diff options
| author | Roman Bolshakov <r.bolshakov@yadro.com> | 2020-06-30 13:28:16 +0300 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2020-07-10 18:02:18 -0400 |
| commit | b8d864f64341eb5825aed28aa9a6d1c98316b3e9 (patch) | |
| tree | 996e2b075d3239308d6e50f3befaacfe2caa5ab4 /target/i386/hvf | |
| parent | 6553aa1d1166b4257f1294b898fc9f09e7276639 (diff) | |
| download | qemu-b8d864f64341eb5825aed28aa9a6d1c98316b3e9.zip qemu-b8d864f64341eb5825aed28aa9a6d1c98316b3e9.tar.gz qemu-b8d864f64341eb5825aed28aa9a6d1c98316b3e9.tar.bz2 | |
i386: hvf: Set env->eip in macvm_set_rip()
cpu_synchronize_state() is currently no-op for hvf but BIOS will hang in
vAPIC option ROM when cpu_synchronize_state() is wired to
hvf_cpu_synchronize_state().
cpu_synchronize_state() state is called from vapic_write() during option
ROM initialization. It sets dirty flag on the cpu. macvm_set_rip() is
then invoked to advance IP after the I/O write to vAPIC port.
macvm_set_rip() only modifies VMCS, it doesn't change env->eip.
Therefore on the next iteration of vCPU loop, vcpu_dirty flag is checked
and hvf_put_registers() overwrites correct RIP in VMCS with the value of
env->eip that points to the I/O write instruction. Execution of the CPU
gets stuck on the instruction.
The issue can be avoided if eip doesn't contain stale value when dirty
flag is set on cpu.
Cc: Cameron Esfahani <dirty@apple.com>
Signed-off-by: Roman Bolshakov <r.bolshakov@yadro.com>
Message-Id: <20200630102824.77604-2-r.bolshakov@yadro.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'target/i386/hvf')
| -rw-r--r-- | target/i386/hvf/vmx.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/target/i386/hvf/vmx.h b/target/i386/hvf/vmx.h index ce2a153..1e8b29b 100644 --- a/target/i386/hvf/vmx.h +++ b/target/i386/hvf/vmx.h @@ -173,6 +173,7 @@ static inline void macvm_set_rip(CPUState *cpu, uint64_t rip) /* BUG, should take considering overlap.. */ wreg(cpu->hvf_fd, HV_X86_RIP, rip); + env->eip = rip; /* after moving forward in rip, we need to clean INTERRUPTABILITY */ val = rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY); |