cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

cpu_loop.c (8247B)


      1/*
      2 *  qemu user cpu loop
      3 *
      4 *  Copyright (c) 2003-2008 Fabrice Bellard
      5 *
      6 *  This program is free software; you can redistribute it and/or modify
      7 *  it under the terms of the GNU General Public License as published by
      8 *  the Free Software Foundation; either version 2 of the License, or
      9 *  (at your option) any later version.
     10 *
     11 *  This program is distributed in the hope that it will be useful,
     12 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
     13 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     14 *  GNU General Public License for more details.
     15 *
     16 *  You should have received a copy of the GNU General Public License
     17 *  along with this program; if not, see <http://www.gnu.org/licenses/>.
     18 */
     19
     20#include "qemu/osdep.h"
     21#include "qemu-common.h"
     22#include "qemu.h"
     23#include "user-internals.h"
     24#include "cpu_loop-common.h"
     25#include "signal-common.h"
     26
     27void cpu_loop(CPUAlphaState *env)
     28{
     29    CPUState *cs = env_cpu(env);
     30    int trapnr;
     31    target_siginfo_t info;
     32    abi_long sysret;
     33
     34    while (1) {
     35        bool arch_interrupt = true;
     36
     37        cpu_exec_start(cs);
     38        trapnr = cpu_exec(cs);
     39        cpu_exec_end(cs);
     40        process_queued_cpu_work(cs);
     41
     42        switch (trapnr) {
     43        case EXCP_RESET:
     44            fprintf(stderr, "Reset requested. Exit\n");
     45            exit(EXIT_FAILURE);
     46            break;
     47        case EXCP_MCHK:
     48            fprintf(stderr, "Machine check exception. Exit\n");
     49            exit(EXIT_FAILURE);
     50            break;
     51        case EXCP_SMP_INTERRUPT:
     52        case EXCP_CLK_INTERRUPT:
     53        case EXCP_DEV_INTERRUPT:
     54            fprintf(stderr, "External interrupt. Exit\n");
     55            exit(EXIT_FAILURE);
     56            break;
     57        case EXCP_MMFAULT:
     58            info.si_signo = TARGET_SIGSEGV;
     59            info.si_errno = 0;
     60            info.si_code = (page_get_flags(env->trap_arg0) & PAGE_VALID
     61                            ? TARGET_SEGV_ACCERR : TARGET_SEGV_MAPERR);
     62            info._sifields._sigfault._addr = env->trap_arg0;
     63            queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
     64            break;
     65        case EXCP_UNALIGN:
     66            info.si_signo = TARGET_SIGBUS;
     67            info.si_errno = 0;
     68            info.si_code = TARGET_BUS_ADRALN;
     69            info._sifields._sigfault._addr = env->trap_arg0;
     70            queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
     71            break;
     72        case EXCP_OPCDEC:
     73        do_sigill:
     74            info.si_signo = TARGET_SIGILL;
     75            info.si_errno = 0;
     76            info.si_code = TARGET_ILL_ILLOPC;
     77            info._sifields._sigfault._addr = env->pc;
     78            queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
     79            break;
     80        case EXCP_ARITH:
     81            info.si_signo = TARGET_SIGFPE;
     82            info.si_errno = 0;
     83            info.si_code = TARGET_FPE_FLTINV;
     84            info._sifields._sigfault._addr = env->pc;
     85            queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
     86            break;
     87        case EXCP_FEN:
     88            /* No-op.  Linux simply re-enables the FPU.  */
     89            break;
     90        case EXCP_CALL_PAL:
     91            switch (env->error_code) {
     92            case 0x80:
     93                /* BPT */
     94                info.si_signo = TARGET_SIGTRAP;
     95                info.si_errno = 0;
     96                info.si_code = TARGET_TRAP_BRKPT;
     97                info._sifields._sigfault._addr = env->pc;
     98                queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
     99                break;
    100            case 0x81:
    101                /* BUGCHK */
    102                info.si_signo = TARGET_SIGTRAP;
    103                info.si_errno = 0;
    104                info.si_code = 0;
    105                info._sifields._sigfault._addr = env->pc;
    106                queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
    107                break;
    108            case 0x83:
    109                /* CALLSYS */
    110                trapnr = env->ir[IR_V0];
    111                sysret = do_syscall(env, trapnr,
    112                                    env->ir[IR_A0], env->ir[IR_A1],
    113                                    env->ir[IR_A2], env->ir[IR_A3],
    114                                    env->ir[IR_A4], env->ir[IR_A5],
    115                                    0, 0);
    116                if (sysret == -TARGET_ERESTARTSYS) {
    117                    env->pc -= 4;
    118                    break;
    119                }
    120                if (sysret == -TARGET_QEMU_ESIGRETURN) {
    121                    break;
    122                }
    123                /* Syscall writes 0 to V0 to bypass error check, similar
    124                   to how this is handled internal to Linux kernel.
    125                   (Ab)use trapnr temporarily as boolean indicating error.  */
    126                trapnr = (env->ir[IR_V0] != 0 && sysret < 0);
    127                env->ir[IR_V0] = (trapnr ? -sysret : sysret);
    128                env->ir[IR_A3] = trapnr;
    129                break;
    130            case 0x86:
    131                /* IMB */
    132                /* ??? We can probably elide the code using page_unprotect
    133                   that is checking for self-modifying code.  Instead we
    134                   could simply call tb_flush here.  Until we work out the
    135                   changes required to turn off the extra write protection,
    136                   this can be a no-op.  */
    137                break;
    138            case 0x9E:
    139                /* RDUNIQUE */
    140                /* Handled in the translator for usermode.  */
    141                abort();
    142            case 0x9F:
    143                /* WRUNIQUE */
    144                /* Handled in the translator for usermode.  */
    145                abort();
    146            case 0xAA:
    147                /* GENTRAP */
    148                info.si_signo = TARGET_SIGFPE;
    149                switch (env->ir[IR_A0]) {
    150                case TARGET_GEN_INTOVF:
    151                    info.si_code = TARGET_FPE_INTOVF;
    152                    break;
    153                case TARGET_GEN_INTDIV:
    154                    info.si_code = TARGET_FPE_INTDIV;
    155                    break;
    156                case TARGET_GEN_FLTOVF:
    157                    info.si_code = TARGET_FPE_FLTOVF;
    158                    break;
    159                case TARGET_GEN_FLTUND:
    160                    info.si_code = TARGET_FPE_FLTUND;
    161                    break;
    162                case TARGET_GEN_FLTINV:
    163                    info.si_code = TARGET_FPE_FLTINV;
    164                    break;
    165                case TARGET_GEN_FLTINE:
    166                    info.si_code = TARGET_FPE_FLTRES;
    167                    break;
    168                case TARGET_GEN_ROPRAND:
    169                    info.si_code = 0;
    170                    break;
    171                default:
    172                    info.si_signo = TARGET_SIGTRAP;
    173                    info.si_code = 0;
    174                    break;
    175                }
    176                info.si_errno = 0;
    177                info._sifields._sigfault._addr = env->pc;
    178                queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
    179                break;
    180            default:
    181                goto do_sigill;
    182            }
    183            break;
    184        case EXCP_DEBUG:
    185            info.si_signo = TARGET_SIGTRAP;
    186            info.si_errno = 0;
    187            info.si_code = TARGET_TRAP_BRKPT;
    188            queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
    189            break;
    190        case EXCP_INTERRUPT:
    191            /* Just indicate that signals should be handled asap.  */
    192            break;
    193        case EXCP_ATOMIC:
    194            cpu_exec_step_atomic(cs);
    195            arch_interrupt = false;
    196            break;
    197        default:
    198            fprintf(stderr, "Unhandled trap: 0x%x\n", trapnr);
    199            cpu_dump_state(cs, stderr, 0);
    200            exit(EXIT_FAILURE);
    201        }
    202        process_pending_signals (env);
    203
    204        /* Most of the traps imply a transition through PALcode, which
    205           implies an REI instruction has been executed.  Which means
    206           that RX and LOCK_ADDR should be cleared.  But there are a
    207           few exceptions for traps internal to QEMU.  */
    208        if (arch_interrupt) {
    209            env->flags &= ~ENV_FLAG_RX_FLAG;
    210            env->lock_addr = -1;
    211        }
    212    }
    213}
    214
    215void target_cpu_copy_regs(CPUArchState *env, struct target_pt_regs *regs)
    216{
    217    int i;
    218
    219    for(i = 0; i < 28; i++) {
    220        env->ir[i] = ((abi_ulong *)regs)[i];
    221    }
    222    env->ir[IR_SP] = regs->usp;
    223    env->pc = regs->pc;
    224}