aboutsummaryrefslogtreecommitdiff
path: root/target/i386/translate.c
AgeCommit message (Collapse)AuthorFilesLines
2019-05-22target/i386: Implement CPUID_EXT_RDRANDRichard Henderson1-15/+47
We now have an interface for guest visible random numbers. Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2019-04-24tcg: Hoist max_insns computation to tb_gen_codeRichard Henderson1-2/+2
In order to handle TB's that translate to too much code, we need to place the control of the length of the translation in the hands of the code gen master loop. Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2019-04-09target/i386: Generate #UD for LOCK on a register incrementPeter Maydell1-0/+5
Fix a TCG crash due to attempting an atomic increment operation without having set up the address first. This is a similar case to that dealt with in commit e84fcd7f662a0d8198703, and we fix it in the same way. Fixes: https://bugs.launchpad.net/qemu/+bug/1807675 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 20190328104750.25046-1-peter.maydell@linaro.org
2019-01-11avoid TABs in files that only contain a fewPaolo Bonzini1-6/+6
Most files that have TABs only contain a handful of them. Change them to spaces so that we don't confuse people. disas, standard-headers, linux-headers and libdecnumber are imported from other projects and probably should be exempted from the check. Outside those, after this patch the following files still contain both 8-space and TAB sequences at the beginning of the line. Many of them have a majority of TABs, or were initially committed with all tabs. bsd-user/i386/target_syscall.h bsd-user/x86_64/target_syscall.h crypto/aes.c hw/audio/fmopl.c hw/audio/fmopl.h hw/block/tc58128.c hw/display/cirrus_vga.c hw/display/xenfb.c hw/dma/etraxfs_dma.c hw/intc/sh_intc.c hw/misc/mst_fpga.c hw/net/pcnet.c hw/sh4/sh7750.c hw/timer/m48t59.c hw/timer/sh_timer.c include/crypto/aes.h include/disas/bfd.h include/hw/sh4/sh.h libdecnumber/decNumber.c linux-headers/asm-generic/unistd.h linux-headers/linux/kvm.h linux-user/alpha/target_syscall.h linux-user/arm/nwfpe/double_cpdo.c linux-user/arm/nwfpe/fpa11_cpdt.c linux-user/arm/nwfpe/fpa11_cprt.c linux-user/arm/nwfpe/fpa11.h linux-user/flat.h linux-user/flatload.c linux-user/i386/target_syscall.h linux-user/ppc/target_syscall.h linux-user/sparc/target_syscall.h linux-user/syscall.c linux-user/syscall_defs.h linux-user/x86_64/target_syscall.h slirp/cksum.c slirp/if.c slirp/ip.h slirp/ip_icmp.c slirp/ip_icmp.h slirp/ip_input.c slirp/ip_output.c slirp/mbuf.c slirp/misc.c slirp/sbuf.c slirp/socket.c slirp/socket.h slirp/tcp_input.c slirp/tcpip.h slirp/tcp_output.c slirp/tcp_subr.c slirp/tcp_timer.c slirp/tftp.c slirp/udp.c slirp/udp.h target/cris/cpu.h target/cris/mmu.c target/cris/op_helper.c target/sh4/helper.c target/sh4/op_helper.c target/sh4/translate.c tcg/sparc/tcg-target.inc.c tests/tcg/cris/check_addo.c tests/tcg/cris/check_moveq.c tests/tcg/cris/check_swap.c tests/tcg/multiarch/test-mmap.c ui/vnc-enc-hextile-template.h ui/vnc-enc-zywrle.h util/envlist.c util/readline.c The following have only TABs: bsd-user/i386/target_signal.h bsd-user/sparc64/target_signal.h bsd-user/sparc64/target_syscall.h bsd-user/sparc/target_signal.h bsd-user/sparc/target_syscall.h bsd-user/x86_64/target_signal.h crypto/desrfb.c hw/audio/intel-hda-defs.h hw/core/uboot_image.h hw/sh4/sh7750_regnames.c hw/sh4/sh7750_regs.h include/hw/cris/etraxfs_dma.h linux-user/alpha/termbits.h linux-user/arm/nwfpe/fpopcode.h linux-user/arm/nwfpe/fpsr.h linux-user/arm/syscall_nr.h linux-user/arm/target_signal.h linux-user/cris/target_signal.h linux-user/i386/target_signal.h linux-user/linux_loop.h linux-user/m68k/target_signal.h linux-user/microblaze/target_signal.h linux-user/mips64/target_signal.h linux-user/mips/target_signal.h linux-user/mips/target_syscall.h linux-user/mips/termbits.h linux-user/ppc/target_signal.h linux-user/sh4/target_signal.h linux-user/sh4/termbits.h linux-user/sparc64/target_syscall.h linux-user/sparc/target_signal.h linux-user/x86_64/target_signal.h linux-user/x86_64/termbits.h pc-bios/optionrom/optionrom.h slirp/mbuf.h slirp/misc.h slirp/sbuf.h slirp/tcp.h slirp/tcp_timer.h slirp/tcp_var.h target/i386/svm.h target/sparc/asi.h target/xtensa/core-dc232b/xtensa-modules.inc.c target/xtensa/core-dc233c/xtensa-modules.inc.c target/xtensa/core-de212/core-isa.h target/xtensa/core-de212/xtensa-modules.inc.c target/xtensa/core-fsf/xtensa-modules.inc.c target/xtensa/core-sample_controller/core-isa.h target/xtensa/core-sample_controller/xtensa-modules.inc.c target/xtensa/core-test_kc705_be/core-isa.h target/xtensa/core-test_kc705_be/xtensa-modules.inc.c tests/tcg/cris/check_abs.c tests/tcg/cris/check_addc.c tests/tcg/cris/check_addcm.c tests/tcg/cris/check_addoq.c tests/tcg/cris/check_bound.c tests/tcg/cris/check_ftag.c tests/tcg/cris/check_int64.c tests/tcg/cris/check_lz.c tests/tcg/cris/check_openpf5.c tests/tcg/cris/check_sigalrm.c tests/tcg/cris/crisutils.h tests/tcg/cris/sys.c tests/tcg/i386/test-i386-ssse3.c ui/vgafont.h Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20181213223737.11793-3-pbonzini@redhat.com> Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com> Acked-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Eric Blake <eblake@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Stefan Markovic <smarkovic@wavecomp.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27target/i386: Generate #UD when applying LOCK to a register destinationRichard Henderson1-15/+20
Fixes a TCG crash due to attempting the atomic operation without having set up the address first. This does not attempt to fix all of the other missing checks for LOCK. Fixes: a7cee522f35 Fixes: https://bugs.launchpad.net/qemu/+bug/1803160 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20181113193510.24862-1-richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-10-30target/i386: Remove #ifdeffed-out icebp debugging hackPeter Maydell1-6/+0
Remove a debugging hack which could be used to cause the undocumented 'icebp' instruction to enable QEMU internal debug logging. This code has always been #ifdeffed out since it was introduced in commit aba9d61e34b9 in 2005; judging by the rest of that commit (which is entirely unrelated) it may have even been committed by accident. (Note that WANT_ICEBP is not defined by default anyway.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20181009183314.13416-1-peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-10-02target/i386: fix translation for icount modePavel Dovgalyuk1-3/+3
This patch fixes the checking of boundary crossing instructions. In icount mode only first instruction of the block may cross the page boundary to keep the translation deterministic. These conditions already existed, but compared the wrong variable. Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru> Message-Id: <20180920071702.22477.43980.stgit@pasha-VirtualBox> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-10-02target/i386: rename HF_SVMI_MASK to HF_GUEST_MASKPaolo Bonzini1-2/+2
This flag will be used for KVM's nested VMX migration; the HF_GUEST_MASK name is already used in KVM, adopt it in QEMU as well. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-10-02target/i386: move x86_64_hregs to DisasContextEmilio G. Cota1-153/+154
And convert it to a bool to use an existing hole in the struct. Signed-off-by: Emilio G. Cota <cota@braap.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-10-02target/i386: move cpu_tmp1_i64 to DisasContextEmilio G. Cota1-80/+80
Signed-off-by: Emilio G. Cota <cota@braap.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-10-02target/i386: move cpu_tmp3_i32 to DisasContextEmilio G. Cota1-32/+32
Signed-off-by: Emilio G. Cota <cota@braap.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-10-02target/i386: move cpu_tmp2_i32 to DisasContextEmilio G. Cota1-173/+174
Signed-off-by: Emilio G. Cota <cota@braap.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-10-02target/i386: move cpu_ptr1 to DisasContextEmilio G. Cota1-26/+26
Signed-off-by: Emilio G. Cota <cota@braap.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-10-02target/i386: move cpu_ptr0 to DisasContextEmilio G. Cota1-49/+52
Signed-off-by: Emilio G. Cota <cota@braap.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-10-02target/i386: move cpu_tmp4 to DisasContextEmilio G. Cota1-39/+39
Signed-off-by: Emilio G. Cota <cota@braap.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-10-02target/i386: move cpu_tmp0 to DisasContextEmilio G. Cota1-138/+144
Signed-off-by: Emilio G. Cota <cota@braap.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-10-02target/i386: move cpu_T1 to DisasContextEmilio G. Cota1-171/+170
Signed-off-by: Emilio G. Cota <cota@braap.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-10-02target/i386: move cpu_T0 to DisasContextEmilio G. Cota1-580/+594
Signed-off-by: Emilio G. Cota <cota@braap.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-10-02target/i386: move cpu_A0 to DisasContextEmilio G. Cota1-236/+236
Signed-off-by: Emilio G. Cota <cota@braap.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-10-02target/i386: move cpu_cc_srcT to DisasContextEmilio G. Cota1-14/+18
Signed-off-by: Emilio G. Cota <cota@braap.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-08-23fix "Missing break in switch" coverity reportsPaolo Bonzini1-0/+2
Many of these are marked as "intentional/fix required" because they just need adding a fall through comment. This is exactly what this patch does, except for target/mips/translate.c where it is easier to duplicate the code, and hw/audio/sb16.c where I consulted the DOSBox sources and decide to just remove the LOG_UNIMP before the fallthrough. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-06-28target-i386: Allow interrupt injection after STGIJan Kiszka1-1/+2
We need to terminate the translation block after STGI so that pending interrupts can be injected. This fixes pending NMI injection for Jailhouse which uses "stgi; clgi" to open a brief injection window. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Message-Id: <37939b244dda0e9cccf96ce50f2b15df1e48315d.1522769774.git.jan.kiszka@web.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-06-28target/i386: Fix BLSR and BLSIRichard Henderson1-17/+9
The implementation of these two instructions was swapped. At the same time, unify the setup of eflags for the insn group. Reported-by: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com> Signed-off-by: Richard Henderson <rth@twiddle.net> Message-Id: <20170712192902.15493-1-rth@twiddle.net> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-06-01tcg: Pass tb and index to tcg_gen_exit_tb separatelyRichard Henderson1-4/+4
Do the cast to uintptr_t within the helper, so that the compiler can type check the pointer argument. We can also do some more sanity checking of the index argument. Reviewed-by: Laurent Vivier <laurent@vivier.eu> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2018-05-20tcg: fix s/compliment/complement/ typosEmilio G. Cota1-1/+1
Signed-off-by: Emilio G. Cota <cota@braap.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2018-05-09translator: merge max_insns into DisasContextBaseEmilio G. Cota1-4/+1
While at it, use int for both num_insns and max_insns to make sure we have same-type comparisons. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Michael Clark <mjc@sifive.com> Signed-off-by: Emilio G. Cota <cota@braap.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2018-04-09Add missing bit for SSE instr in VEX decodingEugene Minibaev1-1/+3
The 2-byte VEX prefix imples a leading 0Fh opcode byte. Signed-off-by: Eugene Minibaev <mail@kitsu.me> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-04-05target/i386: Fix andn instructionAlexandro Sanchez Bach1-1/+1
In commit 7073fbada733c8d10992f00772c9b9299d740e9b, the `andn` instruction was implemented via `tcg_gen_andc` but passes the operands in the wrong order: - X86 defines `andn dest,src1,src2` as: dest = ~src1 & src2 - TCG defines `andc dest,src1,src2` as: dest = src1 & ~src2 The following simple test shows the issue: #include <stdio.h> #include <stdint.h> int main(void) { uint32_t ret = 0; __asm ( "mov $0xFF00, %%ecx\n" "mov $0x0F0F, %%eax\n" "andn %%ecx, %%eax, %%ecx\n" "mov %%ecx, %0\n" : "=r" (ret)); printf("%08X\n", ret); return 0; } This patch fixes the problem by simply swapping the order of the two last arguments in `tcg_gen_andc_tl`. Reported-by: Alexandro Sanchez Bach <alexandro@phi.nz> Signed-off-by: Alexandro Sanchez Bach <alexandro@phi.nz> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-12-29tcg: Remove TCGV_UNUSED* and TCGV_IS_UNUSED*Richard Henderson1-7/+6
These are now trivial sets and tests against NULL. Unwrap. Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2017-12-21target/i386: Fix handling of VEX prefixesPeter Maydell1-1/+1
In commit e3af7c788b73a6495eb9d94992ef11f6ad6f3c56 we replaced direct calls to to cpu_ld*_code() with calls to the x86_ld*_code() wrappers which incorporate an advance of s->pc. Unfortunately we didn't notice that in one place the old code was deliberately not incrementing s->pc: @@ -4501,7 +4528,7 @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu) static const int pp_prefix[4] = { 0, PREFIX_DATA, PREFIX_REPZ, PREFIX_REPNZ }; - int vex3, vex2 = cpu_ldub_code(env, s->pc); + int vex3, vex2 = x86_ldub_code(env, s); if (!CODE64(s) && (vex2 & 0xc0) != 0xc0) { /* 4.1.4.6: In 32-bit mode, bits [7:6] must be 11b, This meant we were mishandling this set of instructions. Remove the manual advance of s->pc for the "is VEX" case (which is now done by x86_ldub_code()) and instead rewind PC in the case where we decide that this isn't really VEX. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-stable@nongnu.org Reported-by: Alexandro Sanchez Bach <alexandro@phi.nz> Message-Id: <1513163959-17545-1-git-send-email-peter.maydell@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-12-21target/i386: Fix compiler warningsStefan Weil1-3/+4
These gcc warnings are fixed: target/i386/translate.c:4461:12: warning: variable 'prefixes' might be clobbered by 'longjmp' or 'vfork' [-Wclobbered] target/i386/translate.c:4466:9: warning: variable 'rex_w' might be clobbered by 'longjmp' or 'vfork' [-Wclobbered] target/i386/translate.c:4466:16: warning: variable 'rex_r' might be clobbered by 'longjmp' or 'vfork' [-Wclobbered] Tested with x86_64-w64-mingw32-gcc from Debian stretch. Signed-off-by: Stefan Weil <sw@weilnetz.de> Message-Id: <20171113064845.29142-1-sw@weilnetz.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-10-27Merge remote-tracking branch 'remotes/rth/tags/pull-dis-20171026' into stagingPeter Maydell1-7/+1
Capstone disassembler # gpg: Signature made Thu 26 Oct 2017 10:57:27 BST # gpg: using RSA key 0x64DF38E8AF7E215F # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" # Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A 05C0 64DF 38E8 AF7E 215F * remotes/rth/tags/pull-dis-20171026: disas: Add capstone as submodule disas: Remove monitor_disas_is_physical ppc: Support Capstone in disas_set_info arm: Support Capstone in disas_set_info i386: Support Capstone in disas_set_info disas: Support the Capstone disassembler library disas: Remove unused flags arguments target/arm: Don't set INSN_ARM_BE32 for CONFIG_USER_ONLY target/arm: Move BE32 disassembler fixup target/ppc: Convert to disas_set_info hook target/i386: Convert to disas_set_info hook Signed-off-by: Peter Maydell <peter.maydell@linaro.org> # Conflicts: # target/i386/cpu.c # target/ppc/translate_init.c
2017-10-25disas: Remove unused flags argumentsRichard Henderson1-1/+1
Now that every target is using the disas_set_info hook, the flags argument is unused. Remove it. Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2017-10-25target/i386: Convert to disas_set_info hookRichard Henderson1-7/+1
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2017-10-24tcg: Initialize cpu_env genericallyRichard Henderson1-3/+0
This is identical for each target. So, move the initialization to common code. Move the variable itself out of tcg_ctx and name it cpu_env to minimize changes within targets. This also means we can remove tcg_global_reg_new_{ptr,i32,i64}, since there are no longer global-register temps created by targets. Reviewed-by: Emilio G. Cota <cota@braap.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2017-10-24tcg: define tcg_init_ctx and make tcg_ctx a pointerEmilio G. Cota1-1/+1
Groundwork for supporting multiple TCG contexts. The core of this patch is this change to tcg/tcg.h: > -extern TCGContext tcg_ctx; > +extern TCGContext tcg_init_ctx; > +extern TCGContext *tcg_ctx; Note that for now we set *tcg_ctx to whatever TCGContext is passed to tcg_context_init -- in this case &tcg_init_ctx. Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Emilio G. Cota <cota@braap.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2017-10-24target/i386: check CF_PARALLEL instead of parallel_cpusEmilio G. Cota1-2/+2
Thereby decoupling the resulting translated code from the current state of the system. Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Emilio G. Cota <cota@braap.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2017-10-24tcg: convert tb->cflags reads to tb_cflags(tb)Emilio G. Cota1-24/+24
Convert all existing readers of tb->cflags to tb_cflags, so that we use atomic_read and therefore avoid undefined behaviour in C11. Note that the remaining setters/getters of the field are protected by tb_lock, and therefore do not need conversion. Luckily all readers access the field via 'tb->cflags' (so no foo.cflags, bar->cflags in the code base), which makes the conversion easily scriptable: FILES=$(git grep 'tb->cflags' target include/exec/gen-icount.h \ accel/tcg/translator.c | cut -f1 -d':' | sort | uniq) perl -pi -e 's/([^.>])tb->cflags/$1tb_cflags(tb)/g' $FILES perl -pi -e 's/([a-z->.]*)(->|\.)tb->cflags/tb_cflags($1$2tb)/g' $FILES Then manually fixed the few errors that checkpatch reported. Compile-tested for all targets. Suggested-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Emilio G. Cota <cota@braap.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2017-10-24qom: Introduce CPUClass.tcg_initializeRichard Henderson1-6/+0
Move target cpu tcg initialization to common code, called from cpu_exec_realizefn. Acked-by: Andreas Färber <afaerber@suse.de> Reviewed-by: Emilio G. Cota <cota@braap.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2017-10-24tcg: Remove TCGV_EQUAL*Richard Henderson1-3/+3
When we used structures for TCGv_*, we needed a macro in order to perform a comparison. Now that we use pointers, this is just clutter. Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Emilio G. Cota <cota@braap.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2017-10-16target/i386: trap on instructions longer than >15 bytesPaolo Bonzini1-7/+22
Besides being more correct, arbitrarily long instruction allow the generation of a translation block that spans three pages. This confuses the generator and even allows ring 3 code to poison the translation block cache and inject code into other processes that are in guest ring 3. This is an improved (and more invasive) fix for commit 30663fd ("tcg/i386: Check the size of instruction being translated", 2017-03-24). In addition to being more precise (and generating the right exception, which is #GP rather than #UD), it distinguishes better between page faults and too long instructions, as shown by this test case: #include <sys/mman.h> #include <string.h> #include <stdio.h> int main() { char *x = mmap(NULL, 8192, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANON, -1, 0); memset(x, 0x66, 4096); x[4096] = 0x90; x[4097] = 0xc3; char *i = x + 4096 - 15; mprotect(x + 4096, 4096, PROT_READ|PROT_WRITE); ((void(*)(void)) i) (); } ... which produces a #GP without the mprotect, and a #PF with it. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-10-16target/i386: introduce x86_ld*_codePaolo Bonzini1-103/+125
These take care of advancing s->pc, and will provide a unified point where to check for the 15-byte instruction length limit. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-10-10tcg: remove addr argument from lookup_tb_ptrEmilio G. Cota1-12/+5
It is unlikely that we will ever want to call this helper passing an argument other than the current PC. So just remove the argument, and use the pc we already get from cpu_get_tb_cpu_state. This change paves the way to having a common "tb_lookup" function. Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Emilio G. Cota <cota@braap.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2017-10-09x86: Correct translation of some rdgsbase and wrgsbase encodingsTodd Eisenberger1-2/+2
It looks like there was a transcription error when writing this code initially. The code previously only decoded src or dst of rax. This resolves https://bugs.launchpad.net/qemu/+bug/1719984. Signed-off-by: Todd Eisenberger <teisenbe@google.com> Message-Id: <CAP26EVRNVb=Mq=O3s51w7fDhGVmf-e3XFFA73MRzc5b4qKBA4g@mail.gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2017-09-19target/i386: set rip_offset for further SSE instructionsJoseph Myers1-1/+2
It turns out that my recent fix to set rip_offset when emulating some SSE4.1 instructions needs generalizing to cover a wider class of instructions. Specifically, every instruction in the sse_op_table7 table, coming from various instruction set extensions, has an 8-bit immediate operand that comes after any memory operand, and so needs rip_offset set for correctness if there is a memory operand that is rip-relative, and my patch only set it for a subset of those instructions. This patch moves the rip_offset setting to cover the wider class of instructions, so fixing 9 further gcc testsuite failures in my GCC 6-based testing. (I do not know whether there might be still further classes of instructions missing this setting.) Signed-off-by: Joseph Myers <joseph@codesourcery.com> Message-Id: <alpine.DEB.2.20.1708082350340.23380@digraph.polyomino.org.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-09-06target/i386: [tcg] Port to generic translation frameworkLluís Vilanova1-87/+19
Signed-off-by: Lluís Vilanova <vilanova@ac.upc.edu> Reviewed-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Emilio G. Cota <cota@braap.org> Tested-by: Emilio G. Cota <cota@braap.org> Message-Id: <150002267714.22386.5095442346868988808.stgit@frigg.lan> Signed-off-by: Richard Henderson <rth@twiddle.net>
2017-09-06target/i386: [tcg] Port to disas_logLluís Vilanova1-13/+19
Incrementally paves the way towards using the generic instruction translation loop. Signed-off-by: Lluís Vilanova <vilanova@ac.upc.edu> Reviewed-by: Emilio G. Cota <cota@braap.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Message-Id: <150002243497.22386.8888053391875656102.stgit@frigg.lan> [rth: Move tb->size computation and use that result.] Signed-off-by: Richard Henderson <rth@twiddle.net>
2017-09-06target/i386: [tcg] Port to tb_stopLluís Vilanova1-12/+14
Incrementally paves the way towards using the generic instruction translation loop. Signed-off-by: Lluís Vilanova <vilanova@ac.upc.edu> Reviewed-by: Emilio G. Cota <cota@braap.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Message-Id: <150002219289.22386.17959138704858928730.stgit@frigg.lan> Signed-off-by: Richard Henderson <rth@twiddle.net>
2017-09-06target/i386: [tcg] Port to translate_insnLluís Vilanova1-24/+42
Incrementally paves the way towards using the generic instruction translation loop. Signed-off-by: Lluís Vilanova <vilanova@ac.upc.edu> Reviewed-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Emilio G. Cota <cota@braap.org> Message-Id: <150002195074.22386.16195894320027075398.stgit@frigg.lan> Signed-off-by: Richard Henderson <rth@twiddle.net>
2017-09-06target/i386: [tcg] Port to breakpoint_checkLluís Vilanova1-12/+34
Incrementally paves the way towards using the generic instruction translation loop. Signed-off-by: Lluís Vilanova <vilanova@ac.upc.edu> Reviewed-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Emilio G. Cota <cota@braap.org> Message-Id: <150002170871.22386.2172835658104140576.stgit@frigg.lan> Signed-off-by: Richard Henderson <rth@twiddle.net>
generated by cgit v1.1 at 2025-01-04 10:38:11 +0000