diff options
| -rw-r--r-- | accel/tcg/cpu-exec.c | 22 | ||||
| -rw-r--r-- | target/i386/tcg/misc_helper.c | 22 | ||||
| -rw-r--r-- | target/i386/tcg/seg_helper.c | 52 | ||||
| -rw-r--r-- | target/i386/tcg/sysemu/misc_helper.c | 11 | ||||
| -rw-r--r-- | target/i386/tcg/sysemu/seg_helper.c | 1 | ||||
| -rw-r--r-- | target/i386/tcg/translate.c | 69 |
6 files changed, 25 insertions, 152 deletions
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c index adfe45153f..5f3eba038d 100644 --- a/accel/tcg/cpu-exec.c +++ b/accel/tcg/cpu-exec.c @@ -343,9 +343,7 @@ const void *HELPER(lookup_tb_ptr)(CPUArchState *env) * TCG is not considered a security-sensitive part of QEMU so this does not * affect the impact of CFI in environment with high security requirements */ -extern bool uiret_called; -// extern bool senduipi_called; -extern bool in_uiret_called; + static inline TranslationBlock * QEMU_DISABLE_CFI cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit) { @@ -1007,21 +1005,11 @@ int cpu_exec(CPUState *cpu) if (last_tb) { tb_add_jump(last_tb, tb_exit, tb); } - // if (block_id > 10000)qemu_log("BLOCK: %d size:%d icont:%d \n", block_id,tb->size,tb->icount); - // block_id ++; - if (in_uiret_called){ - qemu_log("xxxx in uiret called before exec tb;\n"); - in_uiret_called = false; - } + + cpu_loop_exec_tb(cpu, tb, &last_tb, &tb_exit); - if (in_uiret_called){ - qemu_log("xxxx in uiret called after exec tb;\n"); - in_uiret_called = false; - } - if (uiret_called) { - // helper_uiret(cpu->env_ptr); - uiret_called = false; - } + + /* Try to align the host and virtual clocks if the guest is in advance */ diff --git a/target/i386/tcg/misc_helper.c b/target/i386/tcg/misc_helper.c index 1e9167b40d..e4983fc6c3 100644 --- a/target/i386/tcg/misc_helper.c +++ b/target/i386/tcg/misc_helper.c @@ -80,12 +80,11 @@ void helper_rdtsc(CPUX86State *env) // ？？？ 读取时间相关的函数 #define UPID_ON 1 -static bool former = false; +// static bool former = false; static bool current = true; void helper_senduipi(CPUX86State *env ,int reg_index){ uint32_t uittsz = (uint32_t)env->uintr_misc; int uitte_index = env->regs[R_EAX]; - if(Debug)qemu_log("--------\nqemu:helper senduipi called receive regidx:%d, uipiindex: %d\n",reg_index,uitte_index); if (uitte_index > uittsz){ raise_exception_ra(env, EXCP0D_GPF, GETPC()); } @@ -97,13 +96,11 @@ void helper_senduipi(CPUX86State *env ,int reg_index){ uint64_t uitt_phyaddress = get_hphys2(cs, (env->uintr_tt>>3)<<3 , MMU_DATA_LOAD, &prot); struct uintr_uitt_entry uitte; cpu_physical_memory_rw(uitt_phyaddress + (uitte_index<<4), &uitte, 16,false); - if(Debug && former)qemu_log("qemu: data of uitt \n| valid:%d | user_vec:%d | UPID address 0x%016lx \n",uitte.valid, uitte.user_vec,uitte.target_upid_addr); // read tempUPID from 16 bytes at tempUITTE.UPIDADDR;// under lock uint64_t upid_phyaddress = get_hphys2(cs, uitte.target_upid_addr, MMU_DATA_LOAD, &prot); struct uintr_upid upid; cpu_physical_memory_rw(upid_phyaddress, &upid, 16, false); - if(Debug && former)qemu_log("qemu: content of upid:\n | status:0x%x | nv:0x%x | ndst:0x%x | 0x%016lx\n", upid.nc.status, upid.nc.nv, upid.nc.ndst, upid.puir); // tempUPID.PIR[tempUITTE.UV] := 1; upid.puir |= 1<<uitte.user_vec; @@ -119,22 +116,19 @@ void helper_senduipi(CPUX86State *env ,int reg_index){ //write tempUPID to 16 bytes at tempUITTE.UPIDADDR;// release lock cpu_physical_memory_rw(upid_phyaddress, &upid, 16, true); - if(Debug && former)qemu_log("qemu: data write back in upid:\n | status:0x%x | nv:0x%x | ndst:0x%x | puir 0x%016lx\n", upid.nc.status, upid.nc.nv, upid.nc.ndst, upid.puir); + if(Debug && current){ - qemu_log("the ndst is %d\n", upid.nc.ndst); - DeviceState *dev = cpu_get_current_apic(); - int id = get_apic_id(dev); - qemu_log("the apic id is %d\n", id); - qemu_log("sendnotify: %d\n", sendNotify); + // qemu_log("the ndst is %d\n", upid.nc.ndst); + // DeviceState *dev = cpu_get_current_apic(); + // int id = get_apic_id(dev); + // qemu_log("the apic id is %d\n", id); + // qemu_log("sendnotify: %d\n", sendNotify); } if(sendNotify){ - if(Debug && current){ - qemu_log("the ndst is %d\n", upid.nc.ndst); - } + } - if(Debug)qemu_log("---------\n\n"); } diff --git a/target/i386/tcg/seg_helper.c b/target/i386/tcg/seg_helper.c index 5351ed0825..0da29c356a 100644 --- a/target/i386/tcg/seg_helper.c +++ b/target/i386/tcg/seg_helper.c @@ -863,51 +863,40 @@ static inline target_ulong get_rsp_from_tss(CPUX86State *env, int level) -static bool Debug = true; -static bool former = false; +// static bool Debug = true; +// static bool former = false; void helper_rrnzero(CPUX86State *env){ // 改 - if(Debug)qemu_log("------\nrrnzero called handler: 0x%lx rr: 0x%lx\n", env->uintr_handler,env->uintr_rr); target_ulong temprsp = env->regs[R_ESP]; - qemu_log("origin |esp 0x%lx | eip 0x%lx | eflags: 0x%lx\n",env->regs[R_ESP], env->eip, env->eflags); if(env->uintr_stackadjust &1){ // adjust[0] = 1 env->regs[R_ESP] = env->uintr_stackadjust; - if(Debug && former)qemu_log("set statck 0x%lx\n",env->regs[R_ESP]); }else{ env->regs[R_ESP] -= env->uintr_stackadjust; - if(Debug && former)qemu_log("move statck 0x%lx\n",env->regs[R_ESP]); } env->regs[R_ESP] &= ~0xfLL; /* align stack */ target_ulong esp = env->regs[R_ESP]; - if(Debug && former)qemu_log("align statck 0x%lx\n",env->regs[R_ESP]); PUSHQ(esp, temprsp); PUSHQ(esp, env->eflags); // PUSHQ(esp, cpu_compute_eflags(env)); PUSHQ(esp, env->eip); - // qemu_log("the uirr is 0x%016lx \n", env->uintr_rr); PUSHQ(esp, env->uintr_rr & 0x3f); // // 64-bit push; upper 58 bits pushed as 0 - if(Debug && former)qemu_log("push finish now esp is: 0x%lx |",esp); env->uintr_rr = 0; // clear rr env->regs[R_ESP] = esp; env->eflags &= ~(TF_MASK | RF_MASK); env->eip = env->uintr_handler; env->uintr_uif = 0; - if(Debug && former)qemu_log("qemu: eip: 0x%lx\n",env->eip); - if(Debug)qemu_log("--------\n"); } bool in_uiret_called = false; bool recognized = false; void helper_uiret(CPUX86State *env){ - if(Debug)qemu_log("\n\n---------\nhelper uiret called,\neip: 0x%lx | sp: 0x%lx\n", env->eip,env->regs[R_ESP]); in_uiret_called = true; recognized = false; - target_ulong temprip, temprfalgs, temprsp, uirrv; + target_ulong temprip, temprfalgs, temprsp; // env->regs[R_ESP] &= ~0xfLL; /* align stack */ - target_ulong esp = env->regs[R_ESP] -8; - POPQ(esp, uirrv); + target_ulong esp = env->regs[R_ESP]; + // POPQ(esp, uirrv); POPQ(esp, temprip); POPQ(esp, temprfalgs); POPQ(esp, temprsp); - qemu_log("qemu:poped values:uirrv:0x%lx | rip:0x%lx | eflags:0x%lx | sp:0x%lx \n--------\n\n",uirrv,temprip, temprfalgs, temprsp); env->eip = temprip; env->regs[R_ESP] = temprsp; env->eflags = (env->eflags & ~0x254dd5) |(temprfalgs & 0x254dd5); @@ -944,7 +933,6 @@ static void do_interrupt64(CPUX86State *env, int intno, int is_int, } bool send = false; if(intno == UINTR_UINV ){ - qemu_log("recognize uintr\n"); recognized = true; if(env->uintr_uif == 0){ qemu_log("--uif not zero, return\n"); @@ -964,29 +952,13 @@ static void do_interrupt64(CPUX86State *env, int intno, int is_int, } cpu_physical_memory_rw(upid_phyaddress, &upid, 16, true); - helper_clear_eoi(env); - - // uint64_t EOI; - // cpu_physical_memory_rw(APIC_DEFAULT_ADDRESS + 0xb0, &EOI, 8, false); - // qemu_log("\n\n the EOI content: 0x%lx\n\n",EOI); - // cpu_physical_memory_rw(APIC_DEFAULT_ADDRESS + 0xb0, 0, 4, true); - //查看当前的权级 // cpl = env->hflags & HF_CPL_MASK; // qemu_log("-|-| perv: %d \n", cpl); if(send)helper_rrnzero(env); - // 下面的方法会在uihandler 里面报seg fault - // dpl = (e2 >> DESC_DPL_SHIFT) & 3; - // selector = e1 >> 16; - // selector = (selector & ~3) | dpl; - // cpu_x86_load_seg_cache(env, R_CS, selector, - // get_seg_base(e1, e2), - // get_seg_limit(e1, e2), - // e2); - return; } @@ -1012,12 +984,10 @@ static void do_interrupt64(CPUX86State *env, int intno, int is_int, cpl = env->hflags & HF_CPL_MASK; // 是否事用户态 /* check privilege if software int */ if (is_int && dpl < cpl) { - if(send)qemu_log("pin 2\n"); raise_exception_err(env, EXCP0D_GPF, intno * 16 + 2); } /* check valid bit */ if (!(e2 & DESC_P_MASK)) { - if(send)qemu_log("pin 3\n"); raise_exception_err(env, EXCP0B_NOSEG, intno * 16 + 2); } selector = e1 >> 16; @@ -1027,28 +997,22 @@ static void do_interrupt64(CPUX86State *env, int intno, int is_int, raise_exception_err(env, EXCP0D_GPF, 0); } if (load_segment(env, &e1, &e2, selector) != 0) { - if(send)qemu_log("pin 4\n"); raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); } if (!(e2 & DESC_S_MASK) || !(e2 & (DESC_CS_MASK))) { - if(send)qemu_log("pin 5\n"); raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); } dpl = (e2 >> DESC_DPL_SHIFT) & 3; if (dpl > cpl) { - if(send)qemu_log("pin 6\n"); raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); } if (!(e2 & DESC_P_MASK)) { - if(send)qemu_log("pin 7\n"); raise_exception_err(env, EXCP0B_NOSEG, selector & 0xfffc); } if (!(e2 & DESC_L_MASK) || (e2 & DESC_B_MASK)) { - if(send)qemu_log("pin 8\n"); raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); } if (e2 & DESC_C_MASK) { - if(send)qemu_log("pin 9\n"); dpl = cpl; } if (dpl < cpl || ist != 0) { @@ -1058,7 +1022,6 @@ static void do_interrupt64(CPUX86State *env, int intno, int is_int, ss = 0; } else { /* to same privilege */ - if(send)qemu_log("pin 10\n"); if (env->eflags & VM_MASK) { raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); } @@ -1086,7 +1049,6 @@ static void do_interrupt64(CPUX86State *env, int intno, int is_int, cpu_x86_load_seg_cache(env, R_SS, ss, 0, 0, dpl << DESC_DPL_SHIFT); } env->regs[R_ESP] = esp; - if(send)qemu_log("pin 11\n"); selector = (selector & ~3) | dpl; cpu_x86_load_seg_cache(env, R_CS, selector, get_seg_base(e1, e2), @@ -1234,7 +1196,6 @@ void do_interrupt_all(X86CPU *cpu, int intno, int is_int, if (env->cr[0] & CR0_PE_MASK) { // 改， 中断具体分发，应该不涉及user only #if !defined(CONFIG_USER_ONLY) if (env->hflags & HF_GUEST_MASK) { - qemu_log("HF_GUEST_MASK even \n"); handle_even_inj(env, intno, is_int, error_code, is_hw, 0); } #endif @@ -1244,14 +1205,12 @@ void do_interrupt_all(X86CPU *cpu, int intno, int is_int, } else #endif { - qemu_log("interrupt protected \n"); do_interrupt_protected(env, intno, is_int, error_code, next_eip, is_hw); } } else { #if !defined(CONFIG_USER_ONLY) if (env->hflags & HF_GUEST_MASK) { - qemu_log("HF_GUEST_MASK even inj \n"); handle_even_inj(env, intno, is_int, error_code, is_hw, 1); } #endif @@ -1260,7 +1219,6 @@ void do_interrupt_all(X86CPU *cpu, int intno, int is_int, #if !defined(CONFIG_USER_ONLY) if (env->hflags & HF_GUEST_MASK) { - qemu_log("HF_GUEST_MASK do real \n"); CPUState *cs = CPU(cpu); uint32_t event_inj = x86_ldl_phys(cs, env->vm_vmcb + offsetof(struct vmcb, diff --git a/target/i386/tcg/sysemu/misc_helper.c b/target/i386/tcg/sysemu/misc_helper.c index 286dafe606..93bfe2a69c 100644 --- a/target/i386/tcg/sysemu/misc_helper.c +++ b/target/i386/tcg/sysemu/misc_helper.c @@ -229,7 +229,6 @@ void helper_wrmsr(CPUX86State *env) #endif // ？？？ 改wrmsr case MSR_IA32_UINTR_RR: - qemu_log("qemu:wrmsr RR 0x%lx\n",val); env->uintr_rr = val; if(val!= 0){ if(Debug)qemu_log("getting rr not zero get into helper rr:%ld\n",val); @@ -237,23 +236,18 @@ void helper_wrmsr(CPUX86State *env) } break; case MSR_IA32_UINTR_HANDLER: - qemu_log("qemu:wrmsr handler 0x%016lx\n",val); env->uintr_handler = val; break; case MSR_IA32_UINTR_STACKADJUST: - qemu_log("qemu:wrmsr stackadjust 0x%lx\n",val); env->uintr_stackadjust = val; break; case MSR_IA32_UINTR_MISC: - qemu_log("qemu:wrmsr misc 0x%016lx\n",val); env->uintr_misc = val; break; case MSR_IA32_UINTR_PD: - qemu_log("qemu:wrmsr pd 0x%016lx\n",val); env->uintr_pd = val; break; case MSR_IA32_UINTR_TT: - qemu_log("qemu:wrmsr tt 0x%016lx\n",val); env->uintr_tt = val; break; case MSR_MTRRphysBase(0): @@ -409,15 +403,12 @@ void helper_rdmsr(CPUX86State *env) //改 rdmsr case MSR_IA32_UINTR_RR: val = env->uintr_rr; - if(Debug)qemu_log("qemu:rdmsr RR 0x%016lx\n",val); break; case MSR_IA32_UINTR_HANDLER: val = env->uintr_handler; - qemu_log("qemu:rdmsr handler 0x%016lx\n",val); break; case MSR_IA32_UINTR_STACKADJUST: val = env->uintr_stackadjust; - qemu_log("qemu:rdmsr stackadjust 0x%016lx\n",val); break; case MSR_IA32_UINTR_MISC: val = env->uintr_misc; @@ -430,11 +421,9 @@ void helper_rdmsr(CPUX86State *env) break; case MSR_IA32_UINTR_PD: val = env->uintr_pd; - qemu_log("qemu:rdmsr pd 0x%016lx\n",val); break; case MSR_IA32_UINTR_TT: val = env->uintr_tt; - qemu_log("qemu:rdmsr tt 0x%016lx\n",val); break; case MSR_SMI_COUNT: val = env->msr_smi_count; diff --git a/target/i386/tcg/sysemu/seg_helper.c b/target/i386/tcg/sysemu/seg_helper.c index 45197f4f06..83f674fd5b 100644 --- a/target/i386/tcg/sysemu/seg_helper.c +++ b/target/i386/tcg/sysemu/seg_helper.c @@ -172,7 +172,6 @@ bool x86_cpu_exec_interrupt(CPUState *cs, int interrupt_request) //???？？？ cs->interrupt_request &= ~(CPU_INTERRUPT_HARD | CPU_INTERRUPT_VIRQ); intno = cpu_get_pic_interrupt(env); - if(Debug && intno == 0xec)printf("!!! interrupt %d intno:%d \n",interrupt_request, intno); //改 qemu_log_mask(CPU_LOG_INT, "Servicing hardware INT=0x%02x\n", intno); do_interrupt_x86_hardirq(env, intno, 1); diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c index 1619d97e96..2592d7297b 100644 --- a/target/i386/tcg/translate.c +++ b/target/i386/tcg/translate.c @@ -31,8 +31,7 @@ #include "helper-tcg.h" #include "exec/log.h" -#include <stdio.h> -static bool Debug = true; +// static bool Debug = true; #define PREFIX_REPZ 0x01 #define PREFIX_REPNZ 0x02 @@ -2761,13 +2760,13 @@ static inline void gen_op_movo(DisasContext *s, int d_offset, int s_offset) } static inline void gen_op_movq(DisasContext *s, int d_offset, int s_offset) -{ if(Debug) qemu_log("qemu: movq %d %d\n",d_offset,s_offset); +{ tcg_gen_ld_i64(s->tmp1_i64, cpu_env, s_offset); tcg_gen_st_i64(s->tmp1_i64, cpu_env, d_offset); } static inline void gen_op_movl(DisasContext *s, int d_offset, int s_offset) -{ if(Debug) qemu_log("qemu: movl %d %d\n",d_offset,s_offset); +{ tcg_gen_ld_i32(s->tmp2_i32, cpu_env, s_offset); tcg_gen_st_i32(s->tmp2_i32, cpu_env, d_offset); } @@ -5403,44 +5402,10 @@ static inline void gen_op_ld_v(DisasContext *s, int idx, TCGv t0, TCGv a0) } */ case 0x1c7: /* cmpxchg8b */ - if(prefixes & PREFIX_REPZ){ + if(prefixes & PREFIX_REPZ){ // SENDUIPI modrm = x86_ldub_code(env, s); - qemu_log("\n\n--------------\n"); - qemu_log("qemu: caught 0xf30fc7 SENDUIPI eip:0x%lx\n ",env->eip); // 改 Debug - // CPUState *cs = env_cpu(env); - // int prot; - // uint64_t APICaddress = get_hphys2(cs, APIC_DEFAULT_ADDRESS, MMU_DATA_LOAD, &prot); - // uint64_t EOI; - // cpu_physical_memory_rw(APICaddress + 0xb0, &EOI, 8, false); - // qemu_log("the physical address of APIC 0x%lx the EOI content: 0x%lx\n", APICaddress,EOI); - - - // s->tmp1_i64 = env->uintr_tt; //地址 - // tcg_gen_qemu_ld_i64(s->tmp1_i64, s->A0 , 0, MO_LEUQ); - // qemu_log("qemu: loaded 0x%lx A0: 0x%lx\n",(uint64_t)((void*)s->tmp1_i64),(uint64_t)s->A0); - - - // uint64_t content[10]; // read all zero - // cpu_physical_memory_rw((env->uintr_tt>>3)<<3,&content,16,false); - // if(Debug) qemu_log("0x%lx xxx %lx \n %lx \n\n",(env->uintr_tt>>3)<<3, content[0],content[1]); - - // int mem_idx = cpu_mmu_index(env, false); // system segfault - // MemOpIdx oi0 = make_memop_idx(MO_LEUQ | MO_ALIGN_16, mem_idx); - // uint64_t content = cpu_ldq_le_mmu(env, (env->uintr_tt>>3)<<3, oi0, 0); - // if(Debug) qemu_log(" %lx \n\n\n",content); - - - // TCGv t0; - // t0 = tcg_temp_local_new(); - // s->A0 = (TCGv)(env->uintr_tt>>3)<<3; - // if(Debug)qemu_log("debug: memindex: %x \n",s->mem_index); - // if(Debug){qemu_log("debug: before t0: %llx A0: %llx\n",(long long unsigned)t0,(long long unsigned)s->A0);} - // gen_op_ld_v(s, ot, t0, s->A0); - // if(Debug){qemu_log("debug: after t0: %llx A0: %llx\n",(long long unsigned)t0,(long long unsigned)s->A0);} - // tcg_temp_free(t0); gen_helper_senduipi(cpu_env, tcg_const_i32(modrm)); senduipi_called = true; - qemu_log("--------------\n\n\n"); break; } modrm = x86_ldub_code(env, s); @@ -7748,7 +7713,6 @@ static inline void gen_op_ld_v(DisasContext *s, int idx, TCGv t0, TCGv a0) break; case 0xee: /* rdpkru */ if(prefixes & PREFIX_REPZ){ - qemu_log("qemu:caught 0xf30fee CLUI\n"); // 改 env->uintr_uif = 0; break; } @@ -7760,39 +7724,20 @@ static inline void gen_op_ld_v(DisasContext *s, int idx, TCGv t0, TCGv a0) tcg_gen_extr_i64_tl(cpu_regs[R_EAX], cpu_regs[R_EDX], s->tmp1_i64); break; case 0xec: - if (prefixes & PREFIX_REPZ){ - qemu_log("\n\n\n--------------\n"); - qemu_log("qemu:caught 0xf30f01ec UIRET when translate\n"); // 改 - qemu_log("before: pc_start: 0x%lx sc_base:%lx pc: 0x%lx pc.next:0x%lx rip:0x%lx\n",s->pc_start,s->cs_base, s->pc, s->base.pc_next, env->eip); - - + if (prefixes & PREFIX_REPZ){ // UIRET gen_helper_uiret(cpu_env); uiret_called = true; - // gen_jmp_im(s, env->eip); - // gen_jmp(s, env->eip); - qemu_log("pc_start: 0x%lx sc_base:%lx pc: 0x%lx rip:0x%lx\n",s->pc_start,s->cs_base, s->pc, env->eip); - // s->pc = env->eip; - // gen_jmp(s, s->pc - s->cs_base); - // tcg_gen_exit_tb(NULL, 0); - // helper_ret_protected(env, shift, 1, 0, GETPC()); - // set_cc_op(s, CC_OP_EFLAGS); gen_eob(s); - // s->base.is_jmp = DISAS_NORETURN; - qemu_log("-------------\n\n\n"); - // exit(12); } break; case 0xed: - if (prefixes & PREFIX_REPZ){ + if (prefixes & PREFIX_REPZ){ // TESTUI qemu_log("qemu:caught 0xf30f01ed TESTUI\n"); // 改 } break; case 0xef: /* wrpkru */ - if(prefixes & PREFIX_REPZ){ - qemu_log("--------------\n"); - qemu_log("qemu:caught 0xf30f01ef STUI\n"); // 改 + if(prefixes & PREFIX_REPZ){ // STUI env->uintr_uif = 1; - qemu_log("--------------\n\n\n"); break; } if (prefixes & PREFIX_LOCK) { |