a2d57703b3
During a page table walk of TCG+SVM the code in target/i386/excp_helper.c get_hphys() uses the cr4 register of the guest instead of the hypervisor to check for the PSE bit. In the test case we have, the guest have not enabled (yet) the PSE bit and so the page table walk results in a wrong host physical address resolution and wrong content read by the guest. Attached patch is against 4.2.1, but works also on 3.1.0. It fixes the issue for our automated testcase, which is a 32bit hypervisor w/o PAE support running a guest VM with tcg+svm. The test worked beforehand up to qemu 2.12, started to fail with qemu 3.0 and later. The added TCG/SVM NPT commit seems to introduce the regression. In case someone want to try to reproduce it, the iso is at [0], the good case is [1] and the failing case is [2]. The used commandline is: qemu-system-i386 -no-kvm -nographic -cpu phenom -m 512 -machine q35 -cdrom seoul-vmm-test.iso [0] https://depot.genode.org/alex-ab/images/seoul-vmm-test.iso [1] https://depot.genode.org/alex-ab/images/seoul-vmm-good.txt [2] https://depot.genode.org/alex-ab/images/seoul-vmm-bad.txt Signed-off-by: Alexander Boettcher <alexander.boettcher@genode-labs.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
238 lines
6.1 KiB
C
238 lines
6.1 KiB
C
#ifndef SVM_H
|
|
#define SVM_H
|
|
|
|
#define TLB_CONTROL_DO_NOTHING 0
|
|
#define TLB_CONTROL_FLUSH_ALL_ASID 1
|
|
|
|
#define V_TPR_MASK 0x0f
|
|
|
|
#define V_IRQ_SHIFT 8
|
|
#define V_IRQ_MASK (1 << V_IRQ_SHIFT)
|
|
|
|
#define V_INTR_PRIO_SHIFT 16
|
|
#define V_INTR_PRIO_MASK (0x0f << V_INTR_PRIO_SHIFT)
|
|
|
|
#define V_IGN_TPR_SHIFT 20
|
|
#define V_IGN_TPR_MASK (1 << V_IGN_TPR_SHIFT)
|
|
|
|
#define V_INTR_MASKING_SHIFT 24
|
|
#define V_INTR_MASKING_MASK (1 << V_INTR_MASKING_SHIFT)
|
|
|
|
#define SVM_INTERRUPT_SHADOW_MASK 1
|
|
|
|
#define SVM_IOIO_STR_SHIFT 2
|
|
#define SVM_IOIO_REP_SHIFT 3
|
|
#define SVM_IOIO_SIZE_SHIFT 4
|
|
#define SVM_IOIO_ASIZE_SHIFT 7
|
|
|
|
#define SVM_IOIO_TYPE_MASK 1
|
|
#define SVM_IOIO_STR_MASK (1 << SVM_IOIO_STR_SHIFT)
|
|
#define SVM_IOIO_REP_MASK (1 << SVM_IOIO_REP_SHIFT)
|
|
#define SVM_IOIO_SIZE_MASK (7 << SVM_IOIO_SIZE_SHIFT)
|
|
#define SVM_IOIO_ASIZE_MASK (7 << SVM_IOIO_ASIZE_SHIFT)
|
|
|
|
#define SVM_EVTINJ_VEC_MASK 0xff
|
|
|
|
#define SVM_EVTINJ_TYPE_SHIFT 8
|
|
#define SVM_EVTINJ_TYPE_MASK (7 << SVM_EVTINJ_TYPE_SHIFT)
|
|
|
|
#define SVM_EVTINJ_TYPE_INTR (0 << SVM_EVTINJ_TYPE_SHIFT)
|
|
#define SVM_EVTINJ_TYPE_NMI (2 << SVM_EVTINJ_TYPE_SHIFT)
|
|
#define SVM_EVTINJ_TYPE_EXEPT (3 << SVM_EVTINJ_TYPE_SHIFT)
|
|
#define SVM_EVTINJ_TYPE_SOFT (4 << SVM_EVTINJ_TYPE_SHIFT)
|
|
|
|
#define SVM_EVTINJ_VALID (1 << 31)
|
|
#define SVM_EVTINJ_VALID_ERR (1 << 11)
|
|
|
|
#define SVM_EXITINTINFO_VEC_MASK SVM_EVTINJ_VEC_MASK
|
|
|
|
#define SVM_EXITINTINFO_TYPE_INTR SVM_EVTINJ_TYPE_INTR
|
|
#define SVM_EXITINTINFO_TYPE_NMI SVM_EVTINJ_TYPE_NMI
|
|
#define SVM_EXITINTINFO_TYPE_EXEPT SVM_EVTINJ_TYPE_EXEPT
|
|
#define SVM_EXITINTINFO_TYPE_SOFT SVM_EVTINJ_TYPE_SOFT
|
|
|
|
#define SVM_EXITINTINFO_VALID SVM_EVTINJ_VALID
|
|
#define SVM_EXITINTINFO_VALID_ERR SVM_EVTINJ_VALID_ERR
|
|
|
|
#define SVM_EXIT_READ_CR0 0x000
|
|
#define SVM_EXIT_READ_CR3 0x003
|
|
#define SVM_EXIT_READ_CR4 0x004
|
|
#define SVM_EXIT_READ_CR8 0x008
|
|
#define SVM_EXIT_WRITE_CR0 0x010
|
|
#define SVM_EXIT_WRITE_CR3 0x013
|
|
#define SVM_EXIT_WRITE_CR4 0x014
|
|
#define SVM_EXIT_WRITE_CR8 0x018
|
|
#define SVM_EXIT_READ_DR0 0x020
|
|
#define SVM_EXIT_READ_DR1 0x021
|
|
#define SVM_EXIT_READ_DR2 0x022
|
|
#define SVM_EXIT_READ_DR3 0x023
|
|
#define SVM_EXIT_READ_DR4 0x024
|
|
#define SVM_EXIT_READ_DR5 0x025
|
|
#define SVM_EXIT_READ_DR6 0x026
|
|
#define SVM_EXIT_READ_DR7 0x027
|
|
#define SVM_EXIT_WRITE_DR0 0x030
|
|
#define SVM_EXIT_WRITE_DR1 0x031
|
|
#define SVM_EXIT_WRITE_DR2 0x032
|
|
#define SVM_EXIT_WRITE_DR3 0x033
|
|
#define SVM_EXIT_WRITE_DR4 0x034
|
|
#define SVM_EXIT_WRITE_DR5 0x035
|
|
#define SVM_EXIT_WRITE_DR6 0x036
|
|
#define SVM_EXIT_WRITE_DR7 0x037
|
|
#define SVM_EXIT_EXCP_BASE 0x040
|
|
#define SVM_EXIT_INTR 0x060
|
|
#define SVM_EXIT_NMI 0x061
|
|
#define SVM_EXIT_SMI 0x062
|
|
#define SVM_EXIT_INIT 0x063
|
|
#define SVM_EXIT_VINTR 0x064
|
|
#define SVM_EXIT_CR0_SEL_WRITE 0x065
|
|
#define SVM_EXIT_IDTR_READ 0x066
|
|
#define SVM_EXIT_GDTR_READ 0x067
|
|
#define SVM_EXIT_LDTR_READ 0x068
|
|
#define SVM_EXIT_TR_READ 0x069
|
|
#define SVM_EXIT_IDTR_WRITE 0x06a
|
|
#define SVM_EXIT_GDTR_WRITE 0x06b
|
|
#define SVM_EXIT_LDTR_WRITE 0x06c
|
|
#define SVM_EXIT_TR_WRITE 0x06d
|
|
#define SVM_EXIT_RDTSC 0x06e
|
|
#define SVM_EXIT_RDPMC 0x06f
|
|
#define SVM_EXIT_PUSHF 0x070
|
|
#define SVM_EXIT_POPF 0x071
|
|
#define SVM_EXIT_CPUID 0x072
|
|
#define SVM_EXIT_RSM 0x073
|
|
#define SVM_EXIT_IRET 0x074
|
|
#define SVM_EXIT_SWINT 0x075
|
|
#define SVM_EXIT_INVD 0x076
|
|
#define SVM_EXIT_PAUSE 0x077
|
|
#define SVM_EXIT_HLT 0x078
|
|
#define SVM_EXIT_INVLPG 0x079
|
|
#define SVM_EXIT_INVLPGA 0x07a
|
|
#define SVM_EXIT_IOIO 0x07b
|
|
#define SVM_EXIT_MSR 0x07c
|
|
#define SVM_EXIT_TASK_SWITCH 0x07d
|
|
#define SVM_EXIT_FERR_FREEZE 0x07e
|
|
#define SVM_EXIT_SHUTDOWN 0x07f
|
|
#define SVM_EXIT_VMRUN 0x080
|
|
#define SVM_EXIT_VMMCALL 0x081
|
|
#define SVM_EXIT_VMLOAD 0x082
|
|
#define SVM_EXIT_VMSAVE 0x083
|
|
#define SVM_EXIT_STGI 0x084
|
|
#define SVM_EXIT_CLGI 0x085
|
|
#define SVM_EXIT_SKINIT 0x086
|
|
#define SVM_EXIT_RDTSCP 0x087
|
|
#define SVM_EXIT_ICEBP 0x088
|
|
#define SVM_EXIT_WBINVD 0x089
|
|
/* only included in documentation, maybe wrong */
|
|
#define SVM_EXIT_MONITOR 0x08a
|
|
#define SVM_EXIT_MWAIT 0x08b
|
|
#define SVM_EXIT_NPF 0x400
|
|
|
|
#define SVM_EXIT_ERR -1
|
|
|
|
#define SVM_CR0_SELECTIVE_MASK (1 << 3 | 1) /* TS and MP */
|
|
|
|
#define SVM_NPT_ENABLED (1 << 0)
|
|
|
|
#define SVM_NPT_PAE (1 << 0)
|
|
#define SVM_NPT_LMA (1 << 1)
|
|
#define SVM_NPT_NXE (1 << 2)
|
|
#define SVM_NPT_PSE (1 << 3)
|
|
|
|
#define SVM_NPTEXIT_P (1ULL << 0)
|
|
#define SVM_NPTEXIT_RW (1ULL << 1)
|
|
#define SVM_NPTEXIT_US (1ULL << 2)
|
|
#define SVM_NPTEXIT_RSVD (1ULL << 3)
|
|
#define SVM_NPTEXIT_ID (1ULL << 4)
|
|
#define SVM_NPTEXIT_GPA (1ULL << 32)
|
|
#define SVM_NPTEXIT_GPT (1ULL << 33)
|
|
|
|
struct QEMU_PACKED vmcb_control_area {
|
|
uint16_t intercept_cr_read;
|
|
uint16_t intercept_cr_write;
|
|
uint16_t intercept_dr_read;
|
|
uint16_t intercept_dr_write;
|
|
uint32_t intercept_exceptions;
|
|
uint64_t intercept;
|
|
uint8_t reserved_1[44];
|
|
uint64_t iopm_base_pa;
|
|
uint64_t msrpm_base_pa;
|
|
uint64_t tsc_offset;
|
|
uint32_t asid;
|
|
uint8_t tlb_ctl;
|
|
uint8_t reserved_2[3];
|
|
uint32_t int_ctl;
|
|
uint32_t int_vector;
|
|
uint32_t int_state;
|
|
uint8_t reserved_3[4];
|
|
uint64_t exit_code;
|
|
uint64_t exit_info_1;
|
|
uint64_t exit_info_2;
|
|
uint32_t exit_int_info;
|
|
uint32_t exit_int_info_err;
|
|
uint64_t nested_ctl;
|
|
uint8_t reserved_4[16];
|
|
uint32_t event_inj;
|
|
uint32_t event_inj_err;
|
|
uint64_t nested_cr3;
|
|
uint64_t lbr_ctl;
|
|
uint8_t reserved_5[832];
|
|
};
|
|
|
|
struct QEMU_PACKED vmcb_seg {
|
|
uint16_t selector;
|
|
uint16_t attrib;
|
|
uint32_t limit;
|
|
uint64_t base;
|
|
};
|
|
|
|
struct QEMU_PACKED vmcb_save_area {
|
|
struct vmcb_seg es;
|
|
struct vmcb_seg cs;
|
|
struct vmcb_seg ss;
|
|
struct vmcb_seg ds;
|
|
struct vmcb_seg fs;
|
|
struct vmcb_seg gs;
|
|
struct vmcb_seg gdtr;
|
|
struct vmcb_seg ldtr;
|
|
struct vmcb_seg idtr;
|
|
struct vmcb_seg tr;
|
|
uint8_t reserved_1[43];
|
|
uint8_t cpl;
|
|
uint8_t reserved_2[4];
|
|
uint64_t efer;
|
|
uint8_t reserved_3[112];
|
|
uint64_t cr4;
|
|
uint64_t cr3;
|
|
uint64_t cr0;
|
|
uint64_t dr7;
|
|
uint64_t dr6;
|
|
uint64_t rflags;
|
|
uint64_t rip;
|
|
uint8_t reserved_4[88];
|
|
uint64_t rsp;
|
|
uint8_t reserved_5[24];
|
|
uint64_t rax;
|
|
uint64_t star;
|
|
uint64_t lstar;
|
|
uint64_t cstar;
|
|
uint64_t sfmask;
|
|
uint64_t kernel_gs_base;
|
|
uint64_t sysenter_cs;
|
|
uint64_t sysenter_esp;
|
|
uint64_t sysenter_eip;
|
|
uint64_t cr2;
|
|
uint8_t reserved_6[32];
|
|
uint64_t g_pat;
|
|
uint64_t dbgctl;
|
|
uint64_t br_from;
|
|
uint64_t br_to;
|
|
uint64_t last_excp_from;
|
|
uint64_t last_excp_to;
|
|
};
|
|
|
|
struct QEMU_PACKED vmcb {
|
|
struct vmcb_control_area control;
|
|
struct vmcb_save_area save;
|
|
};
|
|
|
|
#endif
|