* [Qemu-devel] [PULL 1/2] target-i386: fix disassembly with PAE=1, PG=0
2013-09-12 18:28 [Qemu-devel] [PULL 0/2] Outstanding target-i386 patches Richard Henderson
@ 2013-09-12 18:28 ` Richard Henderson
2013-09-12 18:28 ` [Qemu-devel] [PULL 2/2] target-i386: Only provide CMOV and friends if feature bit set Richard Henderson
1 sibling, 0 replies; 3+ messages in thread
From: Richard Henderson @ 2013-09-12 18:28 UTC (permalink / raw)
To: qemu-devel; +Cc: Paolo Bonzini, anthony
From: Paolo Bonzini <pbonzini@redhat.com>
CR4.PAE=1 will not enable paging if CR0.PG=0, but the "if" chain
in x86_cpu_get_phys_page_debug says otherwise. Check CR0.PG
before everything else.
Fixes "-d in_asm" for a code section at the beginning of OVMF.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Max Filippov <jcmvbkbc@gmail.com>
---
target-i386/helper.c | 34 ++++++++++++++++------------------
1 file changed, 16 insertions(+), 18 deletions(-)
diff --git a/target-i386/helper.c b/target-i386/helper.c
index 7c58e27..8bf85ec 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -894,7 +894,10 @@ hwaddr x86_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
uint32_t page_offset;
int page_size;
- if (env->cr[4] & CR4_PAE_MASK) {
+ if (!(env->cr[0] & CR0_PG_MASK)) {
+ pte = addr & env->a20_mask;
+ page_size = 4096;
+ } else if (env->cr[4] & CR4_PAE_MASK) {
target_ulong pdpe_addr;
uint64_t pde, pdpe;
@@ -952,26 +955,21 @@ hwaddr x86_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
} else {
uint32_t pde;
- if (!(env->cr[0] & CR0_PG_MASK)) {
- pte = addr;
- page_size = 4096;
+ /* page directory entry */
+ pde_addr = ((env->cr[3] & ~0xfff) + ((addr >> 20) & 0xffc)) & env->a20_mask;
+ pde = ldl_phys(pde_addr);
+ if (!(pde & PG_PRESENT_MASK))
+ return -1;
+ if ((pde & PG_PSE_MASK) && (env->cr[4] & CR4_PSE_MASK)) {
+ pte = pde & ~0x003ff000; /* align to 4MB */
+ page_size = 4096 * 1024;
} else {
/* page directory entry */
- pde_addr = ((env->cr[3] & ~0xfff) + ((addr >> 20) & 0xffc)) & env->a20_mask;
- pde = ldl_phys(pde_addr);
- if (!(pde & PG_PRESENT_MASK))
+ pte_addr = ((pde & ~0xfff) + ((addr >> 10) & 0xffc)) & env->a20_mask;
+ pte = ldl_phys(pte_addr);
+ if (!(pte & PG_PRESENT_MASK))
return -1;
- if ((pde & PG_PSE_MASK) && (env->cr[4] & CR4_PSE_MASK)) {
- pte = pde & ~0x003ff000; /* align to 4MB */
- page_size = 4096 * 1024;
- } else {
- /* page directory entry */
- pte_addr = ((pde & ~0xfff) + ((addr >> 10) & 0xffc)) & env->a20_mask;
- pte = ldl_phys(pte_addr);
- if (!(pte & PG_PRESENT_MASK))
- return -1;
- page_size = 4096;
- }
+ page_size = 4096;
}
pte = pte & env->a20_mask;
}
--
1.8.1.4
^ permalink raw reply related [flat|nested] 3+ messages in thread* [Qemu-devel] [PULL 2/2] target-i386: Only provide CMOV and friends if feature bit set
2013-09-12 18:28 [Qemu-devel] [PULL 0/2] Outstanding target-i386 patches Richard Henderson
2013-09-12 18:28 ` [Qemu-devel] [PULL 1/2] target-i386: fix disassembly with PAE=1, PG=0 Richard Henderson
@ 2013-09-12 18:28 ` Richard Henderson
1 sibling, 0 replies; 3+ messages in thread
From: Richard Henderson @ 2013-09-12 18:28 UTC (permalink / raw)
To: qemu-devel; +Cc: Peter Maydell, anthony
From: Peter Maydell <peter.maydell@linaro.org>
The instructions CMOVcc, FCMOVcc and F[U]COMI[P] should only be
present if the CMOV feature bit is set. Add missing feature bit
checks so we correctly fault if emulating a 486 or 586.
This fixes bug LP:1201446.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <rth@twiddle.net>
---
target-i386/translate.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/target-i386/translate.c b/target-i386/translate.c
index 6d87900..be74ebc 100644
--- a/target-i386/translate.c
+++ b/target-i386/translate.c
@@ -6434,12 +6434,18 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
}
break;
case 0x1d: /* fucomi */
+ if (!(s->cpuid_features & CPUID_CMOV)) {
+ goto illegal_op;
+ }
gen_update_cc_op(s);
gen_helper_fmov_FT0_STN(cpu_env, tcg_const_i32(opreg));
gen_helper_fucomi_ST0_FT0(cpu_env);
set_cc_op(s, CC_OP_EFLAGS);
break;
case 0x1e: /* fcomi */
+ if (!(s->cpuid_features & CPUID_CMOV)) {
+ goto illegal_op;
+ }
gen_update_cc_op(s);
gen_helper_fmov_FT0_STN(cpu_env, tcg_const_i32(opreg));
gen_helper_fcomi_ST0_FT0(cpu_env);
@@ -6495,6 +6501,9 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
}
break;
case 0x3d: /* fucomip */
+ if (!(s->cpuid_features & CPUID_CMOV)) {
+ goto illegal_op;
+ }
gen_update_cc_op(s);
gen_helper_fmov_FT0_STN(cpu_env, tcg_const_i32(opreg));
gen_helper_fucomi_ST0_FT0(cpu_env);
@@ -6502,6 +6511,9 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
set_cc_op(s, CC_OP_EFLAGS);
break;
case 0x3e: /* fcomip */
+ if (!(s->cpuid_features & CPUID_CMOV)) {
+ goto illegal_op;
+ }
gen_update_cc_op(s);
gen_helper_fmov_FT0_STN(cpu_env, tcg_const_i32(opreg));
gen_helper_fcomi_ST0_FT0(cpu_env);
@@ -6518,6 +6530,10 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
(JCC_BE << 1),
(JCC_P << 1),
};
+
+ if (!(s->cpuid_features & CPUID_CMOV)) {
+ goto illegal_op;
+ }
op1 = fcmov_cc[op & 3] | (((op >> 3) & 1) ^ 1);
l1 = gen_new_label();
gen_jcc1_noeob(s, op1, l1);
@@ -6889,6 +6905,9 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
gen_ldst_modrm(env, s, modrm, OT_BYTE, OR_TMP0, 1);
break;
case 0x140 ... 0x14f: /* cmov Gv, Ev */
+ if (!(s->cpuid_features & CPUID_CMOV)) {
+ goto illegal_op;
+ }
ot = dflag + OT_WORD;
modrm = cpu_ldub_code(env, s->pc++);
reg = ((modrm >> 3) & 7) | rex_r;
--
1.8.1.4
^ permalink raw reply related [flat|nested] 3+ messages in thread