From nobody Sat Nov 15 22:35:13 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=linux.microsoft.com ARC-Seal: i=1; a=rsa-sha256; t=1747740989; cv=none; d=zohomail.com; s=zohoarc; b=N0U5SGtEvWyXePfmB193FoZRAVkry/FV3YSKave8HiC/9NXf5RF1pYyYBqqfEeUJaN0rwzeGMHSoniiSQ+F1b32oxDl4KXe2DUDIYLgGy49eYYbUvEpt+YgixAVdyCgKx+CRBoG41A0BkDEqDGJt6jDFXqrmG9KJyFZ16txPAmk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1747740989; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=kiSwBxsrpREHcCNUamJV6d9nNzOZx4WMReNeya8ItkI=; b=YNRCFRdfyJoP4qqA4s6rsPnjyHDfBy1jNu/NStU/rnyiThKlmKqbLtJFsi3t8MPjoQxwnP9CYycNWq9NuC0xKo9JXGiTbSTqlQ7MHYO5gyS3PDWl7CmlZP8bBrP2X5UAUnG4u/HSNrmRX5Wi+ElIVPNhV1rDMspZWqjROrsl18E= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1747740989178638.1797609647366; Tue, 20 May 2025 04:36:29 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uHLBr-00082K-Lw; Tue, 20 May 2025 07:31:23 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uHLBp-000827-Hp for qemu-devel@nongnu.org; Tue, 20 May 2025 07:31:21 -0400 Received: from linux.microsoft.com ([13.77.154.182]) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uHLBn-0001B7-0m for qemu-devel@nongnu.org; Tue, 20 May 2025 07:31:21 -0400 Received: from DESKTOP-TUU1E5L.fritz.box (unknown [172.201.77.43]) by linux.microsoft.com (Postfix) with ESMTPSA id 9C621206788F; Tue, 20 May 2025 04:31:14 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 9C621206788F DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1747740677; bh=kiSwBxsrpREHcCNUamJV6d9nNzOZx4WMReNeya8ItkI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jl0tEYQuslvgpRIxrz8I2ULrZUEwlPpZNCfiDNfEByJZQL6yFT7dhaoBWaJZKxS6l 3J08AIE+zdYNqa+tuboywckpbBA32A7py1pjl3HKTPH0IBFSYCeLBu0CJBU0A+KMQ5 pKgPr+DIYDIIAdhgiB0yZ1l+VnALOuwncPiB47ZI= From: Magnus Kulke To: magnuskulke@microsoft.com, qemu-devel@nongnu.org, liuwe@microsoft.com Cc: Paolo Bonzini , "Michael S. Tsirkin" , Wei Liu , Phil Dennis-Jordan , Roman Bolshakov , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Zhao Liu , Richard Henderson , Cameron Esfahani , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Subject: [RFC PATCH 03/25] target/i386/mshv: Add x86 decoder/emu implementation Date: Tue, 20 May 2025 13:29:56 +0200 Message-Id: <20250520113018.49569-4-magnuskulke@linux.microsoft.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250520113018.49569-1-magnuskulke@linux.microsoft.com> References: <20250520113018.49569-1-magnuskulke@linux.microsoft.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=13.77.154.182; envelope-from=magnuskulke@linux.microsoft.com; helo=linux.microsoft.com X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @linux.microsoft.com) X-ZM-MESSAGEID: 1747740991678116600 Content-Type: text/plain; charset="utf-8" The MSHV accelerator requires a x86 decoder/emulator in userland to emulate MMIO instructions. This change contains the implementations for the generalized i386 instruction decoder/emulator. Signed-off-by: Magnus Kulke --- include/system/mshv.h | 32 ++++ target/i386/cpu.h | 2 +- target/i386/emulate/meson.build | 7 +- target/i386/meson.build | 2 + target/i386/mshv/meson.build | 7 + target/i386/mshv/x86.c | 330 ++++++++++++++++++++++++++++++++ 6 files changed, 377 insertions(+), 3 deletions(-) create mode 100644 include/system/mshv.h create mode 100644 target/i386/mshv/meson.build create mode 100644 target/i386/mshv/x86.c diff --git a/include/system/mshv.h b/include/system/mshv.h new file mode 100644 index 0000000000..8380b92da2 --- /dev/null +++ b/include/system/mshv.h @@ -0,0 +1,32 @@ +/* + * QEMU MSHV support + * + * Copyright Microsoft, Corp. 2025 + * + * Authors: + * Ziqiao Zhou + * Magnus Kulke + * Jinank Jain + * + * This work is licensed under the terms of the GNU GPL, version 2 or late= r. + * See the COPYING file in the top-level directory. + * + */ + +#ifndef QEMU_MSHV_INT_H +#define QEMU_MSHV_INT_H + +#ifdef COMPILING_PER_TARGET +#ifdef CONFIG_MSHV +#define CONFIG_MSHV_IS_POSSIBLE +#endif +#else +#define CONFIG_MSHV_IS_POSSIBLE +#endif + +/* cpu */ +/* EFER (technically not a register) bits */ +#define EFER_LMA ((uint64_t)0x400) +#define EFER_LME ((uint64_t)0x100) + +#endif diff --git a/target/i386/cpu.h b/target/i386/cpu.h index 4f8ed8868e..db6a37b271 100644 --- a/target/i386/cpu.h +++ b/target/i386/cpu.h @@ -2101,7 +2101,7 @@ typedef struct CPUArchState { QEMUTimer *xen_periodic_timer; QemuMutex xen_timers_lock; #endif -#if defined(CONFIG_HVF) +#if defined(CONFIG_HVF) || defined(CONFIG_MSHV) X86LazyFlags lflags; void *emu_mmio_buf; #endif diff --git a/target/i386/emulate/meson.build b/target/i386/emulate/meson.bu= ild index 4edd4f462f..b6dafb6a5b 100644 --- a/target/i386/emulate/meson.build +++ b/target/i386/emulate/meson.build @@ -1,5 +1,8 @@ -i386_system_ss.add(when: [hvf, 'CONFIG_HVF'], if_true: files( +emulator_files =3D files( 'x86_decode.c', 'x86_emu.c', 'x86_flags.c', -)) +) + +i386_system_ss.add(when: [hvf, 'CONFIG_HVF'], if_true: emulator_files) +i386_system_ss.add(when: 'CONFIG_MSHV', if_true: emulator_files) diff --git a/target/i386/meson.build b/target/i386/meson.build index c1aacea613..6097e5c427 100644 --- a/target/i386/meson.build +++ b/target/i386/meson.build @@ -11,6 +11,7 @@ i386_ss.add(when: 'CONFIG_SEV', if_true: files('host-cpu.= c', 'confidential-guest # x86 cpu type i386_ss.add(when: 'CONFIG_KVM', if_true: files('host-cpu.c')) i386_ss.add(when: 'CONFIG_HVF', if_true: files('host-cpu.c')) +i386_ss.add(when: 'CONFIG_MSHV', if_true: files('host-cpu.c')) =20 i386_system_ss =3D ss.source_set() i386_system_ss.add(files( @@ -32,6 +33,7 @@ subdir('nvmm') subdir('hvf') subdir('tcg') subdir('emulate') +subdir('mshv') =20 target_arch +=3D {'i386': i386_ss} target_system_arch +=3D {'i386': i386_system_ss} diff --git a/target/i386/mshv/meson.build b/target/i386/mshv/meson.build new file mode 100644 index 0000000000..8ddaa7c11d --- /dev/null +++ b/target/i386/mshv/meson.build @@ -0,0 +1,7 @@ +i386_mshv_ss =3D ss.source_set() + +i386_mshv_ss.add(files( + 'x86.c', +)) + +i386_system_ss.add_all(when: 'CONFIG_MSHV', if_true: i386_mshv_ss) diff --git a/target/i386/mshv/x86.c b/target/i386/mshv/x86.c new file mode 100644 index 0000000000..581710fd06 --- /dev/null +++ b/target/i386/mshv/x86.c @@ -0,0 +1,330 @@ +/* + * QEMU MSHV support + * + * Copyright Microsoft, Corp. 2025 + * + * Authors: + * Magnus Kulke + * + * This work is licensed under the terms of the GNU GPL, version 2 or late= r. + * See the COPYING file in the top-level directory. + * + */ + +#include "qemu/osdep.h" + +#include "cpu.h" +#include "emulate/x86_decode.h" +#include "emulate/x86_emu.h" +#include "qemu/typedefs.h" +#include "qemu/error-report.h" +#include "system/mshv.h" + +/* RW or Exec segment */ +static const uint8_t RWRX_SEGMENT_TYPE =3D 0x2; +static const uint8_t CODE_SEGMENT_TYPE =3D 0x8; +static const uint8_t EXPAND_DOWN_SEGMENT_TYPE =3D 0x4; + +typedef enum CpuMode { + REAL_MODE, + PROTECTED_MODE, + LONG_MODE, +} CpuMode; + +static CpuMode cpu_mode(CPUState *cpu) +{ + enum CpuMode m =3D REAL_MODE; + + if (x86_is_protected(cpu)) { + m =3D PROTECTED_MODE; + + if (x86_is_long_mode(cpu)) { + m =3D LONG_MODE; + } + } + + return m; +} + +static bool segment_type_ro(const SegmentCache *seg) +{ + uint32_t type_ =3D (seg->flags >> DESC_TYPE_SHIFT) & 15; + return (type_ & (~RWRX_SEGMENT_TYPE)) =3D=3D 0; +} + +static bool segment_type_code(const SegmentCache *seg) +{ + uint32_t type_ =3D (seg->flags >> DESC_TYPE_SHIFT) & 15; + return (type_ & CODE_SEGMENT_TYPE) !=3D 0; +} + +static bool segment_expands_down(const SegmentCache *seg) +{ + uint32_t type_ =3D (seg->flags >> DESC_TYPE_SHIFT) & 15; + + if (segment_type_code(seg)) { + return false; + } + + return (type_ & EXPAND_DOWN_SEGMENT_TYPE) !=3D 0; +} + +static uint32_t segment_limit(const SegmentCache *seg) +{ + uint32_t limit =3D seg->limit; + uint32_t granularity =3D (seg->flags & DESC_G_MASK) !=3D 0; + + if (granularity !=3D 0) { + limit =3D (limit << 12) | 0xFFF; + } + + return limit; +} + +static uint8_t segment_db(const SegmentCache *seg) +{ + return (seg->flags >> DESC_B_SHIFT) & 1; +} + +static uint32_t segment_max_limit(const SegmentCache *seg) +{ + if (segment_db(seg) !=3D 0) { + return 0xFFFFFFFF; + } + return 0xFFFF; +} + +static int linearize(CPUState *cpu, + target_ulong logical_addr, target_ulong *linear_addr, + X86Seg seg_idx) +{ + enum CpuMode mode; + X86CPU *x86_cpu =3D X86_CPU(cpu); + CPUX86State *env =3D &x86_cpu->env; + SegmentCache *seg =3D &env->segs[seg_idx]; + target_ulong base =3D seg->base; + target_ulong logical_addr_32b; + uint32_t limit; + /* TODO: the emulator will not pass us "write" indicator yet */ + bool write =3D false; + + mode =3D cpu_mode(cpu); + + switch (mode) { + case LONG_MODE: + if (__builtin_add_overflow(logical_addr, base, linear_addr)) { + error_report("Address overflow"); + return -1; + } + break; + case PROTECTED_MODE: + case REAL_MODE: + if (segment_type_ro(seg) && write) { + error_report("Cannot write to read-only segment"); + return -1; + } + + logical_addr_32b =3D logical_addr & 0xFFFFFFFF; + limit =3D segment_limit(seg); + + if (segment_expands_down(seg)) { + if (logical_addr_32b >=3D limit) { + error_report("Address exceeds limit (expands down)"); + return -1; + } + + limit =3D segment_max_limit(seg); + } + + if (logical_addr_32b > limit) { + error_report("Address exceeds limit %u", limit); + return -1; + } + *linear_addr =3D logical_addr_32b + base; + break; + default: + error_report("Unknown cpu mode: %d", mode); + return -1; + } + + return 0; +} + +bool x86_read_segment_descriptor(CPUState *cpu, + struct x86_segment_descriptor *desc, + x86_segment_selector sel) +{ + target_ulong base; + uint32_t limit; + X86CPU *x86_cpu =3D X86_CPU(cpu); + CPUX86State *env =3D &x86_cpu->env; + target_ulong gva; + /* int ret; */ + + memset(desc, 0, sizeof(*desc)); + + /* valid gdt descriptors start from index 1 */ + if (!sel.index && GDT_SEL =3D=3D sel.ti) { + return false; + } + + if (GDT_SEL =3D=3D sel.ti) { + base =3D env->gdt.base; + limit =3D env->gdt.limit; + } else { + base =3D env->ldt.base; + limit =3D env->ldt.limit; + } + + if (sel.index * 8 >=3D limit) { + return false; + } + + gva =3D base + sel.index * 8; + emul_ops->read_mem(cpu, desc, gva, sizeof(*desc)); + + return true; +} + +bool x86_write_segment_descriptor(CPUState *cpu, + struct x86_segment_descriptor *desc, + x86_segment_selector sel) +{ + target_ulong base; + uint32_t limit; + X86CPU *x86_cpu =3D X86_CPU(cpu); + CPUX86State *env =3D &x86_cpu->env; + /* int ret; */ + target_ulong gva; + + if (GDT_SEL =3D=3D sel.ti) { + base =3D env->gdt.base; + limit =3D env->gdt.limit; + } else { + base =3D env->ldt.base; + limit =3D env->ldt.limit; + } + + if (sel.index * 8 >=3D limit) { + return false; + } + + gva =3D base + sel.index * 8; + emul_ops->write_mem(cpu, desc, gva, sizeof(*desc)); + + return true; +} + +bool x86_read_call_gate(CPUState *cpu, struct x86_call_gate *idt_desc, + int gate) +{ + target_ulong base; + uint32_t limit; + X86CPU *x86_cpu =3D X86_CPU(cpu); + CPUX86State *env =3D &x86_cpu->env; + target_ulong gva; + + base =3D env->idt.base; + limit =3D env->idt.limit; + + memset(idt_desc, 0, sizeof(*idt_desc)); + if (gate * 8 >=3D limit) { + perror("call gate exceeds idt limit"); + return false; + } + + gva =3D base + gate * 8; + emul_ops->read_mem(cpu, idt_desc, gva, sizeof(*idt_desc)); + + return true; +} + +bool x86_is_protected(CPUState *cpu) +{ + X86CPU *x86_cpu =3D X86_CPU(cpu); + CPUX86State *env =3D &x86_cpu->env; + uint64_t cr0 =3D env->cr[0]; + + return cr0 & CR0_PE_MASK; +} + +bool x86_is_real(CPUState *cpu) +{ + return !x86_is_protected(cpu); +} + +bool x86_is_v8086(CPUState *cpu) +{ + X86CPU *x86_cpu =3D X86_CPU(cpu); + CPUX86State *env =3D &x86_cpu->env; + return x86_is_protected(cpu) && (env->eflags & VM_MASK); +} + +bool x86_is_long_mode(CPUState *cpu) +{ + X86CPU *x86_cpu =3D X86_CPU(cpu); + CPUX86State *env =3D &x86_cpu->env; + uint64_t efer =3D env->efer; + + return ((efer & (EFER_LME | EFER_LMA)) =3D=3D (EFER_LME | EFER_LMA)); +} + +bool x86_is_long64_mode(CPUState *cpu) +{ + error_report("unimplemented: is_long64_mode()"); + abort(); +} + +bool x86_is_paging_mode(CPUState *cpu) +{ + X86CPU *x86_cpu =3D X86_CPU(cpu); + CPUX86State *env =3D &x86_cpu->env; + uint64_t cr0 =3D env->cr[0]; + + return cr0 & CR0_PG_MASK; +} + +bool x86_is_pae_enabled(CPUState *cpu) +{ + X86CPU *x86_cpu =3D X86_CPU(cpu); + CPUX86State *env =3D &x86_cpu->env; + uint64_t cr4 =3D env->cr[4]; + + return cr4 & CR4_PAE_MASK; +} + +target_ulong linear_addr(CPUState *cpu, target_ulong addr, X86Seg seg) +{ + int ret; + target_ulong linear_addr; + + /* return vmx_read_segment_base(cpu, seg) + addr; */ + ret =3D linearize(cpu, addr, &linear_addr, seg); + if (ret < 0) { + error_report("failed to linearize address"); + abort(); + } + + return linear_addr; +} + +target_ulong linear_addr_size(CPUState *cpu, target_ulong addr, int size, + X86Seg seg) +{ + switch (size) { + case 2: + addr =3D (uint16_t)addr; + break; + case 4: + addr =3D (uint32_t)addr; + break; + default: + break; + } + return linear_addr(cpu, addr, seg); +} + +target_ulong linear_rip(CPUState *cpu, target_ulong rip) +{ + return linear_addr(cpu, rip, R_CS); +} --=20 2.34.1