[Qemu-devel] [Bug 1809144] [NEW] SVM instructions fail with SVME bit enabled

[Paolo Montesel]

Public bug reported:

I was trying to use QEMU/TCG to emulate some stuff that uses SVM.
I know SVM is only partially implemented but I gave it a try anyway.

I found that if SVM is enabled in the same basic block in which there's a call 
to VMSAVE/etc,
the call fails as illegal op because the flags don't get updated correctly.

The pseudocode for the asm I'm running is:

```
EFER |= SVME; set the appropriate bit with wrmsr
vmsave
```

This is an example of the relevant translate.c code:

```
            if (!(s->flags & HF_SVME_MASK) || !s->pe) {
                goto illegal_op;
            }
            if (s->cpl != 0) {
                gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
                break;
            }
```

s->flags doesn't get updated after the wrmsr instruction and so QEMU
raises an illegal opcode interrupt.

A quick fix is to make the tb end after `wrmsr` instructions, but it's an hack 
afaik.
I'm not too comfortable with QEMU's code, so I don't know what a proper fix 
would be.

Cheers,

thebabush

** Affects: qemu
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1809144

Title:
  SVM instructions fail with SVME bit enabled

Status in QEMU:
  New

Bug description:
  I was trying to use QEMU/TCG to emulate some stuff that uses SVM.
  I know SVM is only partially implemented but I gave it a try anyway.

  I found that if SVM is enabled in the same basic block in which there's a 
call to VMSAVE/etc,
  the call fails as illegal op because the flags don't get updated correctly.

  The pseudocode for the asm I'm running is:

  ```
  EFER |= SVME; set the appropriate bit with wrmsr
  vmsave
  ```

  This is an example of the relevant translate.c code:

  ```
              if (!(s->flags & HF_SVME_MASK) || !s->pe) {
                  goto illegal_op;
              }
              if (s->cpl != 0) {
                  gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
                  break;
              }
  ```

  s->flags doesn't get updated after the wrmsr instruction and so QEMU
  raises an illegal opcode interrupt.

  A quick fix is to make the tb end after `wrmsr` instructions, but it's an 
hack afaik.
  I'm not too comfortable with QEMU's code, so I don't know what a proper fix 
would be.

  Cheers,

  thebabush

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1809144/+subscriptions