This patch series is a fix for the recent merge of the outdated patch series: https://lore.kernel.org/all/20260428135053.251200-1-dblanzeanu@linux.microsoft.com/ The above patch series had some newer versions that fixed addressed feedback from reviewers. The commits do the following: 1. Moves the definition for the `hv_vp_register_page` to `hvhdk.h` Fixes: 8afb40b7fe 2. Changes the register page setup to fail in case the mmap of the page fails. This way it signals an issue early. Fixes: a173f8f170 3. Rename functions local to the `mshv-cpu.c` linked to register page get. Use the register page to read registers on VM exit. General purpose registers, RIP, RFLAGS, segment registers, and control registers (CR0, CR4, CR4, CR8, EFER) are read directly from the page. Registers not present on the page (TR, LDTR, GDTR, IDTR, CR2, APIC_BASE) are not fetched anymore for performance reasons. Removes the fallback to ioctls in case the register page is not correctly set up and aborts. Fixes: 40072a7391 4. Changes the registers storing to only use the register page and not rely on ioctls for perfomance improvements. From local tests, the special registers that are not stored, do not get modified when emulating. However, if there's an issue discovered, we'll fix later. Fixes: 80c7f8e9cd 5. When a device handler (e.g. vmport) calls cpu_synchronize_state() during I/O port dispatch, it sets cpu->accel->dirty = true and may modify registers directly in env. The old PIO code ignored this: it unconditionally wrote the stale info->rax from the VM-exit intercept message back to the hypervisor and then cleared dirty, discarding any register changes made by the device. Note: This was a change present in version 3 of the patch series but not present in the version 1 of the patch series (the one merged) The register page is only used when it has been successfully mmapped and the hypervisor has marked it as valid (`isvalid != 0`). Otherwise, an error is returned and execution aborted to signal something faulty and unexpected. -----BEGIN SSH SIGNATURE----- U1NIU0lHAAAAAQAAAE0AAAAac2stc3NoLWVkMjU1MTlAb3BlbnNzaC5jb20AAAAgF4l9Pi ZyIMDy0ZI4SCYaMCvjXS3h6Dpo3xDFvSh0I7oAAAAHc3NoOmdpdAAAAANnaXQAAAAAAAAA BnNoYTUxMgAAAGcAAAAac2stc3NoLWVkMjU1MTlAb3BlbnNzaC5jb20AAABA4egRAbnGLI XkdzHMqxAMQj1wQNIw+Ja9we8xUkEiJW96FaummDyD2h2TxplwF93KnWYW/sUYZMX5b1C3 3OOcBgUAACUF -----END SSH SIGNATURE----- -----BEGIN SSH SIGNATURE----- U1NIU0lHAAAAAQAAAE0AAAAac2stc3NoLWVkMjU1MTlAb3BlbnNzaC5jb20AAAAgF4l9Pi ZyIMDy0ZI4SCYaMCvjXS3h6Dpo3xDFvSh0I7oAAAAHc3NoOmdpdAAAAANnaXQAAAAAAAAA BnNoYTUxMgAAAGcAAAAac2stc3NoLWVkMjU1MTlAb3BlbnNzaC5jb20AAABAqkJRImazba 3Xjj17Hi7FDcJ5XC7f+rFXUvDc58gax1GyCHtOu16ldDx3ldSi2Zl8iGFtauFsLHRAdPpK IoPyDAUAACUR -----END SSH SIGNATURE----- Doru Blânzeanu (5): include/hw/hyperv: move hv_vp_register_page struct definition target/i386/mshv: abort when hv_vp_register_page setup fails target/i386/mshv: remove fallback for register page get registers target/i386/mshv: remove fallback for register page set registers target/i386/mshv: fix pio handlers clobbering device-modified registers include/hw/hyperv/hvgdk.h | 2 + include/hw/hyperv/hvgdk_mini.h | 103 -------------- include/hw/hyperv/hvhdk.h | 106 ++++++++++++++ target/i386/mshv/mshv-cpu.c | 249 +++++++++++++++------------------ 4 files changed, 220 insertions(+), 240 deletions(-) -- 2.53.0 Move the `hv_vp_register_page` structure definition from `hvgdk_mini.h` to `hvhdk.h`. Fixes: 8afb40b7fe Signed-off-by: Doru Blânzeanu <dblanzeanu@linux.microsoft.com> --- include/hw/hyperv/hvgdk.h | 2 + include/hw/hyperv/hvgdk_mini.h | 103 -------------------------------- include/hw/hyperv/hvhdk.h | 106 +++++++++++++++++++++++++++++++++ 3 files changed, 108 insertions(+), 103 deletions(-) diff --git a/include/hw/hyperv/hvgdk.h b/include/hw/hyperv/hvgdk.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/hyperv/hvgdk.h +++ b/include/hw/hyperv/hvgdk.h @@ -XXX,XX +XXX,XX @@ #ifndef HW_HYPERV_HVGDK_H #define HW_HYPERV_HVGDK_H +#include "hvgdk_mini.h" + #define HVGDK_H_VERSION (25125) enum hv_unimplemented_msr_action { diff --git a/include/hw/hyperv/hvgdk_mini.h b/include/hw/hyperv/hvgdk_mini.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/hyperv/hvgdk_mini.h +++ b/include/hw/hyperv/hvgdk_mini.h @@ -XXX,XX +XXX,XX @@ struct hv_input_assert_virtual_interrupt { uint16_t rsvd_z1; } QEMU_PACKED; -/* Flags for dirty mask of hv_vp_register_page */ -enum hv_x64_register_class_type { - HV_X64_REGISTER_CLASS_GENERAL = 0, - HV_X64_REGISTER_CLASS_IP = 1, - HV_X64_REGISTER_CLASS_XMM = 2, - HV_X64_REGISTER_CLASS_SEGMENT = 3, - HV_X64_REGISTER_CLASS_FLAGS = 4, -}; - -#define HV_VP_REGISTER_PAGE_MAX_VECTOR_COUNT 7 - -union hv_vp_register_page_interrupt_vectors { - uint64_t as_uint64; - struct { - uint8_t vector_count; - uint8_t vector[HV_VP_REGISTER_PAGE_MAX_VECTOR_COUNT]; - }; -}; - -struct hv_vp_register_page { - uint16_t version; - uint8_t isvalid; - uint8_t rsvdz; - uint32_t dirty; - - union { - struct { - /* General purpose registers (HV_X64_REGISTER_CLASS_GENERAL) */ - union { - struct { - uint64_t rax; - uint64_t rcx; - uint64_t rdx; - uint64_t rbx; - uint64_t rsp; - uint64_t rbp; - uint64_t rsi; - uint64_t rdi; - uint64_t r8; - uint64_t r9; - uint64_t r10; - uint64_t r11; - uint64_t r12; - uint64_t r13; - uint64_t r14; - uint64_t r15; - } QEMU_PACKED; - - uint64_t gp_registers[16]; - }; - /* Instruction pointer (HV_X64_REGISTER_CLASS_IP) */ - uint64_t rip; - /* Flags (HV_X64_REGISTER_CLASS_FLAGS) */ - uint64_t rflags; - } QEMU_PACKED; - - uint64_t registers[18]; - }; - uint8_t reserved[8]; - /* Volatile XMM registers (HV_X64_REGISTER_CLASS_XMM) */ - union { - struct { - struct hv_u128 xmm0; - struct hv_u128 xmm1; - struct hv_u128 xmm2; - struct hv_u128 xmm3; - struct hv_u128 xmm4; - struct hv_u128 xmm5; - } QEMU_PACKED; - - struct hv_u128 xmm_registers[6]; - }; - /* Segment registers (HV_X64_REGISTER_CLASS_SEGMENT) */ - union { - struct { - struct hv_x64_segment_register es; - struct hv_x64_segment_register cs; - struct hv_x64_segment_register ss; - struct hv_x64_segment_register ds; - struct hv_x64_segment_register fs; - struct hv_x64_segment_register gs; - } QEMU_PACKED; - - struct hv_x64_segment_register segment_registers[6]; - }; - /* Misc. control registers (cannot be set via this interface) */ - uint64_t cr0; - uint64_t cr3; - uint64_t cr4; - uint64_t cr8; - uint64_t efer; - uint64_t dr7; - union hv_x64_pending_interruption_register pending_interruption; - union hv_x64_interrupt_state_register interrupt_state; - uint64_t instruction_emulation_hints; - uint64_t xfem; - - uint8_t reserved1[0x100]; - - /* Interrupts injected as part of HvCallDispatchVp. */ - union hv_vp_register_page_interrupt_vectors interrupt_vectors; -} QEMU_PACKED; - /* /dev/mshv */ #define MSHV_CREATE_PARTITION _IOW(MSHV_IOCTL, 0x00, struct mshv_create_partition) #define MSHV_CREATE_VP _IOW(MSHV_IOCTL, 0x01, struct mshv_create_vp) diff --git a/include/hw/hyperv/hvhdk.h b/include/hw/hyperv/hvhdk.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/hyperv/hvhdk.h +++ b/include/hw/hyperv/hvhdk.h @@ -XXX,XX +XXX,XX @@ #ifndef HW_HYPERV_HVHDK_H #define HW_HYPERV_HVHDK_H +#include "hvgdk.h" +#include "hvhdk_mini.h" + #define HV_PARTITION_SYNTHETIC_PROCESSOR_FEATURES_BANKS 1 +#define HV_VP_REGISTER_PAGE_VERSION_1 1u +#define HV_VP_REGISTER_PAGE_MAX_VECTOR_COUNT 7 struct hv_input_get_partition_property { uint64_t partition_id; @@ -XXX,XX +XXX,XX @@ typedef struct hv_input_register_intercept_result { union hv_register_intercept_result_parameters parameters; } QEMU_PACKED hv_input_register_intercept_result; +/* Flags for dirty mask of hv_vp_register_page */ +enum hv_x64_register_class_type { + HV_X64_REGISTER_CLASS_GENERAL = 0, + HV_X64_REGISTER_CLASS_IP = 1, + HV_X64_REGISTER_CLASS_XMM = 2, + HV_X64_REGISTER_CLASS_SEGMENT = 3, + HV_X64_REGISTER_CLASS_FLAGS = 4, +}; + +union hv_vp_register_page_interrupt_vectors { + uint64_t as_uint64; + struct { + uint8_t vector_count; + uint8_t vector[HV_VP_REGISTER_PAGE_MAX_VECTOR_COUNT]; + }; +}; + +struct hv_vp_register_page { + uint16_t version; + uint8_t isvalid; + uint8_t rsvdz; + uint32_t dirty; + + union { + struct { + /* General purpose registers (HV_X64_REGISTER_CLASS_GENERAL) */ + union { + struct { + uint64_t rax; + uint64_t rcx; + uint64_t rdx; + uint64_t rbx; + uint64_t rsp; + uint64_t rbp; + uint64_t rsi; + uint64_t rdi; + uint64_t r8; + uint64_t r9; + uint64_t r10; + uint64_t r11; + uint64_t r12; + uint64_t r13; + uint64_t r14; + uint64_t r15; + } QEMU_PACKED; + + uint64_t gp_registers[16]; + }; + /* Instruction pointer (HV_X64_REGISTER_CLASS_IP) */ + uint64_t rip; + /* Flags (HV_X64_REGISTER_CLASS_FLAGS) */ + uint64_t rflags; + } QEMU_PACKED; + + uint64_t registers[18]; + }; + uint8_t reserved[8]; + /* Volatile XMM registers (HV_X64_REGISTER_CLASS_XMM) */ + union { + struct { + struct hv_u128 xmm0; + struct hv_u128 xmm1; + struct hv_u128 xmm2; + struct hv_u128 xmm3; + struct hv_u128 xmm4; + struct hv_u128 xmm5; + } QEMU_PACKED; + + struct hv_u128 xmm_registers[6]; + }; + /* Segment registers (HV_X64_REGISTER_CLASS_SEGMENT) */ + union { + struct { + struct hv_x64_segment_register es; + struct hv_x64_segment_register cs; + struct hv_x64_segment_register ss; + struct hv_x64_segment_register ds; + struct hv_x64_segment_register fs; + struct hv_x64_segment_register gs; + } QEMU_PACKED; + + struct hv_x64_segment_register segment_registers[6]; + }; + /* Misc. control registers (cannot be set via this interface) */ + uint64_t cr0; + uint64_t cr3; + uint64_t cr4; + uint64_t cr8; + uint64_t efer; + uint64_t dr7; + union hv_x64_pending_interruption_register pending_interruption; + union hv_x64_interrupt_state_register interrupt_state; + uint64_t instruction_emulation_hints; + uint64_t xfem; + + uint8_t reserved1[0x100]; + + /* Interrupts injected as part of HvCallDispatchVp. */ + union hv_vp_register_page_interrupt_vectors interrupt_vectors; +} QEMU_PACKED; + #endif /* HW_HYPERV_HVHDK_H */ -- 2.53.0 In case the call to mmap fails, we log an error and abort to signal there is something wrong with the system. Check the register page version and compare with the expected version and abort in case of a mismatch. Fixes: a173f8f170 Signed-off-by: Doru Blânzeanu <dblanzeanu@linux.microsoft.com> --- target/i386/mshv/mshv-cpu.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/target/i386/mshv/mshv-cpu.c b/target/i386/mshv/mshv-cpu.c index XXXXXXX..XXXXXXX 100644 --- a/target/i386/mshv/mshv-cpu.c +++ b/target/i386/mshv/mshv-cpu.c @@ -XXX,XX +XXX,XX @@ void mshv_arch_init_vcpu(CPUState *cpu) CPUX86State *env = &x86_cpu->env; AccelCPUState *state = cpu->accel; size_t page = HV_HYP_PAGE_SIZE, xsave_len; + void *regs_page; void *mem = qemu_memalign(page, 2 * page); int ret; X86XSaveHeader *header; @@ -XXX,XX +XXX,XX @@ void mshv_arch_init_vcpu(CPUState *cpu) > HV_HYP_PAGE_SIZE)); /* mmap the registers page */ - void *rp = mmap(NULL, page, PROT_READ | PROT_WRITE, + regs_page = mmap(NULL, page, PROT_READ | PROT_WRITE, MAP_SHARED, mshv_vcpufd(cpu), MSHV_VP_MMAP_OFFSET_REGISTERS * page); - if (rp == MAP_FAILED) { - warn_report("register page mmap failed, falling back to hypercalls: %s", - strerror(errno)); - env->regs_page = NULL; - } else { - env->regs_page = (struct hv_vp_register_page *) rp; + if (regs_page == MAP_FAILED) { + /* This shouldn't fail, so we treat it as a fatal error */ + error_report("register page mmap failed: %s", strerror(errno)); + abort(); + } + env->regs_page = (struct hv_vp_register_page *) regs_page; + + if (env->regs_page->version != HV_VP_REGISTER_PAGE_VERSION_1) { + error_report("register page version mismatch: got %u, expected %u", + env->regs_page->version, HV_VP_REGISTER_PAGE_VERSION_1); + abort(); } state->hvcall_args.base = mem; -- 2.53.0 Change `load_regs` to use the register page when it is mmapped and is valid. Eliminate the hypercall based logic and fail in case the register page is found in an unexpected state. When retrieving the special registers, there are some registers that are not present in the register page: TR, LDTR, GDTR, IDTR, CR2, APIC_BASE. As this registers are not likely to be used in an MMIO/PIO operation, and to avoid a hypercall overhead we do not retrieve them. Local testing showed no regression when using this logic. To properly retrieve all the necessary registers for each decoded operation implies having a mechanism that tracks the state of each register, which is beyond the scope of this patch series. Fixes: 40072a7391 Signed-off-by: Doru Blânzeanu <dblanzeanu@linux.microsoft.com> --- target/i386/mshv/mshv-cpu.c | 107 +++++++++++------------------------- 1 file changed, 31 insertions(+), 76 deletions(-) diff --git a/target/i386/mshv/mshv-cpu.c b/target/i386/mshv/mshv-cpu.c index XXXXXXX..XXXXXXX 100644 --- a/target/i386/mshv/mshv-cpu.c +++ b/target/i386/mshv/mshv-cpu.c @@ -XXX,XX +XXX,XX @@ static int get_xc_reg(CPUState *cpu) return 0; } -static enum hv_register_name NON_VP_PAGE_REGISTER_NAMES[6] = { - HV_X64_REGISTER_TR, - HV_X64_REGISTER_LDTR, - HV_X64_REGISTER_GDTR, - HV_X64_REGISTER_IDTR, - HV_X64_REGISTER_CR2, - HV_X64_REGISTER_APIC_BASE, -}; - static int translate_gva(const CPUState *cpu, uint64_t gva, uint64_t *gpa, uint64_t flags) { @@ -XXX,XX +XXX,XX @@ static void populate_special_regs(const hv_register_assoc *assocs, cpu_set_apic_base(x86cpu->apic_state, assocs[16].value.reg64); } -static void mshv_get_standard_regs_vp_page(CPUState *cpu) +static void get_standard_regs_vp_page(CPUState *cpu) { X86CPU *x86cpu = X86_CPU(cpu); CPUX86State *env = &x86cpu->env; @@ -XXX,XX +XXX,XX @@ static void mshv_get_standard_regs_vp_page(CPUState *cpu) rflags_to_lflags(env); } -static int mshv_get_special_regs_vp_page(CPUState *cpu) +/* + * This function synchronizes the special registers present in the + * register vp page, which are not all the special registers. + * The rest of the special registers (LD, TR, GDT, IDT, CR2, APIC_BASE) + * are not synchronized to avoid the overhead of a hypercall. + * + * These special registers are not normally used by the guest, + * and are only used in some specific cases. + */ +static void get_special_regs_vp_page(CPUState *cpu) { X86CPU *x86cpu = X86_CPU(cpu); CPUX86State *env = &x86cpu->env; - struct hv_register_assoc assocs[ARRAY_SIZE(NON_VP_PAGE_REGISTER_NAMES)]; - int ret; - size_t n_regs = ARRAY_SIZE(NON_VP_PAGE_REGISTER_NAMES); hv_x64_segment_register seg; /* Populate special registers that are in the VP register page */ @@ -XXX,XX +XXX,XX @@ static int mshv_get_special_regs_vp_page(CPUState *cpu) populate_segment_reg(&seg, &env->segs[R_FS]); memcpy(&seg, &env->regs_page->gs, sizeof(hv_x64_segment_register)); populate_segment_reg(&seg, &env->segs[R_GS]); - - /* The rest of the special registers that are not in the VP register page */ - for (size_t i = 0; i < n_regs; i++) { - assocs[i].name = NON_VP_PAGE_REGISTER_NAMES[i]; - } - - ret = mshv_get_generic_regs(cpu, assocs, n_regs); - if (ret < 0) { - error_report("failed to get non-vp-page special registers"); - return -1; - } - - /* Non-VP page registers - TR, LDTR, GDTR, IDTR, CR2, APIC_BASE */ - populate_segment_reg(&assocs[0].value.segment, &env->tr); - populate_segment_reg(&assocs[1].value.segment, &env->ldt); - - populate_table_reg(&assocs[2].value.table, &env->gdt); - populate_table_reg(&assocs[3].value.table, &env->idt); - env->cr[2] = assocs[4].value.reg64; - - cpu_set_apic_base(x86cpu->apic_state, assocs[5].value.reg64); - - return ret; } -static int mshv_get_registers_vp_page(CPUState *cpu) +static void get_registers_vp_page(CPUState *cpu) { - int ret; - /* General Purpose Registers */ - mshv_get_standard_regs_vp_page(cpu); + get_standard_regs_vp_page(cpu); - /* Special Registers - makes a hypercall */ - ret = mshv_get_special_regs_vp_page(cpu); - if (ret < 0) { - error_report("failed to get special registers for vp page"); - return -1; - } - - return 0; + /* Special Registers */ + get_special_regs_vp_page(cpu); } @@ -XXX,XX +XXX,XX @@ static int get_special_regs(CPUState *cpu) return 0; } -static int load_regs(CPUState *cpu) +static void load_regs(CPUState *cpu) { X86CPU *x86_cpu = X86_CPU(cpu); CPUX86State *env = &x86_cpu->env; - int ret; - - /* Use register vp page to optimize registers access */ - if (env->regs_page && env->regs_page->isvalid != 0) { - ret = mshv_get_registers_vp_page(cpu); - return ret; - } - ret = get_standard_regs(cpu); - if (ret < 0) { - return ret; + /* Check register page pointer and abort if in unexpected state */ + if (!env->regs_page) { + error_report( + "load regs: register page not set for vcpu %d", + cpu->cpu_index); + abort(); } - - ret = get_special_regs(cpu); - if (ret < 0) { - return ret; + if (env->regs_page->isvalid == 0) { + error_report( + "load regs: register page invalid for vcpu %d", + cpu->cpu_index); + abort(); } - return 0; + get_registers_vp_page(cpu); } static int get_vcpu_events(CPUState *cpu) @@ -XXX,XX +XXX,XX @@ static int emulate_instruction(CPUState *cpu, int ret; x86_insn_stream stream = { .bytes = insn_bytes, .len = insn_len }; - ret = load_regs(cpu); - if (ret < 0) { - error_report("Failed to load registers"); - return -1; - } + load_regs(cpu); decode_instruction_stream(env, &decode, &stream); exec_instruction(env, &decode); @@ -XXX,XX +XXX,XX @@ static int handle_pio_str(CPUState *cpu, hv_x64_io_port_intercept_message *info) X86CPU *x86_cpu = X86_CPU(cpu); CPUX86State *env = &x86_cpu->env; - ret = load_regs(cpu); - if (ret < 0) { - error_report("Failed to load registers"); - return -1; - } + load_regs(cpu); direction_flag = (env->eflags & DESC_E_MASK) != 0; @@ -XXX,XX +XXX,XX @@ static void read_segment_descriptor(CPUState *cpu, /* * SegmentCache stores the hypervisor-provided value verbatim (populated by - * mshv_load_regs). We need to convert it to format expected by the + * load_regs). We need to convert it to format expected by the * instruction emulator. We can have a limit value > 0xfffff with * granularity of 0 (byte granularity), which is not representable * in real x86_segment_descriptor. In this case we set granularity to 1 -- 2.53.0 Update `store_regs` to use the register page when it is mmapped and valid to set registers. Remove the ioctl based register retrieval and fail in case the register page is not correctly set or valid. Fixes: 80c7f8e9cd Signed-off-by: Doru Blânzeanu <dblanzeanu@linux.microsoft.com> --- target/i386/mshv/mshv-cpu.c | 48 +++++++++++++------------------------ 1 file changed, 17 insertions(+), 31 deletions(-) diff --git a/target/i386/mshv/mshv-cpu.c b/target/i386/mshv/mshv-cpu.c index XXXXXXX..XXXXXXX 100644 --- a/target/i386/mshv/mshv-cpu.c +++ b/target/i386/mshv/mshv-cpu.c @@ -XXX,XX +XXX,XX @@ static int set_standard_regs(const CPUState *cpu) return 0; } -static void mshv_set_standard_regs_vp_page(CPUState *cpu) +static void set_standard_regs_vp_page(CPUState *cpu) { X86CPU *x86cpu = X86_CPU(cpu); CPUX86State *env = &x86cpu->env; @@ -XXX,XX +XXX,XX @@ static void mshv_set_standard_regs_vp_page(CPUState *cpu) | (1u << HV_X64_REGISTER_CLASS_FLAGS); } -static int store_regs(CPUState *cpu) +static void store_regs(CPUState *cpu) { X86CPU *x86cpu = X86_CPU(cpu); CPUX86State *env = &x86cpu->env; - int ret; - /* Use register vp page to optimize registers access */ - if (env->regs_page && env->regs_page->isvalid != 0) { - mshv_set_standard_regs_vp_page(cpu); - } else { - ret = set_standard_regs(cpu); - if (ret < 0) { - return ret; - } + /* Check register page pointer and abort if in unexpected state */ + if (!env->regs_page) { + error_report( + "store regs: register page not set for vcpu %d", + cpu->cpu_index); + abort(); } - - ret = set_special_regs(cpu); - if (ret < 0) { - error_report("Failed to store speical registers"); - return ret; + if (env->regs_page->isvalid == 0) { + error_report( + "store regs: register page invalid for vcpu %d", + cpu->cpu_index); + abort(); } - return 0; + set_standard_regs_vp_page(cpu); } static void populate_standard_regs(const hv_register_assoc *assocs, @@ -XXX,XX +XXX,XX @@ static int set_memory_info(const struct hyperv_message *msg, return 0; } -static int emulate_instruction(CPUState *cpu, +static void emulate_instruction(CPUState *cpu, const uint8_t *insn_bytes, size_t insn_len, uint64_t gva, uint64_t gpa) { X86CPU *x86_cpu = X86_CPU(cpu); CPUX86State *env = &x86_cpu->env; struct x86_decode decode = { 0 }; - int ret; x86_insn_stream stream = { .bytes = insn_bytes, .len = insn_len }; load_regs(cpu); @@ -XXX,XX +XXX,XX @@ static int emulate_instruction(CPUState *cpu, decode_instruction_stream(env, &decode, &stream); exec_instruction(env, &decode); - ret = store_regs(cpu); - if (ret < 0) { - error_report("failed to store registers"); - return -1; - } - - return 0; + store_regs(cpu); } static int handle_mmio(CPUState *cpu, const struct hyperv_message *msg, @@ -XXX,XX +XXX,XX @@ static int handle_mmio(CPUState *cpu, const struct hyperv_message *msg, instruction_bytes = info.instruction_bytes; - ret = emulate_instruction(cpu, instruction_bytes, insn_len, + emulate_instruction(cpu, instruction_bytes, insn_len, info.guest_virtual_address, info.guest_physical_address); - if (ret < 0) { - error_report("failed to emulate mmio"); - return -1; - } *exit_reason = MshvVmExitIgnore; -- 2.53.0 When a device handler (e.g. vmport) calls cpu_synchronize_state() during I/O port dispatch, it sets cpu->accel->dirty = true and may modify registers directly in env. The old PIO code ignored this: it unconditionally wrote the stale info->rax from the VM-exit intercept message back to the hypervisor and then cleared dirty, discarding any register changes made by the device. Bifurcate both handlers on cpu->accel->dirty: handle_pio_non_str: - dirty path: update env->eip directly. For reads (IN), merge the I/O result into env->regs[R_EAX] (which may have been modified by the device) rather than info->rax. For writes (OUT), leave RAX untouched. Flush all registers via mshv_store_regs() and clear dirty. - non-dirty path: write RIP and RAX via set_x64_registers hypercall as before. handle_pio_str: - dirty path: update env->eip and the appropriate index register (RSI for OUTS, RDI for INS) directly. Flush via mshv_store_regs() and clear dirty. - non-dirty path: write the index register and RIP via set_x64_registers. Drop the RAX assignment that was here before; string I/O does not modify RAX, and set_x64_registers is hardcoded to write only 2 registers so the third slot was silently ignored anyway. Remove the unconditional "cpu->accel->dirty = false" at the end of both handlers. In the non-dirty fast path it was redundant (already false). In the dirty path it was actively harmful: it told the vcpu run loop that env was clean when it was not, losing the device's modifications. Signed-off-by: Doru Blânzeanu <dblanzeanu@linux.microsoft.com> --- target/i386/mshv/mshv-cpu.c | 74 +++++++++++++++++++++++++------------ 1 file changed, 51 insertions(+), 23 deletions(-) diff --git a/target/i386/mshv/mshv-cpu.c b/target/i386/mshv/mshv-cpu.c index XXXXXXX..XXXXXXX 100644 --- a/target/i386/mshv/mshv-cpu.c +++ b/target/i386/mshv/mshv-cpu.c @@ -XXX,XX +XXX,XX @@ static int pio_write(uint64_t port, const uint8_t *data, uintptr_t size, return ret; } -static int handle_pio_non_str(const CPUState *cpu, +static int handle_pio_non_str(CPUState *cpu, hv_x64_io_port_intercept_message *info) { size_t len = info->access_info.access_size; @@ -XXX,XX +XXX,XX @@ static int handle_pio_non_str(const CPUState *cpu, uint32_t val, eax; const uint32_t eax_mask = 0xffffffffu >> (32 - len * 8); size_t insn_len; - uint64_t rip, rax; + uint64_t rip; uint32_t reg_names[2]; uint64_t reg_values[2]; uint16_t port = info->port_number; + X86CPU *x86_cpu = X86_CPU(cpu); + CPUX86State *env = &x86_cpu->env; if (access_type == HV_X64_INTERCEPT_ACCESS_TYPE_WRITE) { union { @@ -XXX,XX +XXX,XX @@ static int handle_pio_non_str(const CPUState *cpu, /* Advance RIP and update RAX */ rip = info->header.rip + insn_len; - rax = info->rax; - reg_names[0] = HV_X64_REGISTER_RIP; - reg_values[0] = rip; - reg_names[1] = HV_X64_REGISTER_RAX; - reg_values[1] = rax; + if (cpu->accel->dirty) { + env->eip = rip; + if (access_type != HV_X64_INTERCEPT_ACCESS_TYPE_WRITE) { + /* + * For reads, merge the I/O result into the current RAX. + * Use env->regs[R_EAX] as the base since a device handler + * (e.g. vmport) may have called cpu_synchronize_state() + * and modified registers. + */ + eax = (((uint32_t)env->regs[R_EAX]) & ~eax_mask) + | (val & eax_mask); + env->regs[R_EAX] = (uint64_t)eax; + } + /* Sync modified standard registers back and clear dirty. */ + store_regs(cpu); + cpu->accel->dirty = false; + } else { + reg_names[0] = HV_X64_REGISTER_RIP; + reg_values[0] = rip; + reg_names[1] = HV_X64_REGISTER_RAX; + reg_values[1] = info->rax; - ret = set_x64_registers(cpu, reg_names, reg_values); - if (ret < 0) { - error_report("Failed to set x64 registers"); - return -1; + ret = set_x64_registers(cpu, reg_names, reg_values); + if (ret < 0) { + error_report("Failed to set x64 registers"); + return -1; + } } - cpu->accel->dirty = false; - return 0; } @@ -XXX,XX +XXX,XX @@ static int handle_pio_str(CPUState *cpu, hv_x64_io_port_intercept_message *info) bool repop = info->access_info.rep_prefix == 1; size_t repeat = repop ? info->rcx : 1; size_t insn_len = info->header.instruction_length; + uint64_t rip; bool direction_flag; uint32_t reg_names[3]; uint64_t reg_values[3]; @@ -XXX,XX +XXX,XX @@ static int handle_pio_str(CPUState *cpu, hv_x64_io_port_intercept_message *info) reg_values[0] = info->rdi; } - reg_names[1] = HV_X64_REGISTER_RIP; - reg_values[1] = info->header.rip + insn_len; - reg_names[2] = HV_X64_REGISTER_RAX; - reg_values[2] = info->rax; + rip = info->header.rip + insn_len; - ret = set_x64_registers(cpu, reg_names, reg_values); - if (ret < 0) { - error_report("Failed to set RIP and RAX registers"); - return -1; - } + if (cpu->accel->dirty) { + env->eip = rip; + if (access_type == HV_X64_INTERCEPT_ACCESS_TYPE_WRITE) { + env->regs[R_ESI] = info->rsi; + } else { + env->regs[R_EDI] = info->rdi; + } + /* Sync modified standard registers back and clear dirty. */ + store_regs(cpu); + cpu->accel->dirty = false; + } else { + reg_names[1] = HV_X64_REGISTER_RIP; + reg_values[1] = rip; - cpu->accel->dirty = false; + ret = set_x64_registers(cpu, reg_names, reg_values); + if (ret < 0) { + error_report("Failed to set x64 registers"); + return -1; + } + } return 0; } -- 2.53.0 This patch series is a fix for the recent merge of the outdated patch series: https://lore.kernel.org/all/20260428135053.251200-1-dblanzeanu@linux.microsoft.com/ The above patch series had some newer versions that fixed addressed feedback from reviewers. The commits do the following: 1. Moves the definition for the `hv_vp_register_page` to `hvhdk.h` Fixes: 8afb40b7fe 2. Changes the register page setup to fail in case the mmap of the page fails. This way it signals an issue early. Fixes: a173f8f170 3. Rename functions local to the `mshv-cpu.c` linked to register page get. Use the register page to read registers on VM exit. General purpose registers, RIP, RFLAGS, segment registers, and control registers (CR0, CR4, CR4, CR8, EFER) are read directly from the page. Registers not present on the page (TR, LDTR, GDTR, IDTR, CR2, APIC_BASE) are not fetched anymore for performance reasons. Removes the fallback to ioctls in case the register page is not correctly set up and aborts. Fixes: 40072a7391 4. Changes the registers storing to only use the register page and not rely on ioctls for perfomance improvements. From local tests, the special registers that are not stored, do not get modified when emulating. However, if there's an issue discovered, we'll fix later. Fixes: 80c7f8e9cd 5. When a device handler (e.g. vmport) calls cpu_synchronize_state() during I/O port dispatch, it sets cpu->accel->dirty = true and may modify registers directly in env. The old PIO code ignored this: it unconditionally wrote the stale info->rax from the VM-exit intercept message back to the hypervisor and then cleared dirty, discarding any register changes made by the device. Note: This was a change present in version 3 of the patch series but not present in the version 1 of the patch series (the one merged) The register page is only used when it has been successfully mmapped and the hypervisor has marked it as valid (`isvalid != 0`). Otherwise, an error is returned and execution aborted to signal something faulty and unexpected. Changes since v1: - Rebased on latest master to fix a merge conflict coming from the elimination of the accel specific dirty field -----BEGIN SSH SIGNATURE----- U1NIU0lHAAAAAQAAAE0AAAAac2stc3NoLWVkMjU1MTlAb3BlbnNzaC5jb20AAAAgF4l9Pi ZyIMDy0ZI4SCYaMCvjXS3h6Dpo3xDFvSh0I7oAAAAHc3NoOmdpdAAAAANnaXQAAAAAAAAA BnNoYTUxMgAAAGcAAAAac2stc3NoLWVkMjU1MTlAb3BlbnNzaC5jb20AAABA4egRAbnGLI XkdzHMqxAMQj1wQNIw+Ja9we8xUkEiJW96FaummDyD2h2TxplwF93KnWYW/sUYZMX5b1C3 3OOcBgUAACUF -----END SSH SIGNATURE----- -----BEGIN SSH SIGNATURE----- U1NIU0lHAAAAAQAAAE0AAAAac2stc3NoLWVkMjU1MTlAb3BlbnNzaC5jb20AAAAgF4l9Pi ZyIMDy0ZI4SCYaMCvjXS3h6Dpo3xDFvSh0I7oAAAAHc3NoOmdpdAAAAANnaXQAAAAAAAAA BnNoYTUxMgAAAGcAAAAac2stc3NoLWVkMjU1MTlAb3BlbnNzaC5jb20AAABAqkJRImazba 3Xjj17Hi7FDcJ5XC7f+rFXUvDc58gax1GyCHtOu16ldDx3ldSi2Zl8iGFtauFsLHRAdPpK IoPyDAUAACUR -----END SSH SIGNATURE----- -----BEGIN SSH SIGNATURE----- U1NIU0lHAAAAAQAAAE0AAAAac2stc3NoLWVkMjU1MTlAb3BlbnNzaC5jb20AAAAgF4l9Pi ZyIMDy0ZI4SCYaMCvjXS3h6Dpo3xDFvSh0I7oAAAAHc3NoOmdpdAAAAANnaXQAAAAAAAAA BnNoYTUxMgAAAGcAAAAac2stc3NoLWVkMjU1MTlAb3BlbnNzaC5jb20AAABAJ1tI5FyxL+ GZ8gHzwMy4Bvk3bYniUpXhdKF+Y41Ec6aSaK92zZEILSBmpioCBTjawsYF7/0Gqju5Ukjg Fai0CQUAACV5 -----END SSH SIGNATURE----- Doru Blânzeanu (5): include/hw/hyperv: move hv_vp_register_page struct definition target/i386/mshv: abort when hv_vp_register_page setup fails target/i386/mshv: remove fallback for register page get registers target/i386/mshv: remove fallback for register page set registers target/i386/mshv: fix pio handlers clobbering device-modified registers include/hw/hyperv/hvgdk.h | 2 + include/hw/hyperv/hvgdk_mini.h | 103 -------------- include/hw/hyperv/hvhdk.h | 106 ++++++++++++++ target/i386/mshv/mshv-cpu.c | 247 +++++++++++++++------------------ 4 files changed, 219 insertions(+), 239 deletions(-) -- 2.53.0 Move the `hv_vp_register_page` structure definition from `hvgdk_mini.h` to `hvhdk.h`. Fixes: 8afb40b7fe Signed-off-by: Doru Blânzeanu <dblanzeanu@linux.microsoft.com> --- include/hw/hyperv/hvgdk.h | 2 + include/hw/hyperv/hvgdk_mini.h | 103 -------------------------------- include/hw/hyperv/hvhdk.h | 106 +++++++++++++++++++++++++++++++++ 3 files changed, 108 insertions(+), 103 deletions(-) diff --git a/include/hw/hyperv/hvgdk.h b/include/hw/hyperv/hvgdk.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/hyperv/hvgdk.h +++ b/include/hw/hyperv/hvgdk.h @@ -XXX,XX +XXX,XX @@ #ifndef HW_HYPERV_HVGDK_H #define HW_HYPERV_HVGDK_H +#include "hvgdk_mini.h" + #define HVGDK_H_VERSION (25125) enum hv_unimplemented_msr_action { diff --git a/include/hw/hyperv/hvgdk_mini.h b/include/hw/hyperv/hvgdk_mini.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/hyperv/hvgdk_mini.h +++ b/include/hw/hyperv/hvgdk_mini.h @@ -XXX,XX +XXX,XX @@ struct hv_input_assert_virtual_interrupt { uint16_t rsvd_z1; } QEMU_PACKED; -/* Flags for dirty mask of hv_vp_register_page */ -enum hv_x64_register_class_type { - HV_X64_REGISTER_CLASS_GENERAL = 0, - HV_X64_REGISTER_CLASS_IP = 1, - HV_X64_REGISTER_CLASS_XMM = 2, - HV_X64_REGISTER_CLASS_SEGMENT = 3, - HV_X64_REGISTER_CLASS_FLAGS = 4, -}; - -#define HV_VP_REGISTER_PAGE_MAX_VECTOR_COUNT 7 - -union hv_vp_register_page_interrupt_vectors { - uint64_t as_uint64; - struct { - uint8_t vector_count; - uint8_t vector[HV_VP_REGISTER_PAGE_MAX_VECTOR_COUNT]; - }; -}; - -struct hv_vp_register_page { - uint16_t version; - uint8_t isvalid; - uint8_t rsvdz; - uint32_t dirty; - - union { - struct { - /* General purpose registers (HV_X64_REGISTER_CLASS_GENERAL) */ - union { - struct { - uint64_t rax; - uint64_t rcx; - uint64_t rdx; - uint64_t rbx; - uint64_t rsp; - uint64_t rbp; - uint64_t rsi; - uint64_t rdi; - uint64_t r8; - uint64_t r9; - uint64_t r10; - uint64_t r11; - uint64_t r12; - uint64_t r13; - uint64_t r14; - uint64_t r15; - } QEMU_PACKED; - - uint64_t gp_registers[16]; - }; - /* Instruction pointer (HV_X64_REGISTER_CLASS_IP) */ - uint64_t rip; - /* Flags (HV_X64_REGISTER_CLASS_FLAGS) */ - uint64_t rflags; - } QEMU_PACKED; - - uint64_t registers[18]; - }; - uint8_t reserved[8]; - /* Volatile XMM registers (HV_X64_REGISTER_CLASS_XMM) */ - union { - struct { - struct hv_u128 xmm0; - struct hv_u128 xmm1; - struct hv_u128 xmm2; - struct hv_u128 xmm3; - struct hv_u128 xmm4; - struct hv_u128 xmm5; - } QEMU_PACKED; - - struct hv_u128 xmm_registers[6]; - }; - /* Segment registers (HV_X64_REGISTER_CLASS_SEGMENT) */ - union { - struct { - struct hv_x64_segment_register es; - struct hv_x64_segment_register cs; - struct hv_x64_segment_register ss; - struct hv_x64_segment_register ds; - struct hv_x64_segment_register fs; - struct hv_x64_segment_register gs; - } QEMU_PACKED; - - struct hv_x64_segment_register segment_registers[6]; - }; - /* Misc. control registers (cannot be set via this interface) */ - uint64_t cr0; - uint64_t cr3; - uint64_t cr4; - uint64_t cr8; - uint64_t efer; - uint64_t dr7; - union hv_x64_pending_interruption_register pending_interruption; - union hv_x64_interrupt_state_register interrupt_state; - uint64_t instruction_emulation_hints; - uint64_t xfem; - - uint8_t reserved1[0x100]; - - /* Interrupts injected as part of HvCallDispatchVp. */ - union hv_vp_register_page_interrupt_vectors interrupt_vectors; -} QEMU_PACKED; - /* /dev/mshv */ #define MSHV_CREATE_PARTITION _IOW(MSHV_IOCTL, 0x00, struct mshv_create_partition) #define MSHV_CREATE_VP _IOW(MSHV_IOCTL, 0x01, struct mshv_create_vp) diff --git a/include/hw/hyperv/hvhdk.h b/include/hw/hyperv/hvhdk.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/hyperv/hvhdk.h +++ b/include/hw/hyperv/hvhdk.h @@ -XXX,XX +XXX,XX @@ #ifndef HW_HYPERV_HVHDK_H #define HW_HYPERV_HVHDK_H +#include "hvgdk.h" +#include "hvhdk_mini.h" + #define HV_PARTITION_SYNTHETIC_PROCESSOR_FEATURES_BANKS 1 +#define HV_VP_REGISTER_PAGE_VERSION_1 1u +#define HV_VP_REGISTER_PAGE_MAX_VECTOR_COUNT 7 struct hv_input_get_partition_property { uint64_t partition_id; @@ -XXX,XX +XXX,XX @@ typedef struct hv_input_register_intercept_result { union hv_register_intercept_result_parameters parameters; } QEMU_PACKED hv_input_register_intercept_result; +/* Flags for dirty mask of hv_vp_register_page */ +enum hv_x64_register_class_type { + HV_X64_REGISTER_CLASS_GENERAL = 0, + HV_X64_REGISTER_CLASS_IP = 1, + HV_X64_REGISTER_CLASS_XMM = 2, + HV_X64_REGISTER_CLASS_SEGMENT = 3, + HV_X64_REGISTER_CLASS_FLAGS = 4, +}; + +union hv_vp_register_page_interrupt_vectors { + uint64_t as_uint64; + struct { + uint8_t vector_count; + uint8_t vector[HV_VP_REGISTER_PAGE_MAX_VECTOR_COUNT]; + }; +}; + +struct hv_vp_register_page { + uint16_t version; + uint8_t isvalid; + uint8_t rsvdz; + uint32_t dirty; + + union { + struct { + /* General purpose registers (HV_X64_REGISTER_CLASS_GENERAL) */ + union { + struct { + uint64_t rax; + uint64_t rcx; + uint64_t rdx; + uint64_t rbx; + uint64_t rsp; + uint64_t rbp; + uint64_t rsi; + uint64_t rdi; + uint64_t r8; + uint64_t r9; + uint64_t r10; + uint64_t r11; + uint64_t r12; + uint64_t r13; + uint64_t r14; + uint64_t r15; + } QEMU_PACKED; + + uint64_t gp_registers[16]; + }; + /* Instruction pointer (HV_X64_REGISTER_CLASS_IP) */ + uint64_t rip; + /* Flags (HV_X64_REGISTER_CLASS_FLAGS) */ + uint64_t rflags; + } QEMU_PACKED; + + uint64_t registers[18]; + }; + uint8_t reserved[8]; + /* Volatile XMM registers (HV_X64_REGISTER_CLASS_XMM) */ + union { + struct { + struct hv_u128 xmm0; + struct hv_u128 xmm1; + struct hv_u128 xmm2; + struct hv_u128 xmm3; + struct hv_u128 xmm4; + struct hv_u128 xmm5; + } QEMU_PACKED; + + struct hv_u128 xmm_registers[6]; + }; + /* Segment registers (HV_X64_REGISTER_CLASS_SEGMENT) */ + union { + struct { + struct hv_x64_segment_register es; + struct hv_x64_segment_register cs; + struct hv_x64_segment_register ss; + struct hv_x64_segment_register ds; + struct hv_x64_segment_register fs; + struct hv_x64_segment_register gs; + } QEMU_PACKED; + + struct hv_x64_segment_register segment_registers[6]; + }; + /* Misc. control registers (cannot be set via this interface) */ + uint64_t cr0; + uint64_t cr3; + uint64_t cr4; + uint64_t cr8; + uint64_t efer; + uint64_t dr7; + union hv_x64_pending_interruption_register pending_interruption; + union hv_x64_interrupt_state_register interrupt_state; + uint64_t instruction_emulation_hints; + uint64_t xfem; + + uint8_t reserved1[0x100]; + + /* Interrupts injected as part of HvCallDispatchVp. */ + union hv_vp_register_page_interrupt_vectors interrupt_vectors; +} QEMU_PACKED; + #endif /* HW_HYPERV_HVHDK_H */ -- 2.53.0 In case the call to mmap fails, we log an error and abort to signal there is something wrong with the system. Check the register page version and compare with the expected version and abort in case of a mismatch. Fixes: a173f8f170 Signed-off-by: Doru Blânzeanu <dblanzeanu@linux.microsoft.com> --- target/i386/mshv/mshv-cpu.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/target/i386/mshv/mshv-cpu.c b/target/i386/mshv/mshv-cpu.c index XXXXXXX..XXXXXXX 100644 --- a/target/i386/mshv/mshv-cpu.c +++ b/target/i386/mshv/mshv-cpu.c @@ -XXX,XX +XXX,XX @@ void mshv_arch_init_vcpu(CPUState *cpu) CPUX86State *env = &x86_cpu->env; AccelCPUState *state = cpu->accel; size_t page = HV_HYP_PAGE_SIZE, xsave_len; + void *regs_page; void *mem = qemu_memalign(page, 2 * page); int ret; X86XSaveHeader *header; @@ -XXX,XX +XXX,XX @@ void mshv_arch_init_vcpu(CPUState *cpu) > HV_HYP_PAGE_SIZE)); /* mmap the registers page */ - void *rp = mmap(NULL, page, PROT_READ | PROT_WRITE, + regs_page = mmap(NULL, page, PROT_READ | PROT_WRITE, MAP_SHARED, mshv_vcpufd(cpu), MSHV_VP_MMAP_OFFSET_REGISTERS * page); - if (rp == MAP_FAILED) { - warn_report("register page mmap failed, falling back to hypercalls: %s", - strerror(errno)); - env->regs_page = NULL; - } else { - env->regs_page = (struct hv_vp_register_page *) rp; + if (regs_page == MAP_FAILED) { + /* This shouldn't fail, so we treat it as a fatal error */ + error_report("register page mmap failed: %s", strerror(errno)); + abort(); + } + env->regs_page = (struct hv_vp_register_page *) regs_page; + + if (env->regs_page->version != HV_VP_REGISTER_PAGE_VERSION_1) { + error_report("register page version mismatch: got %u, expected %u", + env->regs_page->version, HV_VP_REGISTER_PAGE_VERSION_1); + abort(); } state->hvcall_args.base = mem; -- 2.53.0 Change `load_regs` to use the register page when it is mmapped and is valid. Eliminate the hypercall based logic and fail in case the register page is found in an unexpected state. When retrieving the special registers, there are some registers that are not present in the register page: TR, LDTR, GDTR, IDTR, CR2, APIC_BASE. As this registers are not likely to be used in an MMIO/PIO operation, and to avoid a hypercall overhead we do not retrieve them. Local testing showed no regression when using this logic. To properly retrieve all the necessary registers for each decoded operation implies having a mechanism that tracks the state of each register, which is beyond the scope of this patch series. Fixes: 40072a7391 Signed-off-by: Doru Blânzeanu <dblanzeanu@linux.microsoft.com> --- target/i386/mshv/mshv-cpu.c | 107 +++++++++++------------------------- 1 file changed, 31 insertions(+), 76 deletions(-) diff --git a/target/i386/mshv/mshv-cpu.c b/target/i386/mshv/mshv-cpu.c index XXXXXXX..XXXXXXX 100644 --- a/target/i386/mshv/mshv-cpu.c +++ b/target/i386/mshv/mshv-cpu.c @@ -XXX,XX +XXX,XX @@ static int get_xc_reg(CPUState *cpu) return 0; } -static enum hv_register_name NON_VP_PAGE_REGISTER_NAMES[6] = { - HV_X64_REGISTER_TR, - HV_X64_REGISTER_LDTR, - HV_X64_REGISTER_GDTR, - HV_X64_REGISTER_IDTR, - HV_X64_REGISTER_CR2, - HV_X64_REGISTER_APIC_BASE, -}; - static int translate_gva(const CPUState *cpu, uint64_t gva, uint64_t *gpa, uint64_t flags) { @@ -XXX,XX +XXX,XX @@ static void populate_special_regs(const hv_register_assoc *assocs, cpu_set_apic_base(x86cpu->apic_state, assocs[16].value.reg64); } -static void mshv_get_standard_regs_vp_page(CPUState *cpu) +static void get_standard_regs_vp_page(CPUState *cpu) { X86CPU *x86cpu = X86_CPU(cpu); CPUX86State *env = &x86cpu->env; @@ -XXX,XX +XXX,XX @@ static void mshv_get_standard_regs_vp_page(CPUState *cpu) rflags_to_lflags(env); } -static int mshv_get_special_regs_vp_page(CPUState *cpu) +/* + * This function synchronizes the special registers present in the + * register vp page, which are not all the special registers. + * The rest of the special registers (LD, TR, GDT, IDT, CR2, APIC_BASE) + * are not synchronized to avoid the overhead of a hypercall. + * + * These special registers are not normally used by the guest, + * and are only used in some specific cases. + */ +static void get_special_regs_vp_page(CPUState *cpu) { X86CPU *x86cpu = X86_CPU(cpu); CPUX86State *env = &x86cpu->env; - struct hv_register_assoc assocs[ARRAY_SIZE(NON_VP_PAGE_REGISTER_NAMES)]; - int ret; - size_t n_regs = ARRAY_SIZE(NON_VP_PAGE_REGISTER_NAMES); hv_x64_segment_register seg; /* Populate special registers that are in the VP register page */ @@ -XXX,XX +XXX,XX @@ static int mshv_get_special_regs_vp_page(CPUState *cpu) populate_segment_reg(&seg, &env->segs[R_FS]); memcpy(&seg, &env->regs_page->gs, sizeof(hv_x64_segment_register)); populate_segment_reg(&seg, &env->segs[R_GS]); - - /* The rest of the special registers that are not in the VP register page */ - for (size_t i = 0; i < n_regs; i++) { - assocs[i].name = NON_VP_PAGE_REGISTER_NAMES[i]; - } - - ret = mshv_get_generic_regs(cpu, assocs, n_regs); - if (ret < 0) { - error_report("failed to get non-vp-page special registers"); - return -1; - } - - /* Non-VP page registers - TR, LDTR, GDTR, IDTR, CR2, APIC_BASE */ - populate_segment_reg(&assocs[0].value.segment, &env->tr); - populate_segment_reg(&assocs[1].value.segment, &env->ldt); - - populate_table_reg(&assocs[2].value.table, &env->gdt); - populate_table_reg(&assocs[3].value.table, &env->idt); - env->cr[2] = assocs[4].value.reg64; - - cpu_set_apic_base(x86cpu->apic_state, assocs[5].value.reg64); - - return ret; } -static int mshv_get_registers_vp_page(CPUState *cpu) +static void get_registers_vp_page(CPUState *cpu) { - int ret; - /* General Purpose Registers */ - mshv_get_standard_regs_vp_page(cpu); + get_standard_regs_vp_page(cpu); - /* Special Registers - makes a hypercall */ - ret = mshv_get_special_regs_vp_page(cpu); - if (ret < 0) { - error_report("failed to get special registers for vp page"); - return -1; - } - - return 0; + /* Special Registers */ + get_special_regs_vp_page(cpu); } @@ -XXX,XX +XXX,XX @@ static int get_special_regs(CPUState *cpu) return 0; } -static int load_regs(CPUState *cpu) +static void load_regs(CPUState *cpu) { X86CPU *x86_cpu = X86_CPU(cpu); CPUX86State *env = &x86_cpu->env; - int ret; - - /* Use register vp page to optimize registers access */ - if (env->regs_page && env->regs_page->isvalid != 0) { - ret = mshv_get_registers_vp_page(cpu); - return ret; - } - ret = get_standard_regs(cpu); - if (ret < 0) { - return ret; + /* Check register page pointer and abort if in unexpected state */ + if (!env->regs_page) { + error_report( + "load regs: register page not set for vcpu %d", + cpu->cpu_index); + abort(); } - - ret = get_special_regs(cpu); - if (ret < 0) { - return ret; + if (env->regs_page->isvalid == 0) { + error_report( + "load regs: register page invalid for vcpu %d", + cpu->cpu_index); + abort(); } - return 0; + get_registers_vp_page(cpu); } static int get_vcpu_events(CPUState *cpu) @@ -XXX,XX +XXX,XX @@ static int emulate_instruction(CPUState *cpu, int ret; x86_insn_stream stream = { .bytes = insn_bytes, .len = insn_len }; - ret = load_regs(cpu); - if (ret < 0) { - error_report("Failed to load registers"); - return -1; - } + load_regs(cpu); decode_instruction_stream(env, &decode, &stream); exec_instruction(env, &decode); @@ -XXX,XX +XXX,XX @@ static int handle_pio_str(CPUState *cpu, hv_x64_io_port_intercept_message *info) X86CPU *x86_cpu = X86_CPU(cpu); CPUX86State *env = &x86_cpu->env; - ret = load_regs(cpu); - if (ret < 0) { - error_report("Failed to load registers"); - return -1; - } + load_regs(cpu); direction_flag = (env->eflags & DESC_E_MASK) != 0; @@ -XXX,XX +XXX,XX @@ static void read_segment_descriptor(CPUState *cpu, /* * SegmentCache stores the hypervisor-provided value verbatim (populated by - * mshv_load_regs). We need to convert it to format expected by the + * load_regs). We need to convert it to format expected by the * instruction emulator. We can have a limit value > 0xfffff with * granularity of 0 (byte granularity), which is not representable * in real x86_segment_descriptor. In this case we set granularity to 1 -- 2.53.0 Update `store_regs` to use the register page when it is mmapped and valid to set registers. Remove the ioctl based register retrieval and fail in case the register page is not correctly set or valid. Fixes: 80c7f8e9cd Signed-off-by: Doru Blânzeanu <dblanzeanu@linux.microsoft.com> --- target/i386/mshv/mshv-cpu.c | 48 +++++++++++++------------------------ 1 file changed, 17 insertions(+), 31 deletions(-) diff --git a/target/i386/mshv/mshv-cpu.c b/target/i386/mshv/mshv-cpu.c index XXXXXXX..XXXXXXX 100644 --- a/target/i386/mshv/mshv-cpu.c +++ b/target/i386/mshv/mshv-cpu.c @@ -XXX,XX +XXX,XX @@ static int set_standard_regs(const CPUState *cpu) return 0; } -static void mshv_set_standard_regs_vp_page(CPUState *cpu) +static void set_standard_regs_vp_page(CPUState *cpu) { X86CPU *x86cpu = X86_CPU(cpu); CPUX86State *env = &x86cpu->env; @@ -XXX,XX +XXX,XX @@ static void mshv_set_standard_regs_vp_page(CPUState *cpu) | (1u << HV_X64_REGISTER_CLASS_FLAGS); } -static int store_regs(CPUState *cpu) +static void store_regs(CPUState *cpu) { X86CPU *x86cpu = X86_CPU(cpu); CPUX86State *env = &x86cpu->env; - int ret; - /* Use register vp page to optimize registers access */ - if (env->regs_page && env->regs_page->isvalid != 0) { - mshv_set_standard_regs_vp_page(cpu); - } else { - ret = set_standard_regs(cpu); - if (ret < 0) { - return ret; - } + /* Check register page pointer and abort if in unexpected state */ + if (!env->regs_page) { + error_report( + "store regs: register page not set for vcpu %d", + cpu->cpu_index); + abort(); } - - ret = set_special_regs(cpu); - if (ret < 0) { - error_report("Failed to store speical registers"); - return ret; + if (env->regs_page->isvalid == 0) { + error_report( + "store regs: register page invalid for vcpu %d", + cpu->cpu_index); + abort(); } - return 0; + set_standard_regs_vp_page(cpu); } static void populate_standard_regs(const hv_register_assoc *assocs, @@ -XXX,XX +XXX,XX @@ static int set_memory_info(const struct hyperv_message *msg, return 0; } -static int emulate_instruction(CPUState *cpu, +static void emulate_instruction(CPUState *cpu, const uint8_t *insn_bytes, size_t insn_len, uint64_t gva, uint64_t gpa) { X86CPU *x86_cpu = X86_CPU(cpu); CPUX86State *env = &x86_cpu->env; struct x86_decode decode = { 0 }; - int ret; x86_insn_stream stream = { .bytes = insn_bytes, .len = insn_len }; load_regs(cpu); @@ -XXX,XX +XXX,XX @@ static int emulate_instruction(CPUState *cpu, decode_instruction_stream(env, &decode, &stream); exec_instruction(env, &decode); - ret = store_regs(cpu); - if (ret < 0) { - error_report("failed to store registers"); - return -1; - } - - return 0; + store_regs(cpu); } static int handle_mmio(CPUState *cpu, const struct hyperv_message *msg, @@ -XXX,XX +XXX,XX @@ static int handle_mmio(CPUState *cpu, const struct hyperv_message *msg, instruction_bytes = info.instruction_bytes; - ret = emulate_instruction(cpu, instruction_bytes, insn_len, + emulate_instruction(cpu, instruction_bytes, insn_len, info.guest_virtual_address, info.guest_physical_address); - if (ret < 0) { - error_report("failed to emulate mmio"); - return -1; - } *exit_reason = MshvVmExitIgnore; -- 2.53.0 When a device handler (e.g. vmport) calls cpu_synchronize_state() during I/O port dispatch, it sets cpu->accel->dirty = true and may modify registers directly in env. The old PIO code ignored this: it unconditionally wrote the stale info->rax from the VM-exit intercept message back to the hypervisor and then cleared dirty, discarding any register changes made by the device. Bifurcate both handlers on cpu->accel->dirty: handle_pio_non_str: - dirty path: update env->eip directly. For reads (IN), merge the I/O result into env->regs[R_EAX] (which may have been modified by the device) rather than info->rax. For writes (OUT), leave RAX untouched. Flush all registers via mshv_store_regs() and clear dirty. - non-dirty path: write RIP and RAX via set_x64_registers hypercall as before. handle_pio_str: - dirty path: update env->eip and the appropriate index register (RSI for OUTS, RDI for INS) directly. Flush via mshv_store_regs() and clear dirty. - non-dirty path: write the index register and RIP via set_x64_registers. Drop the RAX assignment that was here before; string I/O does not modify RAX, and set_x64_registers is hardcoded to write only 2 registers so the third slot was silently ignored anyway. Remove the unconditional "cpu->accel->dirty = false" at the end of both handlers. In the non-dirty fast path it was redundant (already false). In the dirty path it was actively harmful: it told the vcpu run loop that env was clean when it was not, losing the device's modifications. Signed-off-by: Doru Blânzeanu <dblanzeanu@linux.microsoft.com> --- target/i386/mshv/mshv-cpu.c | 72 +++++++++++++++++++++++++------------ 1 file changed, 50 insertions(+), 22 deletions(-) diff --git a/target/i386/mshv/mshv-cpu.c b/target/i386/mshv/mshv-cpu.c index XXXXXXX..XXXXXXX 100644 --- a/target/i386/mshv/mshv-cpu.c +++ b/target/i386/mshv/mshv-cpu.c @@ -XXX,XX +XXX,XX @@ static int handle_pio_non_str(CPUState *cpu, uint32_t val, eax; const uint32_t eax_mask = 0xffffffffu >> (32 - len * 8); size_t insn_len; - uint64_t rip, rax; + uint64_t rip; uint32_t reg_names[2]; uint64_t reg_values[2]; uint16_t port = info->port_number; + X86CPU *x86_cpu = X86_CPU(cpu); + CPUX86State *env = &x86_cpu->env; if (access_type == HV_X64_INTERCEPT_ACCESS_TYPE_WRITE) { union { @@ -XXX,XX +XXX,XX @@ static int handle_pio_non_str(CPUState *cpu, /* Advance RIP and update RAX */ rip = info->header.rip + insn_len; - rax = info->rax; - reg_names[0] = HV_X64_REGISTER_RIP; - reg_values[0] = rip; - reg_names[1] = HV_X64_REGISTER_RAX; - reg_values[1] = rax; + if (cpu->vcpu_dirty) { + env->eip = rip; + if (access_type != HV_X64_INTERCEPT_ACCESS_TYPE_WRITE) { + /* + * For reads, merge the I/O result into the current RAX. + * Use env->regs[R_EAX] as the base since a device handler + * (e.g. vmport) may have called cpu_synchronize_state() + * and modified registers. + */ + eax = (((uint32_t)env->regs[R_EAX]) & ~eax_mask) + | (val & eax_mask); + env->regs[R_EAX] = (uint64_t)eax; + } + /* Sync modified standard registers back and clear dirty. */ + store_regs(cpu); + cpu->vcpu_dirty = false; + } else { + reg_names[0] = HV_X64_REGISTER_RIP; + reg_values[0] = rip; + reg_names[1] = HV_X64_REGISTER_RAX; + reg_values[1] = info->rax; - ret = set_x64_registers(cpu, reg_names, reg_values); - if (ret < 0) { - error_report("Failed to set x64 registers"); - return -1; + ret = set_x64_registers(cpu, reg_names, reg_values); + if (ret < 0) { + error_report("Failed to set x64 registers"); + return -1; + } } - cpu->vcpu_dirty = false; - return 0; } @@ -XXX,XX +XXX,XX @@ static int handle_pio_str(CPUState *cpu, hv_x64_io_port_intercept_message *info) bool repop = info->access_info.rep_prefix == 1; size_t repeat = repop ? info->rcx : 1; size_t insn_len = info->header.instruction_length; + uint64_t rip; bool direction_flag; uint32_t reg_names[3]; uint64_t reg_values[3]; @@ -XXX,XX +XXX,XX @@ static int handle_pio_str(CPUState *cpu, hv_x64_io_port_intercept_message *info) reg_values[0] = info->rdi; } - reg_names[1] = HV_X64_REGISTER_RIP; - reg_values[1] = info->header.rip + insn_len; - reg_names[2] = HV_X64_REGISTER_RAX; - reg_values[2] = info->rax; + rip = info->header.rip + insn_len; - ret = set_x64_registers(cpu, reg_names, reg_values); - if (ret < 0) { - error_report("Failed to set RIP and RAX registers"); - return -1; - } + if (cpu->vcpu_dirty) { + env->eip = rip; + if (access_type == HV_X64_INTERCEPT_ACCESS_TYPE_WRITE) { + env->regs[R_ESI] = info->rsi; + } else { + env->regs[R_EDI] = info->rdi; + } + /* Sync modified standard registers back and clear dirty. */ + store_regs(cpu); + cpu->vcpu_dirty = false; + } else { + reg_names[1] = HV_X64_REGISTER_RIP; + reg_values[1] = rip; - cpu->vcpu_dirty = false; + ret = set_x64_registers(cpu, reg_names, reg_values); + if (ret < 0) { + error_report("Failed to set x64 registers"); + return -1; + } + } return 0; } -- 2.53.0