1 /* 2 * i386 helpers (without register variable usage) 3 * 4 * Copyright (c) 2003 Fabrice Bellard 5 * 6 * This library is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU Lesser General Public 8 * License as published by the Free Software Foundation; either 9 * version 2 of the License, or (at your option) any later version. 10 * 11 * This library is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 * Lesser General Public License for more details. 15 * 16 * You should have received a copy of the GNU Lesser General Public 17 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 18 */ 19 20 #include "qemu/osdep.h" 21 #include "cpu.h" 22 #include "exec/exec-all.h" 23 #include "sysemu/kvm.h" 24 #include "kvm_i386.h" 25 #ifndef CONFIG_USER_ONLY 26 #include "sysemu/sysemu.h" 27 #include "monitor/monitor.h" 28 #include "hw/i386/apic_internal.h" 29 #endif 30 31 static void cpu_x86_version(CPUX86State *env, int *family, int *model) 32 { 33 int cpuver = env->cpuid_version; 34 35 if (family == NULL || model == NULL) { 36 return; 37 } 38 39 *family = (cpuver >> 8) & 0x0f; 40 *model = ((cpuver >> 12) & 0xf0) + ((cpuver >> 4) & 0x0f); 41 } 42 43 /* Broadcast MCA signal for processor version 06H_EH and above */ 44 int cpu_x86_support_mca_broadcast(CPUX86State *env) 45 { 46 int family = 0; 47 int model = 0; 48 49 cpu_x86_version(env, &family, &model); 50 if ((family == 6 && model >= 14) || family > 6) { 51 return 1; 52 } 53 54 return 0; 55 } 56 57 /***********************************************************/ 58 /* x86 debug */ 59 60 static const char *cc_op_str[CC_OP_NB] = { 61 "DYNAMIC", 62 "EFLAGS", 63 64 "MULB", 65 "MULW", 66 "MULL", 67 "MULQ", 68 69 "ADDB", 70 "ADDW", 71 "ADDL", 72 "ADDQ", 73 74 "ADCB", 75 "ADCW", 76 "ADCL", 77 "ADCQ", 78 79 "SUBB", 80 "SUBW", 81 "SUBL", 82 "SUBQ", 83 84 "SBBB", 85 "SBBW", 86 "SBBL", 87 "SBBQ", 88 89 "LOGICB", 90 "LOGICW", 91 "LOGICL", 92 "LOGICQ", 93 94 "INCB", 95 "INCW", 96 "INCL", 97 "INCQ", 98 99 "DECB", 100 "DECW", 101 "DECL", 102 "DECQ", 103 104 "SHLB", 105 "SHLW", 106 "SHLL", 107 "SHLQ", 108 109 "SARB", 110 "SARW", 111 "SARL", 112 "SARQ", 113 114 "BMILGB", 115 "BMILGW", 116 "BMILGL", 117 "BMILGQ", 118 119 "ADCX", 120 "ADOX", 121 "ADCOX", 122 123 "CLR", 124 }; 125 126 static void 127 cpu_x86_dump_seg_cache(CPUX86State *env, FILE *f, fprintf_function cpu_fprintf, 128 const char *name, struct SegmentCache *sc) 129 { 130 #ifdef TARGET_X86_64 131 if (env->hflags & HF_CS64_MASK) { 132 cpu_fprintf(f, "%-3s=%04x %016" PRIx64 " %08x %08x", name, 133 sc->selector, sc->base, sc->limit, sc->flags & 0x00ffff00); 134 } else 135 #endif 136 { 137 cpu_fprintf(f, "%-3s=%04x %08x %08x %08x", name, sc->selector, 138 (uint32_t)sc->base, sc->limit, sc->flags & 0x00ffff00); 139 } 140 141 if (!(env->hflags & HF_PE_MASK) || !(sc->flags & DESC_P_MASK)) 142 goto done; 143 144 cpu_fprintf(f, " DPL=%d ", (sc->flags & DESC_DPL_MASK) >> DESC_DPL_SHIFT); 145 if (sc->flags & DESC_S_MASK) { 146 if (sc->flags & DESC_CS_MASK) { 147 cpu_fprintf(f, (sc->flags & DESC_L_MASK) ? "CS64" : 148 ((sc->flags & DESC_B_MASK) ? "CS32" : "CS16")); 149 cpu_fprintf(f, " [%c%c", (sc->flags & DESC_C_MASK) ? 'C' : '-', 150 (sc->flags & DESC_R_MASK) ? 'R' : '-'); 151 } else { 152 cpu_fprintf(f, 153 (sc->flags & DESC_B_MASK || env->hflags & HF_LMA_MASK) 154 ? "DS " : "DS16"); 155 cpu_fprintf(f, " [%c%c", (sc->flags & DESC_E_MASK) ? 'E' : '-', 156 (sc->flags & DESC_W_MASK) ? 'W' : '-'); 157 } 158 cpu_fprintf(f, "%c]", (sc->flags & DESC_A_MASK) ? 'A' : '-'); 159 } else { 160 static const char *sys_type_name[2][16] = { 161 { /* 32 bit mode */ 162 "Reserved", "TSS16-avl", "LDT", "TSS16-busy", 163 "CallGate16", "TaskGate", "IntGate16", "TrapGate16", 164 "Reserved", "TSS32-avl", "Reserved", "TSS32-busy", 165 "CallGate32", "Reserved", "IntGate32", "TrapGate32" 166 }, 167 { /* 64 bit mode */ 168 "<hiword>", "Reserved", "LDT", "Reserved", "Reserved", 169 "Reserved", "Reserved", "Reserved", "Reserved", 170 "TSS64-avl", "Reserved", "TSS64-busy", "CallGate64", 171 "Reserved", "IntGate64", "TrapGate64" 172 } 173 }; 174 cpu_fprintf(f, "%s", 175 sys_type_name[(env->hflags & HF_LMA_MASK) ? 1 : 0] 176 [(sc->flags & DESC_TYPE_MASK) 177 >> DESC_TYPE_SHIFT]); 178 } 179 done: 180 cpu_fprintf(f, "\n"); 181 } 182 183 #ifndef CONFIG_USER_ONLY 184 185 /* ARRAY_SIZE check is not required because 186 * DeliveryMode(dm) has a size of 3 bit. 187 */ 188 static inline const char *dm2str(uint32_t dm) 189 { 190 static const char *str[] = { 191 "Fixed", 192 "...", 193 "SMI", 194 "...", 195 "NMI", 196 "INIT", 197 "...", 198 "ExtINT" 199 }; 200 return str[dm]; 201 } 202 203 static void dump_apic_lvt(FILE *f, fprintf_function cpu_fprintf, 204 const char *name, uint32_t lvt, bool is_timer) 205 { 206 uint32_t dm = (lvt & APIC_LVT_DELIV_MOD) >> APIC_LVT_DELIV_MOD_SHIFT; 207 cpu_fprintf(f, 208 "%s\t 0x%08x %s %-5s %-6s %-7s %-12s %-6s", 209 name, lvt, 210 lvt & APIC_LVT_INT_POLARITY ? "active-lo" : "active-hi", 211 lvt & APIC_LVT_LEVEL_TRIGGER ? "level" : "edge", 212 lvt & APIC_LVT_MASKED ? "masked" : "", 213 lvt & APIC_LVT_DELIV_STS ? "pending" : "", 214 !is_timer ? 215 "" : lvt & APIC_LVT_TIMER_PERIODIC ? 216 "periodic" : lvt & APIC_LVT_TIMER_TSCDEADLINE ? 217 "tsc-deadline" : "one-shot", 218 dm2str(dm)); 219 if (dm != APIC_DM_NMI) { 220 cpu_fprintf(f, " (vec %u)\n", lvt & APIC_VECTOR_MASK); 221 } else { 222 cpu_fprintf(f, "\n"); 223 } 224 } 225 226 /* ARRAY_SIZE check is not required because 227 * destination shorthand has a size of 2 bit. 228 */ 229 static inline const char *shorthand2str(uint32_t shorthand) 230 { 231 const char *str[] = { 232 "no-shorthand", "self", "all-self", "all" 233 }; 234 return str[shorthand]; 235 } 236 237 static inline uint8_t divider_conf(uint32_t divide_conf) 238 { 239 uint8_t divide_val = ((divide_conf & 0x8) >> 1) | (divide_conf & 0x3); 240 241 return divide_val == 7 ? 1 : 2 << divide_val; 242 } 243 244 static inline void mask2str(char *str, uint32_t val, uint8_t size) 245 { 246 while (size--) { 247 *str++ = (val >> size) & 1 ? '1' : '0'; 248 } 249 *str = 0; 250 } 251 252 #define MAX_LOGICAL_APIC_ID_MASK_SIZE 16 253 254 static void dump_apic_icr(FILE *f, fprintf_function cpu_fprintf, 255 APICCommonState *s, CPUX86State *env) 256 { 257 uint32_t icr = s->icr[0], icr2 = s->icr[1]; 258 uint8_t dest_shorthand = \ 259 (icr & APIC_ICR_DEST_SHORT) >> APIC_ICR_DEST_SHORT_SHIFT; 260 bool logical_mod = icr & APIC_ICR_DEST_MOD; 261 char apic_id_str[MAX_LOGICAL_APIC_ID_MASK_SIZE + 1]; 262 uint32_t dest_field; 263 bool x2apic; 264 265 cpu_fprintf(f, "ICR\t 0x%08x %s %s %s %s\n", 266 icr, 267 logical_mod ? "logical" : "physical", 268 icr & APIC_ICR_TRIGGER_MOD ? "level" : "edge", 269 icr & APIC_ICR_LEVEL ? "assert" : "de-assert", 270 shorthand2str(dest_shorthand)); 271 272 cpu_fprintf(f, "ICR2\t 0x%08x", icr2); 273 if (dest_shorthand != 0) { 274 cpu_fprintf(f, "\n"); 275 return; 276 } 277 x2apic = env->features[FEAT_1_ECX] & CPUID_EXT_X2APIC; 278 dest_field = x2apic ? icr2 : icr2 >> APIC_ICR_DEST_SHIFT; 279 280 if (!logical_mod) { 281 if (x2apic) { 282 cpu_fprintf(f, " cpu %u (X2APIC ID)\n", dest_field); 283 } else { 284 cpu_fprintf(f, " cpu %u (APIC ID)\n", 285 dest_field & APIC_LOGDEST_XAPIC_ID); 286 } 287 return; 288 } 289 290 if (s->dest_mode == 0xf) { /* flat mode */ 291 mask2str(apic_id_str, icr2 >> APIC_ICR_DEST_SHIFT, 8); 292 cpu_fprintf(f, " mask %s (APIC ID)\n", apic_id_str); 293 } else if (s->dest_mode == 0) { /* cluster mode */ 294 if (x2apic) { 295 mask2str(apic_id_str, dest_field & APIC_LOGDEST_X2APIC_ID, 16); 296 cpu_fprintf(f, " cluster %u mask %s (X2APIC ID)\n", 297 dest_field >> APIC_LOGDEST_X2APIC_SHIFT, apic_id_str); 298 } else { 299 mask2str(apic_id_str, dest_field & APIC_LOGDEST_XAPIC_ID, 4); 300 cpu_fprintf(f, " cluster %u mask %s (APIC ID)\n", 301 dest_field >> APIC_LOGDEST_XAPIC_SHIFT, apic_id_str); 302 } 303 } 304 } 305 306 static void dump_apic_interrupt(FILE *f, fprintf_function cpu_fprintf, 307 const char *name, uint32_t *ireg_tab, 308 uint32_t *tmr_tab) 309 { 310 int i, empty = true; 311 312 cpu_fprintf(f, "%s\t ", name); 313 for (i = 0; i < 256; i++) { 314 if (apic_get_bit(ireg_tab, i)) { 315 cpu_fprintf(f, "%u%s ", i, 316 apic_get_bit(tmr_tab, i) ? "(level)" : ""); 317 empty = false; 318 } 319 } 320 cpu_fprintf(f, "%s\n", empty ? "(none)" : ""); 321 } 322 323 void x86_cpu_dump_local_apic_state(CPUState *cs, FILE *f, 324 fprintf_function cpu_fprintf, int flags) 325 { 326 X86CPU *cpu = X86_CPU(cs); 327 APICCommonState *s = APIC_COMMON(cpu->apic_state); 328 uint32_t *lvt = s->lvt; 329 330 cpu_fprintf(f, "dumping local APIC state for CPU %-2u\n\n", 331 CPU(cpu)->cpu_index); 332 dump_apic_lvt(f, cpu_fprintf, "LVT0", lvt[APIC_LVT_LINT0], false); 333 dump_apic_lvt(f, cpu_fprintf, "LVT1", lvt[APIC_LVT_LINT1], false); 334 dump_apic_lvt(f, cpu_fprintf, "LVTPC", lvt[APIC_LVT_PERFORM], false); 335 dump_apic_lvt(f, cpu_fprintf, "LVTERR", lvt[APIC_LVT_ERROR], false); 336 dump_apic_lvt(f, cpu_fprintf, "LVTTHMR", lvt[APIC_LVT_THERMAL], false); 337 dump_apic_lvt(f, cpu_fprintf, "LVTT", lvt[APIC_LVT_TIMER], true); 338 339 cpu_fprintf(f, "Timer\t DCR=0x%x (divide by %u) initial_count = %u\n", 340 s->divide_conf & APIC_DCR_MASK, 341 divider_conf(s->divide_conf), 342 s->initial_count); 343 344 cpu_fprintf(f, "SPIV\t 0x%08x APIC %s, focus=%s, spurious vec %u\n", 345 s->spurious_vec, 346 s->spurious_vec & APIC_SPURIO_ENABLED ? "enabled" : "disabled", 347 s->spurious_vec & APIC_SPURIO_FOCUS ? "on" : "off", 348 s->spurious_vec & APIC_VECTOR_MASK); 349 350 dump_apic_icr(f, cpu_fprintf, s, &cpu->env); 351 352 cpu_fprintf(f, "ESR\t 0x%08x\n", s->esr); 353 354 dump_apic_interrupt(f, cpu_fprintf, "ISR", s->isr, s->tmr); 355 dump_apic_interrupt(f, cpu_fprintf, "IRR", s->irr, s->tmr); 356 357 cpu_fprintf(f, "\nAPR 0x%02x TPR 0x%02x DFR 0x%02x LDR 0x%02x", 358 s->arb_id, s->tpr, s->dest_mode, s->log_dest); 359 if (s->dest_mode == 0) { 360 cpu_fprintf(f, "(cluster %u: id %u)", 361 s->log_dest >> APIC_LOGDEST_XAPIC_SHIFT, 362 s->log_dest & APIC_LOGDEST_XAPIC_ID); 363 } 364 cpu_fprintf(f, " PPR 0x%02x\n", apic_get_ppr(s)); 365 } 366 #else 367 void x86_cpu_dump_local_apic_state(CPUState *cs, FILE *f, 368 fprintf_function cpu_fprintf, int flags) 369 { 370 } 371 #endif /* !CONFIG_USER_ONLY */ 372 373 #define DUMP_CODE_BYTES_TOTAL 50 374 #define DUMP_CODE_BYTES_BACKWARD 20 375 376 void x86_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf, 377 int flags) 378 { 379 X86CPU *cpu = X86_CPU(cs); 380 CPUX86State *env = &cpu->env; 381 int eflags, i, nb; 382 char cc_op_name[32]; 383 static const char *seg_name[6] = { "ES", "CS", "SS", "DS", "FS", "GS" }; 384 385 eflags = cpu_compute_eflags(env); 386 #ifdef TARGET_X86_64 387 if (env->hflags & HF_CS64_MASK) { 388 cpu_fprintf(f, 389 "RAX=%016" PRIx64 " RBX=%016" PRIx64 " RCX=%016" PRIx64 " RDX=%016" PRIx64 "\n" 390 "RSI=%016" PRIx64 " RDI=%016" PRIx64 " RBP=%016" PRIx64 " RSP=%016" PRIx64 "\n" 391 "R8 =%016" PRIx64 " R9 =%016" PRIx64 " R10=%016" PRIx64 " R11=%016" PRIx64 "\n" 392 "R12=%016" PRIx64 " R13=%016" PRIx64 " R14=%016" PRIx64 " R15=%016" PRIx64 "\n" 393 "RIP=%016" PRIx64 " RFL=%08x [%c%c%c%c%c%c%c] CPL=%d II=%d A20=%d SMM=%d HLT=%d\n", 394 env->regs[R_EAX], 395 env->regs[R_EBX], 396 env->regs[R_ECX], 397 env->regs[R_EDX], 398 env->regs[R_ESI], 399 env->regs[R_EDI], 400 env->regs[R_EBP], 401 env->regs[R_ESP], 402 env->regs[8], 403 env->regs[9], 404 env->regs[10], 405 env->regs[11], 406 env->regs[12], 407 env->regs[13], 408 env->regs[14], 409 env->regs[15], 410 env->eip, eflags, 411 eflags & DF_MASK ? 'D' : '-', 412 eflags & CC_O ? 'O' : '-', 413 eflags & CC_S ? 'S' : '-', 414 eflags & CC_Z ? 'Z' : '-', 415 eflags & CC_A ? 'A' : '-', 416 eflags & CC_P ? 'P' : '-', 417 eflags & CC_C ? 'C' : '-', 418 env->hflags & HF_CPL_MASK, 419 (env->hflags >> HF_INHIBIT_IRQ_SHIFT) & 1, 420 (env->a20_mask >> 20) & 1, 421 (env->hflags >> HF_SMM_SHIFT) & 1, 422 cs->halted); 423 } else 424 #endif 425 { 426 cpu_fprintf(f, "EAX=%08x EBX=%08x ECX=%08x EDX=%08x\n" 427 "ESI=%08x EDI=%08x EBP=%08x ESP=%08x\n" 428 "EIP=%08x EFL=%08x [%c%c%c%c%c%c%c] CPL=%d II=%d A20=%d SMM=%d HLT=%d\n", 429 (uint32_t)env->regs[R_EAX], 430 (uint32_t)env->regs[R_EBX], 431 (uint32_t)env->regs[R_ECX], 432 (uint32_t)env->regs[R_EDX], 433 (uint32_t)env->regs[R_ESI], 434 (uint32_t)env->regs[R_EDI], 435 (uint32_t)env->regs[R_EBP], 436 (uint32_t)env->regs[R_ESP], 437 (uint32_t)env->eip, eflags, 438 eflags & DF_MASK ? 'D' : '-', 439 eflags & CC_O ? 'O' : '-', 440 eflags & CC_S ? 'S' : '-', 441 eflags & CC_Z ? 'Z' : '-', 442 eflags & CC_A ? 'A' : '-', 443 eflags & CC_P ? 'P' : '-', 444 eflags & CC_C ? 'C' : '-', 445 env->hflags & HF_CPL_MASK, 446 (env->hflags >> HF_INHIBIT_IRQ_SHIFT) & 1, 447 (env->a20_mask >> 20) & 1, 448 (env->hflags >> HF_SMM_SHIFT) & 1, 449 cs->halted); 450 } 451 452 for(i = 0; i < 6; i++) { 453 cpu_x86_dump_seg_cache(env, f, cpu_fprintf, seg_name[i], 454 &env->segs[i]); 455 } 456 cpu_x86_dump_seg_cache(env, f, cpu_fprintf, "LDT", &env->ldt); 457 cpu_x86_dump_seg_cache(env, f, cpu_fprintf, "TR", &env->tr); 458 459 #ifdef TARGET_X86_64 460 if (env->hflags & HF_LMA_MASK) { 461 cpu_fprintf(f, "GDT= %016" PRIx64 " %08x\n", 462 env->gdt.base, env->gdt.limit); 463 cpu_fprintf(f, "IDT= %016" PRIx64 " %08x\n", 464 env->idt.base, env->idt.limit); 465 cpu_fprintf(f, "CR0=%08x CR2=%016" PRIx64 " CR3=%016" PRIx64 " CR4=%08x\n", 466 (uint32_t)env->cr[0], 467 env->cr[2], 468 env->cr[3], 469 (uint32_t)env->cr[4]); 470 for(i = 0; i < 4; i++) 471 cpu_fprintf(f, "DR%d=%016" PRIx64 " ", i, env->dr[i]); 472 cpu_fprintf(f, "\nDR6=%016" PRIx64 " DR7=%016" PRIx64 "\n", 473 env->dr[6], env->dr[7]); 474 } else 475 #endif 476 { 477 cpu_fprintf(f, "GDT= %08x %08x\n", 478 (uint32_t)env->gdt.base, env->gdt.limit); 479 cpu_fprintf(f, "IDT= %08x %08x\n", 480 (uint32_t)env->idt.base, env->idt.limit); 481 cpu_fprintf(f, "CR0=%08x CR2=%08x CR3=%08x CR4=%08x\n", 482 (uint32_t)env->cr[0], 483 (uint32_t)env->cr[2], 484 (uint32_t)env->cr[3], 485 (uint32_t)env->cr[4]); 486 for(i = 0; i < 4; i++) { 487 cpu_fprintf(f, "DR%d=" TARGET_FMT_lx " ", i, env->dr[i]); 488 } 489 cpu_fprintf(f, "\nDR6=" TARGET_FMT_lx " DR7=" TARGET_FMT_lx "\n", 490 env->dr[6], env->dr[7]); 491 } 492 if (flags & CPU_DUMP_CCOP) { 493 if ((unsigned)env->cc_op < CC_OP_NB) 494 snprintf(cc_op_name, sizeof(cc_op_name), "%s", cc_op_str[env->cc_op]); 495 else 496 snprintf(cc_op_name, sizeof(cc_op_name), "[%d]", env->cc_op); 497 #ifdef TARGET_X86_64 498 if (env->hflags & HF_CS64_MASK) { 499 cpu_fprintf(f, "CCS=%016" PRIx64 " CCD=%016" PRIx64 " CCO=%-8s\n", 500 env->cc_src, env->cc_dst, 501 cc_op_name); 502 } else 503 #endif 504 { 505 cpu_fprintf(f, "CCS=%08x CCD=%08x CCO=%-8s\n", 506 (uint32_t)env->cc_src, (uint32_t)env->cc_dst, 507 cc_op_name); 508 } 509 } 510 cpu_fprintf(f, "EFER=%016" PRIx64 "\n", env->efer); 511 if (flags & CPU_DUMP_FPU) { 512 int fptag; 513 fptag = 0; 514 for(i = 0; i < 8; i++) { 515 fptag |= ((!env->fptags[i]) << i); 516 } 517 cpu_fprintf(f, "FCW=%04x FSW=%04x [ST=%d] FTW=%02x MXCSR=%08x\n", 518 env->fpuc, 519 (env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11, 520 env->fpstt, 521 fptag, 522 env->mxcsr); 523 for(i=0;i<8;i++) { 524 CPU_LDoubleU u; 525 u.d = env->fpregs[i].d; 526 cpu_fprintf(f, "FPR%d=%016" PRIx64 " %04x", 527 i, u.l.lower, u.l.upper); 528 if ((i & 1) == 1) 529 cpu_fprintf(f, "\n"); 530 else 531 cpu_fprintf(f, " "); 532 } 533 if (env->hflags & HF_CS64_MASK) 534 nb = 16; 535 else 536 nb = 8; 537 for(i=0;i<nb;i++) { 538 cpu_fprintf(f, "XMM%02d=%08x%08x%08x%08x", 539 i, 540 env->xmm_regs[i].ZMM_L(3), 541 env->xmm_regs[i].ZMM_L(2), 542 env->xmm_regs[i].ZMM_L(1), 543 env->xmm_regs[i].ZMM_L(0)); 544 if ((i & 1) == 1) 545 cpu_fprintf(f, "\n"); 546 else 547 cpu_fprintf(f, " "); 548 } 549 } 550 if (flags & CPU_DUMP_CODE) { 551 target_ulong base = env->segs[R_CS].base + env->eip; 552 target_ulong offs = MIN(env->eip, DUMP_CODE_BYTES_BACKWARD); 553 uint8_t code; 554 char codestr[3]; 555 556 cpu_fprintf(f, "Code="); 557 for (i = 0; i < DUMP_CODE_BYTES_TOTAL; i++) { 558 if (cpu_memory_rw_debug(cs, base - offs + i, &code, 1, 0) == 0) { 559 snprintf(codestr, sizeof(codestr), "%02x", code); 560 } else { 561 snprintf(codestr, sizeof(codestr), "??"); 562 } 563 cpu_fprintf(f, "%s%s%s%s", i > 0 ? " " : "", 564 i == offs ? "<" : "", codestr, i == offs ? ">" : ""); 565 } 566 cpu_fprintf(f, "\n"); 567 } 568 } 569 570 /***********************************************************/ 571 /* x86 mmu */ 572 /* XXX: add PGE support */ 573 574 void x86_cpu_set_a20(X86CPU *cpu, int a20_state) 575 { 576 CPUX86State *env = &cpu->env; 577 578 a20_state = (a20_state != 0); 579 if (a20_state != ((env->a20_mask >> 20) & 1)) { 580 CPUState *cs = CPU(cpu); 581 582 qemu_log_mask(CPU_LOG_MMU, "A20 update: a20=%d\n", a20_state); 583 /* if the cpu is currently executing code, we must unlink it and 584 all the potentially executing TB */ 585 cpu_interrupt(cs, CPU_INTERRUPT_EXITTB); 586 587 /* when a20 is changed, all the MMU mappings are invalid, so 588 we must flush everything */ 589 tlb_flush(cs, 1); 590 env->a20_mask = ~(1 << 20) | (a20_state << 20); 591 } 592 } 593 594 void cpu_x86_update_cr0(CPUX86State *env, uint32_t new_cr0) 595 { 596 X86CPU *cpu = x86_env_get_cpu(env); 597 int pe_state; 598 599 qemu_log_mask(CPU_LOG_MMU, "CR0 update: CR0=0x%08x\n", new_cr0); 600 if ((new_cr0 & (CR0_PG_MASK | CR0_WP_MASK | CR0_PE_MASK)) != 601 (env->cr[0] & (CR0_PG_MASK | CR0_WP_MASK | CR0_PE_MASK))) { 602 tlb_flush(CPU(cpu), 1); 603 } 604 605 #ifdef TARGET_X86_64 606 if (!(env->cr[0] & CR0_PG_MASK) && (new_cr0 & CR0_PG_MASK) && 607 (env->efer & MSR_EFER_LME)) { 608 /* enter in long mode */ 609 /* XXX: generate an exception */ 610 if (!(env->cr[4] & CR4_PAE_MASK)) 611 return; 612 env->efer |= MSR_EFER_LMA; 613 env->hflags |= HF_LMA_MASK; 614 } else if ((env->cr[0] & CR0_PG_MASK) && !(new_cr0 & CR0_PG_MASK) && 615 (env->efer & MSR_EFER_LMA)) { 616 /* exit long mode */ 617 env->efer &= ~MSR_EFER_LMA; 618 env->hflags &= ~(HF_LMA_MASK | HF_CS64_MASK); 619 env->eip &= 0xffffffff; 620 } 621 #endif 622 env->cr[0] = new_cr0 | CR0_ET_MASK; 623 624 /* update PE flag in hidden flags */ 625 pe_state = (env->cr[0] & CR0_PE_MASK); 626 env->hflags = (env->hflags & ~HF_PE_MASK) | (pe_state << HF_PE_SHIFT); 627 /* ensure that ADDSEG is always set in real mode */ 628 env->hflags |= ((pe_state ^ 1) << HF_ADDSEG_SHIFT); 629 /* update FPU flags */ 630 env->hflags = (env->hflags & ~(HF_MP_MASK | HF_EM_MASK | HF_TS_MASK)) | 631 ((new_cr0 << (HF_MP_SHIFT - 1)) & (HF_MP_MASK | HF_EM_MASK | HF_TS_MASK)); 632 } 633 634 /* XXX: in legacy PAE mode, generate a GPF if reserved bits are set in 635 the PDPT */ 636 void cpu_x86_update_cr3(CPUX86State *env, target_ulong new_cr3) 637 { 638 X86CPU *cpu = x86_env_get_cpu(env); 639 640 env->cr[3] = new_cr3; 641 if (env->cr[0] & CR0_PG_MASK) { 642 qemu_log_mask(CPU_LOG_MMU, 643 "CR3 update: CR3=" TARGET_FMT_lx "\n", new_cr3); 644 tlb_flush(CPU(cpu), 0); 645 } 646 } 647 648 void cpu_x86_update_cr4(CPUX86State *env, uint32_t new_cr4) 649 { 650 X86CPU *cpu = x86_env_get_cpu(env); 651 uint32_t hflags; 652 653 #if defined(DEBUG_MMU) 654 printf("CR4 update: %08x -> %08x\n", (uint32_t)env->cr[4], new_cr4); 655 #endif 656 if ((new_cr4 ^ env->cr[4]) & 657 (CR4_PGE_MASK | CR4_PAE_MASK | CR4_PSE_MASK | 658 CR4_SMEP_MASK | CR4_SMAP_MASK | CR4_LA57_MASK)) { 659 tlb_flush(CPU(cpu), 1); 660 } 661 662 /* Clear bits we're going to recompute. */ 663 hflags = env->hflags & ~(HF_OSFXSR_MASK | HF_SMAP_MASK); 664 665 /* SSE handling */ 666 if (!(env->features[FEAT_1_EDX] & CPUID_SSE)) { 667 new_cr4 &= ~CR4_OSFXSR_MASK; 668 } 669 if (new_cr4 & CR4_OSFXSR_MASK) { 670 hflags |= HF_OSFXSR_MASK; 671 } 672 673 if (!(env->features[FEAT_7_0_EBX] & CPUID_7_0_EBX_SMAP)) { 674 new_cr4 &= ~CR4_SMAP_MASK; 675 } 676 if (new_cr4 & CR4_SMAP_MASK) { 677 hflags |= HF_SMAP_MASK; 678 } 679 680 if (!(env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_PKU)) { 681 new_cr4 &= ~CR4_PKE_MASK; 682 } 683 684 env->cr[4] = new_cr4; 685 env->hflags = hflags; 686 687 cpu_sync_bndcs_hflags(env); 688 } 689 690 #if defined(CONFIG_USER_ONLY) 691 692 int x86_cpu_handle_mmu_fault(CPUState *cs, vaddr addr, 693 int is_write, int mmu_idx) 694 { 695 X86CPU *cpu = X86_CPU(cs); 696 CPUX86State *env = &cpu->env; 697 698 /* user mode only emulation */ 699 is_write &= 1; 700 env->cr[2] = addr; 701 env->error_code = (is_write << PG_ERROR_W_BIT); 702 env->error_code |= PG_ERROR_U_MASK; 703 cs->exception_index = EXCP0E_PAGE; 704 env->exception_is_int = 0; 705 env->exception_next_eip = -1; 706 return 1; 707 } 708 709 #else 710 711 /* return value: 712 * -1 = cannot handle fault 713 * 0 = nothing more to do 714 * 1 = generate PF fault 715 */ 716 int x86_cpu_handle_mmu_fault(CPUState *cs, vaddr addr, 717 int is_write1, int mmu_idx) 718 { 719 X86CPU *cpu = X86_CPU(cs); 720 CPUX86State *env = &cpu->env; 721 uint64_t ptep, pte; 722 target_ulong pde_addr, pte_addr; 723 int error_code = 0; 724 int is_dirty, prot, page_size, is_write, is_user; 725 hwaddr paddr; 726 uint64_t rsvd_mask = PG_HI_RSVD_MASK; 727 uint32_t page_offset; 728 target_ulong vaddr; 729 730 is_user = mmu_idx == MMU_USER_IDX; 731 #if defined(DEBUG_MMU) 732 printf("MMU fault: addr=%" VADDR_PRIx " w=%d u=%d eip=" TARGET_FMT_lx "\n", 733 addr, is_write1, is_user, env->eip); 734 #endif 735 is_write = is_write1 & 1; 736 737 if (!(env->cr[0] & CR0_PG_MASK)) { 738 pte = addr; 739 #ifdef TARGET_X86_64 740 if (!(env->hflags & HF_LMA_MASK)) { 741 /* Without long mode we can only address 32bits in real mode */ 742 pte = (uint32_t)pte; 743 } 744 #endif 745 prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 746 page_size = 4096; 747 goto do_mapping; 748 } 749 750 if (!(env->efer & MSR_EFER_NXE)) { 751 rsvd_mask |= PG_NX_MASK; 752 } 753 754 if (env->cr[4] & CR4_PAE_MASK) { 755 uint64_t pde, pdpe; 756 target_ulong pdpe_addr; 757 758 #ifdef TARGET_X86_64 759 if (env->hflags & HF_LMA_MASK) { 760 bool la57 = env->cr[4] & CR4_LA57_MASK; 761 uint64_t pml5e_addr, pml5e; 762 uint64_t pml4e_addr, pml4e; 763 int32_t sext; 764 765 /* test virtual address sign extension */ 766 sext = la57 ? (int64_t)addr >> 56 : (int64_t)addr >> 47; 767 if (sext != 0 && sext != -1) { 768 env->error_code = 0; 769 cs->exception_index = EXCP0D_GPF; 770 return 1; 771 } 772 773 if (la57) { 774 pml5e_addr = ((env->cr[3] & ~0xfff) + 775 (((addr >> 48) & 0x1ff) << 3)) & env->a20_mask; 776 pml5e = x86_ldq_phys(cs, pml5e_addr); 777 if (!(pml5e & PG_PRESENT_MASK)) { 778 goto do_fault; 779 } 780 if (pml5e & (rsvd_mask | PG_PSE_MASK)) { 781 goto do_fault_rsvd; 782 } 783 if (!(pml5e & PG_ACCESSED_MASK)) { 784 pml5e |= PG_ACCESSED_MASK; 785 x86_stl_phys_notdirty(cs, pml5e_addr, pml5e); 786 } 787 ptep = pml5e ^ PG_NX_MASK; 788 } else { 789 pml5e = env->cr[3]; 790 ptep = PG_NX_MASK | PG_USER_MASK | PG_RW_MASK; 791 } 792 793 pml4e_addr = ((pml5e & PG_ADDRESS_MASK) + 794 (((addr >> 39) & 0x1ff) << 3)) & env->a20_mask; 795 pml4e = x86_ldq_phys(cs, pml4e_addr); 796 if (!(pml4e & PG_PRESENT_MASK)) { 797 goto do_fault; 798 } 799 if (pml4e & (rsvd_mask | PG_PSE_MASK)) { 800 goto do_fault_rsvd; 801 } 802 if (!(pml4e & PG_ACCESSED_MASK)) { 803 pml4e |= PG_ACCESSED_MASK; 804 x86_stl_phys_notdirty(cs, pml4e_addr, pml4e); 805 } 806 ptep &= pml4e ^ PG_NX_MASK; 807 pdpe_addr = ((pml4e & PG_ADDRESS_MASK) + (((addr >> 30) & 0x1ff) << 3)) & 808 env->a20_mask; 809 pdpe = x86_ldq_phys(cs, pdpe_addr); 810 if (!(pdpe & PG_PRESENT_MASK)) { 811 goto do_fault; 812 } 813 if (pdpe & rsvd_mask) { 814 goto do_fault_rsvd; 815 } 816 ptep &= pdpe ^ PG_NX_MASK; 817 if (!(pdpe & PG_ACCESSED_MASK)) { 818 pdpe |= PG_ACCESSED_MASK; 819 x86_stl_phys_notdirty(cs, pdpe_addr, pdpe); 820 } 821 if (pdpe & PG_PSE_MASK) { 822 /* 1 GB page */ 823 page_size = 1024 * 1024 * 1024; 824 pte_addr = pdpe_addr; 825 pte = pdpe; 826 goto do_check_protect; 827 } 828 } else 829 #endif 830 { 831 /* XXX: load them when cr3 is loaded ? */ 832 pdpe_addr = ((env->cr[3] & ~0x1f) + ((addr >> 27) & 0x18)) & 833 env->a20_mask; 834 pdpe = x86_ldq_phys(cs, pdpe_addr); 835 if (!(pdpe & PG_PRESENT_MASK)) { 836 goto do_fault; 837 } 838 rsvd_mask |= PG_HI_USER_MASK; 839 if (pdpe & (rsvd_mask | PG_NX_MASK)) { 840 goto do_fault_rsvd; 841 } 842 ptep = PG_NX_MASK | PG_USER_MASK | PG_RW_MASK; 843 } 844 845 pde_addr = ((pdpe & PG_ADDRESS_MASK) + (((addr >> 21) & 0x1ff) << 3)) & 846 env->a20_mask; 847 pde = x86_ldq_phys(cs, pde_addr); 848 if (!(pde & PG_PRESENT_MASK)) { 849 goto do_fault; 850 } 851 if (pde & rsvd_mask) { 852 goto do_fault_rsvd; 853 } 854 ptep &= pde ^ PG_NX_MASK; 855 if (pde & PG_PSE_MASK) { 856 /* 2 MB page */ 857 page_size = 2048 * 1024; 858 pte_addr = pde_addr; 859 pte = pde; 860 goto do_check_protect; 861 } 862 /* 4 KB page */ 863 if (!(pde & PG_ACCESSED_MASK)) { 864 pde |= PG_ACCESSED_MASK; 865 x86_stl_phys_notdirty(cs, pde_addr, pde); 866 } 867 pte_addr = ((pde & PG_ADDRESS_MASK) + (((addr >> 12) & 0x1ff) << 3)) & 868 env->a20_mask; 869 pte = x86_ldq_phys(cs, pte_addr); 870 if (!(pte & PG_PRESENT_MASK)) { 871 goto do_fault; 872 } 873 if (pte & rsvd_mask) { 874 goto do_fault_rsvd; 875 } 876 /* combine pde and pte nx, user and rw protections */ 877 ptep &= pte ^ PG_NX_MASK; 878 page_size = 4096; 879 } else { 880 uint32_t pde; 881 882 /* page directory entry */ 883 pde_addr = ((env->cr[3] & ~0xfff) + ((addr >> 20) & 0xffc)) & 884 env->a20_mask; 885 pde = x86_ldl_phys(cs, pde_addr); 886 if (!(pde & PG_PRESENT_MASK)) { 887 goto do_fault; 888 } 889 ptep = pde | PG_NX_MASK; 890 891 /* if PSE bit is set, then we use a 4MB page */ 892 if ((pde & PG_PSE_MASK) && (env->cr[4] & CR4_PSE_MASK)) { 893 page_size = 4096 * 1024; 894 pte_addr = pde_addr; 895 896 /* Bits 20-13 provide bits 39-32 of the address, bit 21 is reserved. 897 * Leave bits 20-13 in place for setting accessed/dirty bits below. 898 */ 899 pte = pde | ((pde & 0x1fe000LL) << (32 - 13)); 900 rsvd_mask = 0x200000; 901 goto do_check_protect_pse36; 902 } 903 904 if (!(pde & PG_ACCESSED_MASK)) { 905 pde |= PG_ACCESSED_MASK; 906 x86_stl_phys_notdirty(cs, pde_addr, pde); 907 } 908 909 /* page directory entry */ 910 pte_addr = ((pde & ~0xfff) + ((addr >> 10) & 0xffc)) & 911 env->a20_mask; 912 pte = x86_ldl_phys(cs, pte_addr); 913 if (!(pte & PG_PRESENT_MASK)) { 914 goto do_fault; 915 } 916 /* combine pde and pte user and rw protections */ 917 ptep &= pte | PG_NX_MASK; 918 page_size = 4096; 919 rsvd_mask = 0; 920 } 921 922 do_check_protect: 923 rsvd_mask |= (page_size - 1) & PG_ADDRESS_MASK & ~PG_PSE_PAT_MASK; 924 do_check_protect_pse36: 925 if (pte & rsvd_mask) { 926 goto do_fault_rsvd; 927 } 928 ptep ^= PG_NX_MASK; 929 930 /* can the page can be put in the TLB? prot will tell us */ 931 if (is_user && !(ptep & PG_USER_MASK)) { 932 goto do_fault_protect; 933 } 934 935 prot = 0; 936 if (mmu_idx != MMU_KSMAP_IDX || !(ptep & PG_USER_MASK)) { 937 prot |= PAGE_READ; 938 if ((ptep & PG_RW_MASK) || (!is_user && !(env->cr[0] & CR0_WP_MASK))) { 939 prot |= PAGE_WRITE; 940 } 941 } 942 if (!(ptep & PG_NX_MASK) && 943 (mmu_idx == MMU_USER_IDX || 944 !((env->cr[4] & CR4_SMEP_MASK) && (ptep & PG_USER_MASK)))) { 945 prot |= PAGE_EXEC; 946 } 947 if ((env->cr[4] & CR4_PKE_MASK) && (env->hflags & HF_LMA_MASK) && 948 (ptep & PG_USER_MASK) && env->pkru) { 949 uint32_t pk = (pte & PG_PKRU_MASK) >> PG_PKRU_BIT; 950 uint32_t pkru_ad = (env->pkru >> pk * 2) & 1; 951 uint32_t pkru_wd = (env->pkru >> pk * 2) & 2; 952 uint32_t pkru_prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 953 954 if (pkru_ad) { 955 pkru_prot &= ~(PAGE_READ | PAGE_WRITE); 956 } else if (pkru_wd && (is_user || env->cr[0] & CR0_WP_MASK)) { 957 pkru_prot &= ~PAGE_WRITE; 958 } 959 960 prot &= pkru_prot; 961 if ((pkru_prot & (1 << is_write1)) == 0) { 962 assert(is_write1 != 2); 963 error_code |= PG_ERROR_PK_MASK; 964 goto do_fault_protect; 965 } 966 } 967 968 if ((prot & (1 << is_write1)) == 0) { 969 goto do_fault_protect; 970 } 971 972 /* yes, it can! */ 973 is_dirty = is_write && !(pte & PG_DIRTY_MASK); 974 if (!(pte & PG_ACCESSED_MASK) || is_dirty) { 975 pte |= PG_ACCESSED_MASK; 976 if (is_dirty) { 977 pte |= PG_DIRTY_MASK; 978 } 979 x86_stl_phys_notdirty(cs, pte_addr, pte); 980 } 981 982 if (!(pte & PG_DIRTY_MASK)) { 983 /* only set write access if already dirty... otherwise wait 984 for dirty access */ 985 assert(!is_write); 986 prot &= ~PAGE_WRITE; 987 } 988 989 do_mapping: 990 pte = pte & env->a20_mask; 991 992 /* align to page_size */ 993 pte &= PG_ADDRESS_MASK & ~(page_size - 1); 994 995 /* Even if 4MB pages, we map only one 4KB page in the cache to 996 avoid filling it too fast */ 997 vaddr = addr & TARGET_PAGE_MASK; 998 page_offset = vaddr & (page_size - 1); 999 paddr = pte + page_offset; 1000 1001 assert(prot & (1 << is_write1)); 1002 tlb_set_page_with_attrs(cs, vaddr, paddr, cpu_get_mem_attrs(env), 1003 prot, mmu_idx, page_size); 1004 return 0; 1005 do_fault_rsvd: 1006 error_code |= PG_ERROR_RSVD_MASK; 1007 do_fault_protect: 1008 error_code |= PG_ERROR_P_MASK; 1009 do_fault: 1010 error_code |= (is_write << PG_ERROR_W_BIT); 1011 if (is_user) 1012 error_code |= PG_ERROR_U_MASK; 1013 if (is_write1 == 2 && 1014 (((env->efer & MSR_EFER_NXE) && 1015 (env->cr[4] & CR4_PAE_MASK)) || 1016 (env->cr[4] & CR4_SMEP_MASK))) 1017 error_code |= PG_ERROR_I_D_MASK; 1018 if (env->intercept_exceptions & (1 << EXCP0E_PAGE)) { 1019 /* cr2 is not modified in case of exceptions */ 1020 x86_stq_phys(cs, 1021 env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2), 1022 addr); 1023 } else { 1024 env->cr[2] = addr; 1025 } 1026 env->error_code = error_code; 1027 cs->exception_index = EXCP0E_PAGE; 1028 return 1; 1029 } 1030 1031 hwaddr x86_cpu_get_phys_page_debug(CPUState *cs, vaddr addr) 1032 { 1033 X86CPU *cpu = X86_CPU(cs); 1034 CPUX86State *env = &cpu->env; 1035 target_ulong pde_addr, pte_addr; 1036 uint64_t pte; 1037 uint32_t page_offset; 1038 int page_size; 1039 1040 if (!(env->cr[0] & CR0_PG_MASK)) { 1041 pte = addr & env->a20_mask; 1042 page_size = 4096; 1043 } else if (env->cr[4] & CR4_PAE_MASK) { 1044 target_ulong pdpe_addr; 1045 uint64_t pde, pdpe; 1046 1047 #ifdef TARGET_X86_64 1048 if (env->hflags & HF_LMA_MASK) { 1049 bool la57 = env->cr[4] & CR4_LA57_MASK; 1050 uint64_t pml5e_addr, pml5e; 1051 uint64_t pml4e_addr, pml4e; 1052 int32_t sext; 1053 1054 /* test virtual address sign extension */ 1055 sext = la57 ? (int64_t)addr >> 56 : (int64_t)addr >> 47; 1056 if (sext != 0 && sext != -1) { 1057 return -1; 1058 } 1059 1060 if (la57) { 1061 pml5e_addr = ((env->cr[3] & ~0xfff) + 1062 (((addr >> 48) & 0x1ff) << 3)) & env->a20_mask; 1063 pml5e = x86_ldq_phys(cs, pml5e_addr); 1064 if (!(pml5e & PG_PRESENT_MASK)) { 1065 return -1; 1066 } 1067 } else { 1068 pml5e = env->cr[3]; 1069 } 1070 1071 pml4e_addr = ((pml5e & PG_ADDRESS_MASK) + 1072 (((addr >> 39) & 0x1ff) << 3)) & env->a20_mask; 1073 pml4e = x86_ldq_phys(cs, pml4e_addr); 1074 if (!(pml4e & PG_PRESENT_MASK)) { 1075 return -1; 1076 } 1077 pdpe_addr = ((pml4e & PG_ADDRESS_MASK) + 1078 (((addr >> 30) & 0x1ff) << 3)) & env->a20_mask; 1079 pdpe = x86_ldq_phys(cs, pdpe_addr); 1080 if (!(pdpe & PG_PRESENT_MASK)) { 1081 return -1; 1082 } 1083 if (pdpe & PG_PSE_MASK) { 1084 page_size = 1024 * 1024 * 1024; 1085 pte = pdpe; 1086 goto out; 1087 } 1088 1089 } else 1090 #endif 1091 { 1092 pdpe_addr = ((env->cr[3] & ~0x1f) + ((addr >> 27) & 0x18)) & 1093 env->a20_mask; 1094 pdpe = x86_ldq_phys(cs, pdpe_addr); 1095 if (!(pdpe & PG_PRESENT_MASK)) 1096 return -1; 1097 } 1098 1099 pde_addr = ((pdpe & PG_ADDRESS_MASK) + 1100 (((addr >> 21) & 0x1ff) << 3)) & env->a20_mask; 1101 pde = x86_ldq_phys(cs, pde_addr); 1102 if (!(pde & PG_PRESENT_MASK)) { 1103 return -1; 1104 } 1105 if (pde & PG_PSE_MASK) { 1106 /* 2 MB page */ 1107 page_size = 2048 * 1024; 1108 pte = pde; 1109 } else { 1110 /* 4 KB page */ 1111 pte_addr = ((pde & PG_ADDRESS_MASK) + 1112 (((addr >> 12) & 0x1ff) << 3)) & env->a20_mask; 1113 page_size = 4096; 1114 pte = x86_ldq_phys(cs, pte_addr); 1115 } 1116 if (!(pte & PG_PRESENT_MASK)) { 1117 return -1; 1118 } 1119 } else { 1120 uint32_t pde; 1121 1122 /* page directory entry */ 1123 pde_addr = ((env->cr[3] & ~0xfff) + ((addr >> 20) & 0xffc)) & env->a20_mask; 1124 pde = x86_ldl_phys(cs, pde_addr); 1125 if (!(pde & PG_PRESENT_MASK)) 1126 return -1; 1127 if ((pde & PG_PSE_MASK) && (env->cr[4] & CR4_PSE_MASK)) { 1128 pte = pde | ((pde & 0x1fe000LL) << (32 - 13)); 1129 page_size = 4096 * 1024; 1130 } else { 1131 /* page directory entry */ 1132 pte_addr = ((pde & ~0xfff) + ((addr >> 10) & 0xffc)) & env->a20_mask; 1133 pte = x86_ldl_phys(cs, pte_addr); 1134 if (!(pte & PG_PRESENT_MASK)) { 1135 return -1; 1136 } 1137 page_size = 4096; 1138 } 1139 pte = pte & env->a20_mask; 1140 } 1141 1142 #ifdef TARGET_X86_64 1143 out: 1144 #endif 1145 pte &= PG_ADDRESS_MASK & ~(page_size - 1); 1146 page_offset = (addr & TARGET_PAGE_MASK) & (page_size - 1); 1147 return pte | page_offset; 1148 } 1149 1150 typedef struct MCEInjectionParams { 1151 Monitor *mon; 1152 int bank; 1153 uint64_t status; 1154 uint64_t mcg_status; 1155 uint64_t addr; 1156 uint64_t misc; 1157 int flags; 1158 } MCEInjectionParams; 1159 1160 static void do_inject_x86_mce(CPUState *cs, run_on_cpu_data data) 1161 { 1162 MCEInjectionParams *params = data.host_ptr; 1163 X86CPU *cpu = X86_CPU(cs); 1164 CPUX86State *cenv = &cpu->env; 1165 uint64_t *banks = cenv->mce_banks + 4 * params->bank; 1166 1167 cpu_synchronize_state(cs); 1168 1169 /* 1170 * If there is an MCE exception being processed, ignore this SRAO MCE 1171 * unless unconditional injection was requested. 1172 */ 1173 if (!(params->flags & MCE_INJECT_UNCOND_AO) 1174 && !(params->status & MCI_STATUS_AR) 1175 && (cenv->mcg_status & MCG_STATUS_MCIP)) { 1176 return; 1177 } 1178 1179 if (params->status & MCI_STATUS_UC) { 1180 /* 1181 * if MSR_MCG_CTL is not all 1s, the uncorrected error 1182 * reporting is disabled 1183 */ 1184 if ((cenv->mcg_cap & MCG_CTL_P) && cenv->mcg_ctl != ~(uint64_t)0) { 1185 monitor_printf(params->mon, 1186 "CPU %d: Uncorrected error reporting disabled\n", 1187 cs->cpu_index); 1188 return; 1189 } 1190 1191 /* 1192 * if MSR_MCi_CTL is not all 1s, the uncorrected error 1193 * reporting is disabled for the bank 1194 */ 1195 if (banks[0] != ~(uint64_t)0) { 1196 monitor_printf(params->mon, 1197 "CPU %d: Uncorrected error reporting disabled for" 1198 " bank %d\n", 1199 cs->cpu_index, params->bank); 1200 return; 1201 } 1202 1203 if ((cenv->mcg_status & MCG_STATUS_MCIP) || 1204 !(cenv->cr[4] & CR4_MCE_MASK)) { 1205 monitor_printf(params->mon, 1206 "CPU %d: Previous MCE still in progress, raising" 1207 " triple fault\n", 1208 cs->cpu_index); 1209 qemu_log_mask(CPU_LOG_RESET, "Triple fault\n"); 1210 qemu_system_reset_request(); 1211 return; 1212 } 1213 if (banks[1] & MCI_STATUS_VAL) { 1214 params->status |= MCI_STATUS_OVER; 1215 } 1216 banks[2] = params->addr; 1217 banks[3] = params->misc; 1218 cenv->mcg_status = params->mcg_status; 1219 banks[1] = params->status; 1220 cpu_interrupt(cs, CPU_INTERRUPT_MCE); 1221 } else if (!(banks[1] & MCI_STATUS_VAL) 1222 || !(banks[1] & MCI_STATUS_UC)) { 1223 if (banks[1] & MCI_STATUS_VAL) { 1224 params->status |= MCI_STATUS_OVER; 1225 } 1226 banks[2] = params->addr; 1227 banks[3] = params->misc; 1228 banks[1] = params->status; 1229 } else { 1230 banks[1] |= MCI_STATUS_OVER; 1231 } 1232 } 1233 1234 void cpu_x86_inject_mce(Monitor *mon, X86CPU *cpu, int bank, 1235 uint64_t status, uint64_t mcg_status, uint64_t addr, 1236 uint64_t misc, int flags) 1237 { 1238 CPUState *cs = CPU(cpu); 1239 CPUX86State *cenv = &cpu->env; 1240 MCEInjectionParams params = { 1241 .mon = mon, 1242 .bank = bank, 1243 .status = status, 1244 .mcg_status = mcg_status, 1245 .addr = addr, 1246 .misc = misc, 1247 .flags = flags, 1248 }; 1249 unsigned bank_num = cenv->mcg_cap & 0xff; 1250 1251 if (!cenv->mcg_cap) { 1252 monitor_printf(mon, "MCE injection not supported\n"); 1253 return; 1254 } 1255 if (bank >= bank_num) { 1256 monitor_printf(mon, "Invalid MCE bank number\n"); 1257 return; 1258 } 1259 if (!(status & MCI_STATUS_VAL)) { 1260 monitor_printf(mon, "Invalid MCE status code\n"); 1261 return; 1262 } 1263 if ((flags & MCE_INJECT_BROADCAST) 1264 && !cpu_x86_support_mca_broadcast(cenv)) { 1265 monitor_printf(mon, "Guest CPU does not support MCA broadcast\n"); 1266 return; 1267 } 1268 1269 run_on_cpu(cs, do_inject_x86_mce, RUN_ON_CPU_HOST_PTR(¶ms)); 1270 if (flags & MCE_INJECT_BROADCAST) { 1271 CPUState *other_cs; 1272 1273 params.bank = 1; 1274 params.status = MCI_STATUS_VAL | MCI_STATUS_UC; 1275 params.mcg_status = MCG_STATUS_MCIP | MCG_STATUS_RIPV; 1276 params.addr = 0; 1277 params.misc = 0; 1278 CPU_FOREACH(other_cs) { 1279 if (other_cs == cs) { 1280 continue; 1281 } 1282 run_on_cpu(other_cs, do_inject_x86_mce, RUN_ON_CPU_HOST_PTR(¶ms)); 1283 } 1284 } 1285 } 1286 1287 void cpu_report_tpr_access(CPUX86State *env, TPRAccess access) 1288 { 1289 X86CPU *cpu = x86_env_get_cpu(env); 1290 CPUState *cs = CPU(cpu); 1291 1292 if (kvm_enabled()) { 1293 env->tpr_access_type = access; 1294 1295 cpu_interrupt(cs, CPU_INTERRUPT_TPR); 1296 } else { 1297 cpu_restore_state(cs, cs->mem_io_pc); 1298 1299 apic_handle_tpr_access_report(cpu->apic_state, env->eip, access); 1300 } 1301 } 1302 #endif /* !CONFIG_USER_ONLY */ 1303 1304 int cpu_x86_get_descr_debug(CPUX86State *env, unsigned int selector, 1305 target_ulong *base, unsigned int *limit, 1306 unsigned int *flags) 1307 { 1308 X86CPU *cpu = x86_env_get_cpu(env); 1309 CPUState *cs = CPU(cpu); 1310 SegmentCache *dt; 1311 target_ulong ptr; 1312 uint32_t e1, e2; 1313 int index; 1314 1315 if (selector & 0x4) 1316 dt = &env->ldt; 1317 else 1318 dt = &env->gdt; 1319 index = selector & ~7; 1320 ptr = dt->base + index; 1321 if ((index + 7) > dt->limit 1322 || cpu_memory_rw_debug(cs, ptr, (uint8_t *)&e1, sizeof(e1), 0) != 0 1323 || cpu_memory_rw_debug(cs, ptr+4, (uint8_t *)&e2, sizeof(e2), 0) != 0) 1324 return 0; 1325 1326 *base = ((e1 >> 16) | ((e2 & 0xff) << 16) | (e2 & 0xff000000)); 1327 *limit = (e1 & 0xffff) | (e2 & 0x000f0000); 1328 if (e2 & DESC_G_MASK) 1329 *limit = (*limit << 12) | 0xfff; 1330 *flags = e2; 1331 1332 return 1; 1333 } 1334 1335 #if !defined(CONFIG_USER_ONLY) 1336 void do_cpu_init(X86CPU *cpu) 1337 { 1338 CPUState *cs = CPU(cpu); 1339 CPUX86State *env = &cpu->env; 1340 CPUX86State *save = g_new(CPUX86State, 1); 1341 int sipi = cs->interrupt_request & CPU_INTERRUPT_SIPI; 1342 1343 *save = *env; 1344 1345 cpu_reset(cs); 1346 cs->interrupt_request = sipi; 1347 memcpy(&env->start_init_save, &save->start_init_save, 1348 offsetof(CPUX86State, end_init_save) - 1349 offsetof(CPUX86State, start_init_save)); 1350 g_free(save); 1351 1352 if (kvm_enabled()) { 1353 kvm_arch_do_init_vcpu(cpu); 1354 } 1355 apic_init_reset(cpu->apic_state); 1356 } 1357 1358 void do_cpu_sipi(X86CPU *cpu) 1359 { 1360 apic_sipi(cpu->apic_state); 1361 } 1362 #else 1363 void do_cpu_init(X86CPU *cpu) 1364 { 1365 } 1366 void do_cpu_sipi(X86CPU *cpu) 1367 { 1368 } 1369 #endif 1370 1371 /* Frob eflags into and out of the CPU temporary format. */ 1372 1373 void x86_cpu_exec_enter(CPUState *cs) 1374 { 1375 X86CPU *cpu = X86_CPU(cs); 1376 CPUX86State *env = &cpu->env; 1377 1378 CC_SRC = env->eflags & (CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C); 1379 env->df = 1 - (2 * ((env->eflags >> 10) & 1)); 1380 CC_OP = CC_OP_EFLAGS; 1381 env->eflags &= ~(DF_MASK | CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C); 1382 } 1383 1384 void x86_cpu_exec_exit(CPUState *cs) 1385 { 1386 X86CPU *cpu = X86_CPU(cs); 1387 CPUX86State *env = &cpu->env; 1388 1389 env->eflags = cpu_compute_eflags(env); 1390 } 1391 1392 #ifndef CONFIG_USER_ONLY 1393 uint8_t x86_ldub_phys(CPUState *cs, hwaddr addr) 1394 { 1395 X86CPU *cpu = X86_CPU(cs); 1396 CPUX86State *env = &cpu->env; 1397 1398 return address_space_ldub(cs->as, addr, 1399 cpu_get_mem_attrs(env), 1400 NULL); 1401 } 1402 1403 uint32_t x86_lduw_phys(CPUState *cs, hwaddr addr) 1404 { 1405 X86CPU *cpu = X86_CPU(cs); 1406 CPUX86State *env = &cpu->env; 1407 1408 return address_space_lduw(cs->as, addr, 1409 cpu_get_mem_attrs(env), 1410 NULL); 1411 } 1412 1413 uint32_t x86_ldl_phys(CPUState *cs, hwaddr addr) 1414 { 1415 X86CPU *cpu = X86_CPU(cs); 1416 CPUX86State *env = &cpu->env; 1417 1418 return address_space_ldl(cs->as, addr, 1419 cpu_get_mem_attrs(env), 1420 NULL); 1421 } 1422 1423 uint64_t x86_ldq_phys(CPUState *cs, hwaddr addr) 1424 { 1425 X86CPU *cpu = X86_CPU(cs); 1426 CPUX86State *env = &cpu->env; 1427 1428 return address_space_ldq(cs->as, addr, 1429 cpu_get_mem_attrs(env), 1430 NULL); 1431 } 1432 1433 void x86_stb_phys(CPUState *cs, hwaddr addr, uint8_t val) 1434 { 1435 X86CPU *cpu = X86_CPU(cs); 1436 CPUX86State *env = &cpu->env; 1437 1438 address_space_stb(cs->as, addr, val, 1439 cpu_get_mem_attrs(env), 1440 NULL); 1441 } 1442 1443 void x86_stl_phys_notdirty(CPUState *cs, hwaddr addr, uint32_t val) 1444 { 1445 X86CPU *cpu = X86_CPU(cs); 1446 CPUX86State *env = &cpu->env; 1447 1448 address_space_stl_notdirty(cs->as, addr, val, 1449 cpu_get_mem_attrs(env), 1450 NULL); 1451 } 1452 1453 void x86_stw_phys(CPUState *cs, hwaddr addr, uint32_t val) 1454 { 1455 X86CPU *cpu = X86_CPU(cs); 1456 CPUX86State *env = &cpu->env; 1457 1458 address_space_stw(cs->as, addr, val, 1459 cpu_get_mem_attrs(env), 1460 NULL); 1461 } 1462 1463 void x86_stl_phys(CPUState *cs, hwaddr addr, uint32_t val) 1464 { 1465 X86CPU *cpu = X86_CPU(cs); 1466 CPUX86State *env = &cpu->env; 1467 1468 address_space_stl(cs->as, addr, val, 1469 cpu_get_mem_attrs(env), 1470 NULL); 1471 } 1472 1473 void x86_stq_phys(CPUState *cs, hwaddr addr, uint64_t val) 1474 { 1475 X86CPU *cpu = X86_CPU(cs); 1476 CPUX86State *env = &cpu->env; 1477 1478 address_space_stq(cs->as, addr, val, 1479 cpu_get_mem_attrs(env), 1480 NULL); 1481 } 1482 #endif 1483