFT 16
+#define V_INTR_PRIO_MASK (0x0f << V_INTR_PRIO_SHIFT)
+
+#define V_IGN_TPR_SHIFT 20
+#define V_IGN_TPR_MASK (1 << V_IGN_TPR_SHIFT)
+
+#define V_INTR_MASKING_SHIFT 24
+#define V_INTR_MASKING_MASK (1 << V_INTR_MASKING_SHIFT)
+
+#define SVM_INTERRUPT_SHADOW_MASK 1
+
+#define SVM_IOIO_STR_SHIFT 2
+#define SVM_IOIO_REP_SHIFT 3
+#define SVM_IOIO_SIZE_SHIFT 4
+#define SVM_IOIO_ASIZE_SHIFT 7
+
+#define SVM_IOIO_TYPE_MASK 1
+#define SVM_IOIO_STR_MASK (1 << SVM_IOIO_STR_SHIFT)
+#define SVM_IOIO_REP_MASK (1 << SVM_IOIO_REP_SHIFT)
+#define SVM_IOIO_SIZE_MASK (7 << SVM_IOIO_SIZE_SHIFT)
+#define SVM_IOIO_ASIZE_MASK (7 << SVM_IOIO_ASIZE_SHIFT)
+
+struct __attribute__ ((__packed__)) vmcb_seg {
+ uint16_t selector;
+ uint16_t attrib;
+ uint32_t limit;
+ uint64_t base;
+};
+
+struct __attribute__ ((__packed__)) vmcb_save_area {
+ struct vmcb_seg es;
+ struct vmcb_seg cs;
+ struct vmcb_seg ss;
+ struct vmcb_seg ds;
+ struct vmcb_seg fs;
+ struct vmcb_seg gs;
+ struct vmcb_seg gdtr;
+ struct vmcb_seg ldtr;
+ struct vmcb_seg idtr;
+ struct vmcb_seg tr;
+ uint8_t reserved_1[43];
+ uint8_t cpl;
+ uint8_t reserved_2[4];
+ uint64_t efer;
+ uint8_t reserved_3[112];
+ uint64_t cr4;
+ uint64_t cr3;
+ uint64_t cr0;
+ uint64_t dr7;
+ uint64_t dr6;
+ uint64_t rflags;
+ uint64_t rip;
+ uint8_t reserved_4[88];
+ uint64_t rsp;
+ uint8_t reserved_5[24];
+ uint64_t rax;
+ uint64_t star;
+ uint64_t lstar;
+ uint64_t cstar;
+ uint64_t sfmask;
+ uint64_t kernel_gs_base;
+ uint64_t sysenter_cs;
+ uint64_t sysenter_esp;
+ uint64_t sysenter_eip;
+ uint64_t cr2;
+ // qemu: added to reuse this as hsave
+ uint64_t cr8;
+ // end of add
+ uint8_t reserved_6[32 - 8]; // originally 32
+ uint64_t g_pat;
+ uint64_t dbgctl;
+ uint64_t br_from;
+ uint64_t br_to;
+ uint64_t last_excp_from;
+ uint64_t last_excp_to;
+};
+
+struct __attribute__ ((__packed__)) vmcb {
+ struct vmcb_control_area control;
+ struct vmcb_save_area save;
+};
+
+#define SVM_CPUID_FEATURE_SHIFT 2
+#define SVM_CPUID_FUNC 0x8000000a
+
+#define MSR_EFER_SVME_MASK (1ULL << 12)
+
+#define SVM_SELECTOR_S_SHIFT 4
+#define SVM_SELECTOR_DPL_SHIFT 5
+#define SVM_SELECTOR_P_SHIFT 7
+#define SVM_SELECTOR_AVL_SHIFT 8
+#define SVM_SELECTOR_L_SHIFT 9
+#define SVM_SELECTOR_DB_SHIFT 10
+#define SVM_SELECTOR_G_SHIFT 11
+
+#define SVM_SELECTOR_TYPE_MASK (0xf)
+#define SVM_SELECTOR_S_MASK (1 << SVM_SELECTOR_S_SHIFT)
+#define SVM_SELECTOR_DPL_MASK (3 << SVM_SELECTOR_DPL_SHIFT)
+#define SVM_SELECTOR_P_MASK (1 << SVM_SELECTOR_P_SHIFT)
+#define SVM_SELECTOR_AVL_MASK (1 << SVM_SELECTOR_AVL_SHIFT)
+#define SVM_SELECTOR_L_MASK (1 << SVM_SELECTOR_L_SHIFT)
+#define SVM_SELECTOR_DB_MASK (1 << SVM_SELECTOR_DB_SHIFT)
+#define SVM_SELECTOR_G_MASK (1 << SVM_SELECTOR_G_SHIFT)
+
+#define SVM_SELECTOR_WRITE_MASK (1 << 1)
+#define SVM_SELECTOR_READ_MASK SVM_SELECTOR_WRITE_MASK
+#define SVM_SELECTOR_CODE_MASK (1 << 3)
+
+#define INTERCEPT_CR0_MASK 1
+#define INTERCEPT_CR3_MASK (1 << 3)
+#define INTERCEPT_CR4_MASK (1 << 4)
+
+#define INTERCEPT_DR0_MASK 1
+#define INTERCEPT_DR1_MASK (1 << 1)
+#define INTERCEPT_DR2_MASK (1 << 2)
+#define INTERCEPT_DR3_MASK (1 << 3)
+#define INTERCEPT_DR4_MASK (1 << 4)
+#define INTERCEPT_DR5_MASK (1 << 5)
+#define INTERCEPT_DR6_MASK (1 << 6)
+#define INTERCEPT_DR7_MASK (1 << 7)
+
+#define SVM_EVTINJ_VEC_MASK 0xff
+
+#define SVM_EVTINJ_TYPE_SHIFT 8
+#define SVM_EVTINJ_TYPE_MASK (7 << SVM_EVTINJ_TYPE_SHIFT)
+
+#define SVM_EVTINJ_TYPE_INTR (0 << SVM_EVTINJ_TYPE_SHIFT)
+#define SVM_EVTINJ_TYPE_NMI (2 << SVM_EVTINJ_TYPE_SHIFT)
+#define SVM_EVTINJ_TYPE_EXEPT (3 << SVM_EVTINJ_TYPE_SHIFT)
+#define SVM_EVTINJ_TYPE_SOFT (4 << SVM_EVTINJ_TYPE_SHIFT)
+
+#define SVM_EVTINJ_VALID (1 << 31)
+#define SVM_EVTINJ_VALID_ERR (1 << 11)
+
+#define SVM_EXITINTINFO_VEC_MASK SVM_EVTINJ_VEC_MASK
+
+#define SVM_EXITINTINFO_TYPE_INTR SVM_EVTINJ_TYPE_INTR
+#define SVM_EXITINTINFO_TYPE_NMI SVM_EVTINJ_TYPE_NMI
+#define SVM_EXITINTINFO_TYPE_EXEPT SVM_EVTINJ_TYPE_EXEPT
+#define SVM_EXITINTINFO_TYPE_SOFT SVM_EVTINJ_TYPE_SOFT
+
+#define SVM_EXITINTINFO_VALID SVM_EVTINJ_VALID
+#define SVM_EXITINTINFO_VALID_ERR SVM_EVTINJ_VALID_ERR
+
+#define SVM_EXIT_READ_CR0 0x000
+#define SVM_EXIT_READ_CR3 0x003
+#define SVM_EXIT_READ_CR4 0x004
+#define SVM_EXIT_READ_CR8 0x008
+#define SVM_EXIT_WRITE_CR0 0x010
+#define SVM_EXIT_WRITE_CR3 0x013
+#define SVM_EXIT_WRITE_CR4 0x014
+#define SVM_EXIT_WRITE_CR8 0x018
+#define SVM_EXIT_READ_DR0 0x020
+#define SVM_EXIT_READ_DR1 0x021
+#define SVM_EXIT_READ_DR2 0x022
+#define SVM_EXIT_READ_DR3 0x023
+#define SVM_EXIT_READ_DR4 0x024
+#define SVM_EXIT_READ_DR5 0x025
+#define SVM_EXIT_READ_DR6 0x026
+#define SVM_EXIT_READ_DR7 0x027
+#define SVM_EXIT_WRITE_DR0 0x030
+#define SVM_EXIT_WRITE_DR1 0x031
+#define SVM_EXIT_WRITE_DR2 0x032
+#define SVM_EXIT_WRITE_DR3 0x033
+#define SVM_EXIT_WRITE_DR4 0x034
+#define SVM_EXIT_WRITE_DR5 0x035
+#define SVM_EXIT_WRITE_DR6 0x036
+#define SVM_EXIT_WRITE_DR7 0x037
+#define SVM_EXIT_EXCP_BASE 0x040
+#define SVM_EXIT_INTR 0x060
+#define SVM_EXIT_NMI 0x061
+#define SVM_EXIT_SMI 0x062
+#define SVM_EXIT_INIT 0x063
+#define SVM_EXIT_VINTR 0x064
+#define SVM_EXIT_CR0_SEL_WRITE 0x065
+#define SVM_EXIT_IDTR_READ 0x066
+#define SVM_EXIT_GDTR_READ 0x067
+#define SVM_EXIT_LDTR_READ 0x068
+#define SVM_EXIT_TR_READ 0x069
+#define SVM_EXIT_IDTR_WRITE 0x06a
+#define SVM_EXIT_GDTR_WRITE 0x06b
+#define SVM_EXIT_LDTR_WRITE 0x06c
+#define SVM_EXIT_TR_WRITE 0x06d
+#define SVM_EXIT_RDTSC 0x06e
+#define SVM_EXIT_RDPMC 0x06f
+#define SVM_EXIT_PUSHF 0x070
+#define SVM_EXIT_POPF 0x071
+#define SVM_EXIT_CPUID 0x072
+#define SVM_EXIT_RSM 0x073
+#define SVM_EXIT_IRET 0x074
+#define SVM_EXIT_SWINT 0x075
+#define SVM_EXIT_INVD 0x076
+#define SVM_EXIT_PAUSE 0x077
+#define SVM_EXIT_HLT 0x078
+#define SVM_EXIT_INVLPG 0x079
+#define SVM_EXIT_INVLPGA 0x07a
+#define SVM_EXIT_IOIO 0x07b
+#define SVM_EXIT_MSR 0x07c
+#define SVM_EXIT_TASK_SWITCH 0x07d
+#define SVM_EXIT_FERR_FREEZE 0x07e
+#define SVM_EXIT_SHUTDOWN 0x07f
+#define SVM_EXIT_VMRUN 0x080
+#define SVM_EXIT_VMMCALL 0x081
+#define SVM_EXIT_VMLOAD 0x082
+#define SVM_EXIT_VMSAVE 0x083
+#define SVM_EXIT_STGI 0x084
+#define SVM_EXIT_CLGI 0x085
+#define SVM_EXIT_SKINIT 0x086
+#define SVM_EXIT_RDTSCP 0x087
+#define SVM_EXIT_ICEBP 0x088
+#define SVM_EXIT_WBINVD 0x089
+// only included in documentation, maybe wrong
+#define SVM_EXIT_MONITOR 0x08a
+#define SVM_EXIT_MWAIT 0x08b
+#define SVM_EXIT_NPF 0x400
+
+#define SVM_EXIT_ERR -1
+
+#define SVM_CR0_SELECTIVE_MASK (1 << 3 | 1) // TS and MP
+
+#define SVM_VMLOAD ".byte 0x0f, 0x01, 0xda"
+#define SVM_VMRUN ".byte 0x0f, 0x01, 0xd8"
+#define SVM_VMSAVE ".byte 0x0f, 0x01, 0xdb"
+#define SVM_CLGI ".byte 0x0f, 0x01, 0xdd"
+#define SVM_STGI ".byte 0x0f, 0x01, 0xdc"
+#define SVM_INVLPGA ".byte 0x0f, 0x01, 0xdf"
+
+/////// function references
+
+void helper_stgi();
+void vmexit(uint64_t exit_code, uint64_t exit_info_1);
+int svm_check_intercept_param(uint32_t type, uint64_t param);
+static inline int svm_check_intercept(unsigned int type) {
+ return svm_check_intercept_param(type, 0);
+}
+
+
+#define INTERCEPTED(mask) (env->intercept & mask)
+#define INTERCEPTEDw(var, mask) (env->intercept ## var & mask)
+#define INTERCEPTEDl(var, mask) (env->intercept ## var & mask)
+
+#define SVM_LOAD_SEG(addr, seg_index, seg) \
+ cpu_x86_load_seg_cache(env, \
+ R_##seg_index, \
+ lduw_phys(addr + offsetof(struct vmcb,
save.seg.selector)),\
+ ldq_phys(addr + offsetof(struct vmcb, save.seg.base)),\
+ ldl_phys(addr + offsetof(struct vmcb, save.seg.limit)),\
+ vmcb2cpu_attrib(lduw_phys(addr + offsetof(struct vmcb,
save.seg.attrib)), ldq_phys(addr + offsetof(struct vmcb, save.seg.base)),
ldl_phys(addr + offsetof(struct vmcb, save.seg.limit))))
+
+#define SVM_LOAD_SEG2(addr, seg_qemu, seg_vmcb) \
+ env->seg_qemu.selector = lduw_phys(addr + offsetof(struct vmcb,
save.seg_vmcb.selector)); \
+ env->seg_qemu.base = ldq_phys(addr + offsetof(struct vmcb,
save.seg_vmcb.base)); \
+ env->seg_qemu.limit = ldl_phys(addr + offsetof(struct vmcb,
save.seg_vmcb.limit)); \
+ env->seg_qemu.flags = vmcb2cpu_attrib(lduw_phys(addr + offsetof(struct
vmcb, save.seg_vmcb.attrib)), env->seg_qemu.base, env->seg_qemu.limit)
+
+#define SVM_SAVE_SEG(addr, seg_qemu, seg_vmcb) \
+ stw_phys(addr + offsetof(struct vmcb, save.seg_vmcb.selector),
env->seg_qemu.selector); \
+ stq_phys(addr + offsetof(struct vmcb, save.seg_vmcb.base),
env->seg_qemu.base); \
+ stl_phys(addr + offsetof(struct vmcb, save.seg_vmcb.limit),
env->seg_qemu.limit); \
+ stw_phys(addr + offsetof(struct vmcb, save.seg_vmcb.attrib),
cpu2vmcb_attrib(env->seg_qemu.flags))
+
+
+////// debugging only
+
+#define SVM_LOAD_SEG2_noconv(addr, seg_qemu, seg_vmcb) \
+ env->seg_qemu.selector = lduw_phys(addr + offsetof(struct vmcb,
save.seg_vmcb.selector)); \
+ env->seg_qemu.base = ldq_phys(addr + offsetof(struct vmcb,
save.seg_vmcb.base)); \
+ env->seg_qemu.limit = ldl_phys(addr + offsetof(struct vmcb,
save.seg_vmcb.limit)); \
+ env->seg_qemu.flags = lduw_phys(addr + offsetof(struct vmcb,
save.seg_vmcb.attrib))
+
+#define SVM_SAVE_SEG_noconv(addr, seg_qemu, seg_vmcb) \
+ stw_phys(addr + offsetof(struct vmcb, save.seg_vmcb.selector),
env->seg_qemu.selector); \
+ stq_phys(addr + offsetof(struct vmcb, save.seg_vmcb.base),
env->seg_qemu.base); \
+ stl_phys(addr + offsetof(struct vmcb, save.seg_vmcb.limit),
env->seg_qemu.limit); \
+ stw_phys(addr + offsetof(struct vmcb, save.seg_vmcb.attrib),
env->seg_qemu.flags)
+
+#endif
+
Index: qemu/cpu-exec.c
===================================================================
--- qemu.orig/cpu-exec.c
+++ qemu/cpu-exec.c
@@ -104,6 +104,9 @@ static TranslationBlock *tb_find_slow(ta
if (tb->pc == pc &&
tb->page_addr[0] == phys_page1 &&
tb->cs_base == cs_base &&
+#if defined(TARGET_I386)
+ tb->intercept == env->intercept &&
+#endif
tb->flags == flags) {
/* check next page if needed */
if (tb->page_addr[1] != -1) {
@@ -132,6 +135,9 @@ static TranslationBlock *tb_find_slow(ta
tc_ptr = code_gen_ptr;
tb->tc_ptr = tc_ptr;
tb->cs_base = cs_base;
+#if defined(TARGET_I386)
+ tb->intercept = env->intercept;
+#endif
tb->flags = flags;
cpu_gen_code(env, tb, CODE_GEN_MAX_SIZE, &code_gen_size);
code_gen_ptr = (void *)(((unsigned long)code_gen_ptr + code_gen_size +
CODE_GEN_ALIGN - 1) & ~(CODE_GEN_ALIGN - 1));
@@ -214,7 +220,11 @@ static inline TranslationBlock *tb_find_
#endif
tb = env->tb_jmp_cache[tb_jmp_cache_hash_func(pc)];
if (__builtin_expect(!tb || tb->pc != pc || tb->cs_base != cs_base ||
- tb->flags != flags, 0)) {
+ tb->flags != flags
+#if defined(TARGET_I386)
+ || tb->intercept != env->intercept
+#endif
+ , 0)) {
tb = tb_find_slow(pc, cs_base, flags);
/* Note: we do it here to avoid a gcc bug on Mac OS X when
doing it in tb_find_slow */
@@ -373,7 +383,11 @@ int cpu_exec(CPUState *env1)
tmp_T0 = T0;
#endif
interrupt_request = env->interrupt_request;
- if (__builtin_expect(interrupt_request, 0)) {
+ if (__builtin_expect(interrupt_request, 0)
+#if defined(TARGET_I386)
+ && env->hflags & HF_GIF_MASK
+#endif
+ ) {
if (interrupt_request & CPU_INTERRUPT_DEBUG) {
env->interrupt_request &= ~CPU_INTERRUPT_DEBUG;
env->exception_index = EXCP_DEBUG;
@@ -391,6 +405,7 @@ int cpu_exec(CPUState *env1)
#if defined(TARGET_I386)
if ((interrupt_request & CPU_INTERRUPT_SMI) &&
!(env->hflags & HF_SMM_MASK)) {
+ svm_check_intercept(SVM_EXIT_SMI);
env->interrupt_request &= ~CPU_INTERRUPT_SMI;
do_smm_enter();
#if defined(__sparc__) && !defined(HOST_SOLARIS)
@@ -399,9 +414,10 @@ int cpu_exec(CPUState *env1)
T0 = 0;
#endif
} else if ((interrupt_request & CPU_INTERRUPT_HARD) &&
- (env->eflags & IF_MASK) &&
+ (env->eflags & IF_MASK || env->hflags & HF_HIF_MASK)
&&
!(env->hflags & HF_INHIBIT_IRQ_MASK)) {
int intno;
+ svm_check_intercept(SVM_EXIT_INTR);
env->interrupt_request &= ~CPU_INTERRUPT_HARD;
intno = cpu_get_pic_interrupt(env);
if (loglevel & CPU_LOG_TB_IN_ASM) {
@@ -415,6 +431,22 @@ int cpu_exec(CPUState *env1)
#else
T0 = 0;
#endif
+ } else if((interrupt_request & CPU_INTERRUPT_VIRQ) &&
+ (env->eflags & IF_MASK) && !(env->hflags &
HF_INHIBIT_IRQ_MASK)) {
+ int intno;
+ // FIXME: this should respect TPR
+ svm_check_intercept(SVM_EXIT_VINTR);
+ env->interrupt_request &= ~CPU_INTERRUPT_VIRQ;
+ stl_phys(env->vm_vmcb + offsetof(struct vmcb,
control.int_ctl), ldl_phys(env->vm_vmcb + offsetof(struct vmcb,
control.int_ctl)) & ~V_IRQ_MASK);
+ intno = ldl_phys(env->vm_vmcb + offsetof(struct vmcb,
control.int_vector));
+ if (loglevel & CPU_LOG_TB_IN_ASM)
+ fprintf(logfile, "Servicing virtual hardware
INT=0x%02x\n", intno);
+ do_interrupt(intno, 0, 0, -1, 1);
+#if defined(__sparc__) && !defined(HOST_SOLARIS)
+ tmp_T0 = 0;
+#else
+ T0 = 0;
+#endif
}
#elif defined(TARGET_PPC)
#if 0
Index: qemu/target-i386/exec.h
===================================================================
--- qemu.orig/target-i386/exec.h
+++ qemu/target-i386/exec.h
@@ -501,6 +501,15 @@ void update_fp_status(void);
void helper_hlt(void);
void helper_monitor(void);
void helper_mwait(void);
+void helper_vmrun(target_ulong addr);
+void helper_vmmcall(void);
+void helper_vmload(target_ulong addr);
+void helper_vmsave(target_ulong addr);
+void helper_stgi(void);
+void helper_clgi(void);
+void helper_skinit(void);
+void helper_invlpga(void);
+void vmexit(uint64_t exit_code, uint64_t exit_info_1);
extern const uint8_t parity_table[256];
extern const uint8_t rclw_table[32];
@@ -588,3 +597,4 @@ static inline int cpu_halted(CPUState *e
}
return EXCP_HALTED;
}
+
Index: qemu/exec.c
===================================================================
--- qemu.orig/exec.c
+++ qemu/exec.c
@@ -1281,6 +1281,11 @@ void cpu_abort(CPUState *env, const char
vfprintf(stderr, fmt, ap);
fprintf(stderr, "\n");
#ifdef TARGET_I386
+ if(env->intercept & INTERCEPT_SVM_MASK) {
+ // most probably the virtual machine should not
+ // be shut down but rather caught by the VMM
+ vmexit(SVM_EXIT_SHUTDOWN, 0);
+ }
cpu_dump_state(env, stderr, fprintf, X86_DUMP_FPU | X86_DUMP_CCOP);
#else
cpu_dump_state(env, stderr, fprintf, 0);
Index: qemu/exec-all.h
===================================================================
--- qemu.orig/exec-all.h
+++ qemu/exec-all.h
@@ -166,6 +166,7 @@ static inline int tlb_set_page(CPUState
typedef struct TranslationBlock {
target_ulong pc; /* simulated PC corresponding to this block (EIP + CS
base) */
target_ulong cs_base; /* CS base for this block */
+ uint64_t intercept; /* SVM intercept vector */
unsigned int flags; /* flags defining in which context the code was
generated */
uint16_t size; /* size of target code for this block (1 <=
size <= TARGET_PAGE_SIZE) */
Index: qemu/cpu-all.h
===================================================================
--- qemu.orig/cpu-all.h
+++ qemu/cpu-all.h
@@ -715,6 +715,7 @@ extern int code_copy_enabled;
#define CPU_INTERRUPT_HALT 0x20 /* CPU halt wanted */
#define CPU_INTERRUPT_SMI 0x40 /* (x86 only) SMI interrupt pending */
#define CPU_INTERRUPT_DEBUG 0x80 /* Debug event occured. */
+#define CPU_INTERRUPT_VIRQ 0x100 /* virtual interrupt pending. */
void cpu_interrupt(CPUState *s, int mask);
void cpu_reset_interrupt(CPUState *env, int mask);
- [Qemu-devel] [PATCH] SVM support,
Alexander Graf <=