From: Paolo Bonzini <pbonzini@redhat.com>
To: qemu-devel@nongnu.org
Cc: Mohamed Mediouni <mohamed@unpredictable.fr>
Subject: [PULL 13/19] target/i386: emulate: segmentation rework
Date: Wed, 25 Mar 2026 17:44:47 +0100 [thread overview]
Message-ID: <20260325164453.72127-14-pbonzini@redhat.com> (raw)
In-Reply-To: <20260325164453.72127-1-pbonzini@redhat.com>
From: Mohamed Mediouni <mohamed@unpredictable.fr>
Make accesses to segments all go through read_segment_descriptor
to be able to fetch segment state on-demand.
Switch away from SegmentCache to the x86_segment_descriptor
that is already used by read_segment_descriptor.
Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
Link: https://lore.kernel.org/r/20260324151323.74473-11-mohamed@unpredictable.fr
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
target/i386/emulate/x86_helpers.c | 50 ++++++++++++-------------------
1 file changed, 19 insertions(+), 31 deletions(-)
diff --git a/target/i386/emulate/x86_helpers.c b/target/i386/emulate/x86_helpers.c
index c817015ef92..63bae3582fe 100644
--- a/target/i386/emulate/x86_helpers.c
+++ b/target/i386/emulate/x86_helpers.c
@@ -43,49 +43,37 @@ static CpuMode cpu_mode(CPUState *cpu)
return m;
}
-static bool segment_type_ro(const SegmentCache *seg)
+static bool segment_type_ro(const x86_segment_descriptor desc)
{
- uint32_t type_ = (seg->flags >> DESC_TYPE_SHIFT) & 15;
+ uint32_t type_ = desc.type;
return (type_ & (~RWRX_SEGMENT_TYPE)) == 0;
}
-static bool segment_type_code(const SegmentCache *seg)
+static bool segment_type_code(const x86_segment_descriptor desc)
{
- uint32_t type_ = (seg->flags >> DESC_TYPE_SHIFT) & 15;
+ uint32_t type_ = desc.type;
return (type_ & CODE_SEGMENT_TYPE) != 0;
}
-static bool segment_expands_down(const SegmentCache *seg)
+static bool segment_expands_down(const x86_segment_descriptor desc)
{
- uint32_t type_ = (seg->flags >> DESC_TYPE_SHIFT) & 15;
+ uint32_t type_ = desc.type;
- if (segment_type_code(seg)) {
+ if (segment_type_code(desc)) {
return false;
}
return (type_ & EXPAND_DOWN_SEGMENT_TYPE) != 0;
}
-static uint32_t segment_limit(const SegmentCache *seg)
+static uint8_t segment_db(const x86_segment_descriptor desc)
{
- uint32_t limit = seg->limit;
- uint32_t granularity = (seg->flags & DESC_G_MASK) != 0;
-
- if (granularity != 0) {
- limit = (limit << 12) | 0xFFF;
- }
-
- return limit;
+ return desc.db;
}
-static uint8_t segment_db(const SegmentCache *seg)
+static uint32_t segment_max_limit(const x86_segment_descriptor desc)
{
- return (seg->flags >> DESC_B_SHIFT) & 1;
-}
-
-static uint32_t segment_max_limit(const SegmentCache *seg)
-{
- if (segment_db(seg) != 0) {
+ if (segment_db(desc) != 0) {
return 0xFFFFFFFF;
}
return 0xFFFF;
@@ -96,15 +84,15 @@ static int linearize(CPUState *cpu,
X86Seg seg_idx)
{
enum CpuMode mode;
- X86CPU *x86_cpu = X86_CPU(cpu);
- CPUX86State *env = &x86_cpu->env;
- SegmentCache *seg = &env->segs[seg_idx];
- target_ulong base = seg->base;
+ struct x86_segment_descriptor desc;
+ target_ulong base;
target_ulong logical_addr_32b;
uint32_t limit;
/* TODO: the emulator will not pass us "write" indicator yet */
bool write = false;
+ emul_ops->read_segment_descriptor(cpu, &desc, seg_idx);
+ base = x86_segment_base(&desc);
mode = cpu_mode(cpu);
switch (mode) {
@@ -116,21 +104,21 @@ static int linearize(CPUState *cpu,
break;
case PROTECTED_MODE:
case REAL_MODE:
- if (segment_type_ro(seg) && write) {
+ if (segment_type_ro(desc) && write) {
error_report("Cannot write to read-only segment");
return -1;
}
logical_addr_32b = logical_addr & 0xFFFFFFFF;
- limit = segment_limit(seg);
+ limit = x86_segment_limit(&desc);
- if (segment_expands_down(seg)) {
+ if (segment_expands_down(desc)) {
if (logical_addr_32b >= limit) {
error_report("Address exceeds limit (expands down)");
return -1;
}
- limit = segment_max_limit(seg);
+ limit = segment_max_limit(desc);
}
if (logical_addr_32b > limit) {
--
2.53.0
next prev parent reply other threads:[~2026-03-25 16:47 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-25 16:44 [PULL 00/19] Fixes (including big i386/emulate performance improvement) for 11.0-rc Paolo Bonzini
2026-03-25 16:44 ` [PULL 01/19] tests/functional: preserve PYTHONPATH entries Paolo Bonzini
2026-03-25 16:44 ` [PULL 02/19] tdx: fix use-after-free in tdx_fetch_cpuid Paolo Bonzini
2026-03-25 16:44 ` [PULL 03/19] treewide: replace qemu_hw_version() with QEMU_HW_VERSION Paolo Bonzini
2026-03-25 16:44 ` [PULL 04/19] whpx: i386: workaround for Windows 10 support Paolo Bonzini
2026-03-25 16:44 ` [PULL 05/19] whpx: i386: enable exceptions VM exit only when needed Paolo Bonzini
2026-03-25 16:44 ` [PULL 06/19] whpx: i386: skip TSC read for MMIO exits Paolo Bonzini
2026-03-25 16:44 ` [PULL 07/19] whpx: i386: skip XCRs " Paolo Bonzini
2026-03-25 16:44 ` [PULL 08/19] whpx: i386: don't restore segment registers after MMIO handling Paolo Bonzini
2026-03-25 16:44 ` [PULL 09/19] target/i386: emulate: add new callbacks Paolo Bonzini
2026-03-25 16:44 ` [PULL 10/19] whpx: i386: add implementation of new x86_emul_ops Paolo Bonzini
2026-03-25 16:44 ` [PULL 11/19] target/i386: emulate: indirect access to CRs Paolo Bonzini
2026-03-25 16:44 ` [PULL 12/19] whpx: i386: " Paolo Bonzini
2026-03-25 16:44 ` Paolo Bonzini [this message]
2026-03-25 16:44 ` [PULL 14/19] whpx: i386: fetch segments on-demand Paolo Bonzini
2026-03-25 16:44 ` [PULL 15/19] whpx: i386: fast runtime state reads Paolo Bonzini
2026-03-25 16:44 ` [PULL 16/19] hw/audio/sb16: validate VMState fields in post_load Paolo Bonzini
2026-03-25 16:44 ` [PULL 17/19] target/i386: expose AMD GMET feature Paolo Bonzini
2026-03-25 16:44 ` [PULL 18/19] target/i386: emulate: set PG_ERROR_W_MASK as expected Paolo Bonzini
2026-03-25 16:44 ` [PULL 19/19] target/i386: emulate: follow priv_check_exempt Paolo Bonzini
2026-03-25 16:53 ` [PULL 00/19] Fixes (including big i386/emulate performance improvement) for 11.0-rc Peter Maydell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260325164453.72127-14-pbonzini@redhat.com \
--to=pbonzini@redhat.com \
--cc=mohamed@unpredictable.fr \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox