QEMU targets ISAs contain instruction that can break the execution
flow with exceptions. When exception breaks the execution of the translation
block it may corrupt PC and icount values.
This set of patches fixes exception handling for MIPS, PowerPC, and i386
targets.
Incorrect execution for i386 is causes by exceptions raised by MMU functions.
MMU helper functions are called from generated code and other helper
functions. In both cases they try to get function's return address for
restoring virtual CPU state.
When MMU helper is called from some other helper function
(like helper_maskmov_xmm) through cpu_st* function, the return address
will point to that helper. That is why CPU state cannot be restored in
the case of MMU fault.
This bug can occur when maskmov instruction is located in the middle of the
translation block.
Execution sequence for this example:
TB start:
PC1: instr1
instr2
PC2: maskmov <page fault>
<page fault processing>
PC1: instr1
instr2
maskmov
At the start of TB execution guest PC points to instr1. When page fault occurs
QEMU tries to restore guest PC (which should be equal to PC2). It reads host PC
from the call stack and checks whether it points to TB or not. Bug in ldst
helpers implementation provides incorrect host PC, which is not located within
the TB. That's why QEMU cannot recover guest PC and it remains the same (PC1).
After page fault processing QEMU restarts TB and executes instr1 and instr2
for the second time, because guest PC was not recovered.
Bugs in helper functions for other targets do not break the execution in
regular TCG mode, because PC value is updated before calling the functions
that can raise an exception. But icount value cannot be updated this way.
Therefore exceptions make execution in icount mode non-determinisic.
In icount mode every translation block looks as follows:
if icount < n then exit
icount -= n
instr1
instr2
...
instrn
exit
When one of these instructions initiates an exception, icount should be
restored and adjusted number of instructions should be subtracted from icount
instead of initial n.
tlb_fill function passes retaddr to raise_exception, which allows restoring
current instructions in TB and correct icount calculation.
When exception triggered with other function (e.g. by embedding call to
exception raising helper into TB), then PC is not passed as retaddr and
correct icount is not recovered. In such cases icount will be decreased
by the value equal to the size of TB.
This behavior leads to incorrect values of virtual clock and
non-deterministic execution of the code.
These patches passes pointer to the translation block code to the exception
handler. It allows correct restoring of PC and icount values.
v6 changes:
* Removed several calls to gen_update_cc_op(s) (as suggested by Aurelien Jarno)
* Introduced do_* versions for fxsave and fxrstor (as suggested by Richard
Henderson)
* Removed useless seg functions changes (as suggested by Richard Henderson)
* Fixed ppc linux user build (as suggested by Aurelien Jarno)
v5 changes:
* Added helper functions for usermode ldst (as suggested by Aurelien Jarno)
* Fixed memory helpers for MIPS (as suggested by Aurelien Jarno)
* Added _ra version of raise_exception functions (as suggested by Richard
Henderson)
* Split i386 patch into several parts (as suggested by Richard Henderson)
v4 changes:
* Fixed exceptions handling for PowerPC
* Fixed passing of mmu_idx into helpers (as suggested by Aurelien Jarno)
* Added cpu_loop_exit_restore function (as suggested by Aurelien Jarno)
* Fixed exceptions handling in compare helper functions for MIPS (as suggested
by Aurelien Jarno)
* Removed several CPU state saving calls for MIPS (as suggested by Aurelien
Jarno)
v3 changes:
* Modified exception handling for syscall (as suggested by Aurelien Jarno)
* Removed redundant calls to save_cpu_state (as suggested by Aurelien Jarno)
* Removed helper_call* functions from softmmu (as suggested by Paolo Bonzini)
v2 changes:
* Added softmmu functions to pass TB return value into memory operations
handlers
* Fixed memory operations handling for MIPS
* Disabled updates of the PC that are overridden with cpu_restore_state
* Fixed memory operations and exceptions invoked by i386 helpers
---
Pavel Dovgalyuk (10):
softmmu: add helper function to pass through retaddr
cpu-exec: introduce loop exit with restore function
target-mips: improve exception handling
target-i386: introduce new raise_exception functions
target-i386: exception handling for FPU instructions
target-i386: exception handling for div instructions
target-i386: exception handling for memory helpers
target-i386: exception handling for seg_helper functions
target-i386: exception handling for other helper functions
target-ppc: exceptions handling in icount mode
cpu-exec.c | 9
include/exec/cpu_ldst_template.h | 59 ++-
include/exec/cpu_ldst_useronly_template.h | 25 +
include/exec/exec-all.h | 1
softmmu_template.h | 6
target-i386/cc_helper.c | 2
target-i386/cpu.h | 4
target-i386/excp_helper.c | 30 +
target-i386/fpu_helper.c | 164 +++++---
target-i386/int_helper.c | 32 +-
target-i386/mem_helper.c | 39 +-
target-i386/misc_helper.c | 10
target-i386/ops_sse.h | 2
target-i386/seg_helper.c | 607 +++++++++++++++--------------
target-i386/svm_helper.c | 4
target-i386/translate.c | 61 ---
target-mips/cpu.h | 23 +
target-mips/helper.h | 1
target-mips/msa_helper.c | 158 ++++----
target-mips/op_helper.c | 169 ++++----
target-mips/translate.c | 363 ++++++++---------
target-ppc/cpu.h | 3
target-ppc/excp_helper.c | 38 +-
target-ppc/fpu_helper.c | 191 +++++----
target-ppc/helper.h | 1
target-ppc/mem_helper.c | 6
target-ppc/misc_helper.c | 8
target-ppc/mmu-hash64.c | 12 -
target-ppc/mmu_helper.c | 18 -
target-ppc/timebase_helper.c | 20 -
target-ppc/translate.c | 84 ----
tcg/tcg.h | 23 +
32 files changed, 1117 insertions(+), 1056 deletions(-)
--
Pavel Dovgalyuk
