1/*
2 * Copyright (c) 2014 Advanced Micro Devices, Inc.
3 * Copyright (c) 2007 The Hewlett-Packard Development Company
4 * All rights reserved.
5 *
6 * The license below extends only to copyright in the software and shall
7 * not be construed as granting a license to any other intellectual
8 * property including but not limited to intellectual property relating
9 * to a hardware implementation of the functionality of the software
10 * licensed hereunder.  You may use the software subject to the license
11 * terms below provided that you ensure that this notice is replicated
12 * unmodified and in its entirety in all distributions of the software,
13 * modified or unmodified, in source code or in binary form.
14 *
15 * Copyright (c) 2003-2006 The Regents of The University of Michigan
16 * All rights reserved.
17 *
18 * Redistribution and use in source and binary forms, with or without
19 * modification, are permitted provided that the following conditions are
20 * met: redistributions of source code must retain the above copyright
21 * notice, this list of conditions and the following disclaimer;
22 * redistributions in binary form must reproduce the above copyright
23 * notice, this list of conditions and the following disclaimer in the
24 * documentation and/or other materials provided with the distribution;
25 * neither the name of the copyright holders nor the names of its
26 * contributors may be used to endorse or promote products derived from
27 * this software without specific prior written permission.
28 *
29 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
30 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
31 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
32 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
33 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
34 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
35 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
36 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
37 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
38 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
39 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
40 *
41 * Authors: Gabe Black
42 *          Ali Saidi
43 */
44
45#include "arch/x86/process.hh"
46
47#include <string>
48#include <vector>
49
50#include "arch/x86/isa_traits.hh"
51#include "arch/x86/regs/misc.hh"
52#include "arch/x86/regs/segment.hh"
53#include "arch/x86/system.hh"
54#include "arch/x86/types.hh"
55#include "base/loader/elf_object.hh"
56#include "base/loader/object_file.hh"
57#include "base/logging.hh"
58#include "base/trace.hh"
59#include "cpu/thread_context.hh"
60#include "debug/Stack.hh"
61#include "mem/multi_level_page_table.hh"
62#include "mem/page_table.hh"
63#include "params/Process.hh"
64#include "sim/aux_vector.hh"
65#include "sim/process_impl.hh"
66#include "sim/syscall_desc.hh"
67#include "sim/syscall_return.hh"
68#include "sim/system.hh"
69
70using namespace std;
71using namespace X86ISA;
72
73static const int ArgumentReg[] = {
74    INTREG_RDI,
75    INTREG_RSI,
76    INTREG_RDX,
77    // This argument register is r10 for syscalls and rcx for C.
78    INTREG_R10W,
79    // INTREG_RCX,
80    INTREG_R8W,
81    INTREG_R9W
82};
83
84static const int NumArgumentRegs M5_VAR_USED =
85    sizeof(ArgumentReg) / sizeof(const int);
86
87static const int ArgumentReg32[] = {
88    INTREG_EBX,
89    INTREG_ECX,
90    INTREG_EDX,
91    INTREG_ESI,
92    INTREG_EDI,
93    INTREG_EBP
94};
95
96static const int NumArgumentRegs32 M5_VAR_USED =
97    sizeof(ArgumentReg) / sizeof(const int);
98
99template class MultiLevelPageTable<LongModePTE<47, 39>,
100                                   LongModePTE<38, 30>,
101                                   LongModePTE<29, 21>,
102                                   LongModePTE<20, 12> >;
103typedef MultiLevelPageTable<LongModePTE<47, 39>,
104                            LongModePTE<38, 30>,
105                            LongModePTE<29, 21>,
106                            LongModePTE<20, 12> > ArchPageTable;
107
108X86Process::X86Process(ProcessParams *params, ObjectFile *objFile,
109                       SyscallDesc *_syscallDescs, int _numSyscallDescs)
110    : Process(params, params->useArchPT ?
111                      static_cast<EmulationPageTable *>(
112                              new ArchPageTable(params->name, params->pid,
113                                                params->system, PageBytes)) :
114                      new EmulationPageTable(params->name, params->pid,
115                                             PageBytes),
116              objFile),
117      syscallDescs(_syscallDescs), numSyscallDescs(_numSyscallDescs)
118{
119}
120
121void X86Process::clone(ThreadContext *old_tc, ThreadContext *new_tc,
122                       Process *p, RegVal flags)
123{
124    Process::clone(old_tc, new_tc, p, flags);
125    X86Process *process = (X86Process*)p;
126    *process = *this;
127}
128
129X86_64Process::X86_64Process(ProcessParams *params, ObjectFile *objFile,
130                             SyscallDesc *_syscallDescs, int _numSyscallDescs)
131    : X86Process(params, objFile, _syscallDescs, _numSyscallDescs)
132{
133
134    vsyscallPage.base = 0xffffffffff600000ULL;
135    vsyscallPage.size = PageBytes;
136    vsyscallPage.vtimeOffset = 0x400;
137    vsyscallPage.vgettimeofdayOffset = 0x0;
138
139    Addr brk_point = roundUp(objFile->dataBase() + objFile->dataSize() +
140                             objFile->bssSize(), PageBytes);
141    Addr stack_base = 0x7FFFFFFFF000ULL;
142    Addr max_stack_size = 8 * 1024 * 1024;
143    Addr next_thread_stack_base = stack_base - max_stack_size;
144    Addr mmap_end = 0x7FFFF7FFF000ULL;
145
146    memState = make_shared<MemState>(brk_point, stack_base, max_stack_size,
147                                     next_thread_stack_base, mmap_end);
148}
149
150void
151I386Process::syscall(int64_t callnum, ThreadContext *tc, Fault *fault)
152{
153    PCState pc = tc->pcState();
154    Addr eip = pc.pc();
155    if (eip >= vsyscallPage.base &&
156            eip < vsyscallPage.base + vsyscallPage.size) {
157        pc.npc(vsyscallPage.base + vsyscallPage.vsysexitOffset);
158        tc->pcState(pc);
159    }
160    X86Process::syscall(callnum, tc, fault);
161}
162
163
164I386Process::I386Process(ProcessParams *params, ObjectFile *objFile,
165                         SyscallDesc *_syscallDescs, int _numSyscallDescs)
166    : X86Process(params, objFile, _syscallDescs, _numSyscallDescs)
167{
168    if (kvmInSE)
169        panic("KVM CPU model does not support 32 bit processes");
170
171    _gdtStart = ULL(0xffffd000);
172    _gdtSize = PageBytes;
173
174    vsyscallPage.base = 0xffffe000ULL;
175    vsyscallPage.size = PageBytes;
176    vsyscallPage.vsyscallOffset = 0x400;
177    vsyscallPage.vsysexitOffset = 0x410;
178
179    Addr brk_point = roundUp(objFile->dataBase() + objFile->dataSize() +
180                             objFile->bssSize(), PageBytes);
181    Addr stack_base = _gdtStart;
182    Addr max_stack_size = 8 * 1024 * 1024;
183    Addr next_thread_stack_base = stack_base - max_stack_size;
184    Addr mmap_end = 0xB7FFF000ULL;
185
186    memState = make_shared<MemState>(brk_point, stack_base, max_stack_size,
187                                     next_thread_stack_base, mmap_end);
188}
189
190SyscallDesc*
191X86Process::getDesc(int callnum)
192{
193    if (callnum < 0 || callnum >= numSyscallDescs)
194        return NULL;
195    return &syscallDescs[callnum];
196}
197
198void
199X86_64Process::initState()
200{
201    X86Process::initState();
202
203    if (useForClone)
204        return;
205
206    argsInit(PageBytes);
207
208    // Set up the vsyscall page for this process.
209    allocateMem(vsyscallPage.base, vsyscallPage.size);
210    uint8_t vtimeBlob[] = {
211        0x48,0xc7,0xc0,0xc9,0x00,0x00,0x00,    // mov    $0xc9,%rax
212        0x0f,0x05,                             // syscall
213        0xc3                                   // retq
214    };
215    initVirtMem.writeBlob(vsyscallPage.base + vsyscallPage.vtimeOffset,
216            vtimeBlob, sizeof(vtimeBlob));
217
218    uint8_t vgettimeofdayBlob[] = {
219        0x48,0xc7,0xc0,0x60,0x00,0x00,0x00,    // mov    $0x60,%rax
220        0x0f,0x05,                             // syscall
221        0xc3                                   // retq
222    };
223    initVirtMem.writeBlob(vsyscallPage.base + vsyscallPage.vgettimeofdayOffset,
224            vgettimeofdayBlob, sizeof(vgettimeofdayBlob));
225
226    if (kvmInSE) {
227        PortProxy physProxy = system->physProxy;
228
229        Addr syscallCodePhysAddr = system->allocPhysPages(1);
230        Addr gdtPhysAddr = system->allocPhysPages(1);
231        Addr idtPhysAddr = system->allocPhysPages(1);
232        Addr istPhysAddr = system->allocPhysPages(1);
233        Addr tssPhysAddr = system->allocPhysPages(1);
234        Addr pfHandlerPhysAddr = system->allocPhysPages(1);
235
236        /*
237         * Set up the gdt.
238         */
239        uint8_t numGDTEntries = 0;
240        uint64_t nullDescriptor = 0;
241        physProxy.writeBlob(gdtPhysAddr + numGDTEntries * 8,
242                            &nullDescriptor, 8);
243        numGDTEntries++;
244
245        SegDescriptor initDesc = 0;
246        initDesc.type.codeOrData = 0; // code or data type
247        initDesc.type.c = 0;          // conforming
248        initDesc.type.r = 1;          // readable
249        initDesc.dpl = 0;             // privilege
250        initDesc.p = 1;               // present
251        initDesc.l = 1;               // longmode - 64 bit
252        initDesc.d = 0;               // operand size
253        initDesc.s = 1;               // system segment
254        initDesc.limit = 0xFFFFFFFF;
255        initDesc.base = 0;
256
257        //64 bit code segment
258        SegDescriptor csLowPLDesc = initDesc;
259        csLowPLDesc.type.codeOrData = 1;
260        csLowPLDesc.dpl = 0;
261        uint64_t csLowPLDescVal = csLowPLDesc;
262        physProxy.writeBlob(gdtPhysAddr + numGDTEntries * 8,
263                            &csLowPLDescVal, 8);
264
265        numGDTEntries++;
266
267        SegSelector csLowPL = 0;
268        csLowPL.si = numGDTEntries - 1;
269        csLowPL.rpl = 0;
270
271        //64 bit data segment
272        SegDescriptor dsLowPLDesc = initDesc;
273        dsLowPLDesc.type.codeOrData = 0;
274        dsLowPLDesc.dpl = 0;
275        uint64_t dsLowPLDescVal = dsLowPLDesc;
276        physProxy.writeBlob(gdtPhysAddr + numGDTEntries * 8,
277                            &dsLowPLDescVal, 8);
278
279        numGDTEntries++;
280
281        SegSelector dsLowPL = 0;
282        dsLowPL.si = numGDTEntries - 1;
283        dsLowPL.rpl = 0;
284
285        //64 bit data segment
286        SegDescriptor dsDesc = initDesc;
287        dsDesc.type.codeOrData = 0;
288        dsDesc.dpl = 3;
289        uint64_t dsDescVal = dsDesc;
290        physProxy.writeBlob(gdtPhysAddr + numGDTEntries * 8,
291                            &dsDescVal, 8);
292
293        numGDTEntries++;
294
295        SegSelector ds = 0;
296        ds.si = numGDTEntries - 1;
297        ds.rpl = 3;
298
299        //64 bit code segment
300        SegDescriptor csDesc = initDesc;
301        csDesc.type.codeOrData = 1;
302        csDesc.dpl = 3;
303        uint64_t csDescVal = csDesc;
304        physProxy.writeBlob(gdtPhysAddr + numGDTEntries * 8,
305                            &csDescVal, 8);
306
307        numGDTEntries++;
308
309        SegSelector cs = 0;
310        cs.si = numGDTEntries - 1;
311        cs.rpl = 3;
312
313        SegSelector scall = 0;
314        scall.si = csLowPL.si;
315        scall.rpl = 0;
316
317        SegSelector sret = 0;
318        sret.si = dsLowPL.si;
319        sret.rpl = 3;
320
321        /* In long mode the TSS has been extended to 16 Bytes */
322        TSSlow TSSDescLow = 0;
323        TSSDescLow.type = 0xB;
324        TSSDescLow.dpl = 0; // Privelege level 0
325        TSSDescLow.p = 1; // Present
326        TSSDescLow.limit = 0xFFFFFFFF;
327        TSSDescLow.base = bits(TSSVirtAddr, 31, 0);
328
329        TSShigh TSSDescHigh = 0;
330        TSSDescHigh.base = bits(TSSVirtAddr, 63, 32);
331
332        struct TSSDesc {
333            uint64_t low;
334            uint64_t high;
335        } tssDescVal = {TSSDescLow, TSSDescHigh};
336
337        physProxy.writeBlob(gdtPhysAddr + numGDTEntries * 8,
338                            &tssDescVal, sizeof(tssDescVal));
339
340        numGDTEntries++;
341
342        SegSelector tssSel = 0;
343        tssSel.si = numGDTEntries - 1;
344
345        uint64_t tss_base_addr = (TSSDescHigh.base << 32) | TSSDescLow.base;
346        uint64_t tss_limit = TSSDescLow.limit;
347
348        SegAttr tss_attr = 0;
349
350        tss_attr.type = TSSDescLow.type;
351        tss_attr.dpl = TSSDescLow.dpl;
352        tss_attr.present = TSSDescLow.p;
353        tss_attr.granularity = TSSDescLow.g;
354        tss_attr.unusable = 0;
355
356        for (int i = 0; i < contextIds.size(); i++) {
357            ThreadContext * tc = system->getThreadContext(contextIds[i]);
358
359            tc->setMiscReg(MISCREG_CS, cs);
360            tc->setMiscReg(MISCREG_DS, ds);
361            tc->setMiscReg(MISCREG_ES, ds);
362            tc->setMiscReg(MISCREG_FS, ds);
363            tc->setMiscReg(MISCREG_GS, ds);
364            tc->setMiscReg(MISCREG_SS, ds);
365
366            // LDT
367            tc->setMiscReg(MISCREG_TSL, 0);
368            SegAttr tslAttr = 0;
369            tslAttr.present = 1;
370            tslAttr.type = 2;
371            tc->setMiscReg(MISCREG_TSL_ATTR, tslAttr);
372
373            tc->setMiscReg(MISCREG_TSG_BASE, GDTVirtAddr);
374            tc->setMiscReg(MISCREG_TSG_LIMIT, 8 * numGDTEntries - 1);
375
376            tc->setMiscReg(MISCREG_TR, tssSel);
377            tc->setMiscReg(MISCREG_TR_BASE, tss_base_addr);
378            tc->setMiscReg(MISCREG_TR_EFF_BASE, 0);
379            tc->setMiscReg(MISCREG_TR_LIMIT, tss_limit);
380            tc->setMiscReg(MISCREG_TR_ATTR, tss_attr);
381
382            //Start using longmode segments.
383            installSegDesc(tc, SEGMENT_REG_CS, csDesc, true);
384            installSegDesc(tc, SEGMENT_REG_DS, dsDesc, true);
385            installSegDesc(tc, SEGMENT_REG_ES, dsDesc, true);
386            installSegDesc(tc, SEGMENT_REG_FS, dsDesc, true);
387            installSegDesc(tc, SEGMENT_REG_GS, dsDesc, true);
388            installSegDesc(tc, SEGMENT_REG_SS, dsDesc, true);
389
390            Efer efer = 0;
391            efer.sce = 1; // Enable system call extensions.
392            efer.lme = 1; // Enable long mode.
393            efer.lma = 1; // Activate long mode.
394            efer.nxe = 0; // Enable nx support.
395            efer.svme = 1; // Enable svm support for now.
396            efer.ffxsr = 0; // Turn on fast fxsave and fxrstor.
397            tc->setMiscReg(MISCREG_EFER, efer);
398
399            //Set up the registers that describe the operating mode.
400            CR0 cr0 = 0;
401            cr0.pg = 1; // Turn on paging.
402            cr0.cd = 0; // Don't disable caching.
403            cr0.nw = 0; // This is bit is defined to be ignored.
404            cr0.am = 1; // No alignment checking
405            cr0.wp = 1; // Supervisor mode can write read only pages
406            cr0.ne = 1;
407            cr0.et = 1; // This should always be 1
408            cr0.ts = 0; // We don't do task switching, so causing fp exceptions
409                        // would be pointless.
410            cr0.em = 0; // Allow x87 instructions to execute natively.
411            cr0.mp = 1; // This doesn't really matter, but the manual suggests
412                        // setting it to one.
413            cr0.pe = 1; // We're definitely in protected mode.
414            tc->setMiscReg(MISCREG_CR0, cr0);
415
416            CR0 cr2 = 0;
417            tc->setMiscReg(MISCREG_CR2, cr2);
418
419            CR3 cr3 = dynamic_cast<ArchPageTable *>(pTable)->basePtr();
420            tc->setMiscReg(MISCREG_CR3, cr3);
421
422            CR4 cr4 = 0;
423            //Turn on pae.
424            cr4.osxsave = 1; // Enable XSAVE and Proc Extended States
425            cr4.osxmmexcpt = 1; // Operating System Unmasked Exception
426            cr4.osfxsr = 1; // Operating System FXSave/FSRSTOR Support
427            cr4.pce = 0; // Performance-Monitoring Counter Enable
428            cr4.pge = 0; // Page-Global Enable
429            cr4.mce = 0; // Machine Check Enable
430            cr4.pae = 1; // Physical-Address Extension
431            cr4.pse = 0; // Page Size Extensions
432            cr4.de = 0; // Debugging Extensions
433            cr4.tsd = 0; // Time Stamp Disable
434            cr4.pvi = 0; // Protected-Mode Virtual Interrupts
435            cr4.vme = 0; // Virtual-8086 Mode Extensions
436
437            tc->setMiscReg(MISCREG_CR4, cr4);
438
439            CR4 cr8 = 0;
440            tc->setMiscReg(MISCREG_CR8, cr8);
441
442            tc->setMiscReg(MISCREG_MXCSR, 0x1f80);
443
444            tc->setMiscReg(MISCREG_APIC_BASE, 0xfee00900);
445
446            tc->setMiscReg(MISCREG_TSG_BASE, GDTVirtAddr);
447            tc->setMiscReg(MISCREG_TSG_LIMIT, 0xffff);
448
449            tc->setMiscReg(MISCREG_IDTR_BASE, IDTVirtAddr);
450            tc->setMiscReg(MISCREG_IDTR_LIMIT, 0xffff);
451
452            /* enabling syscall and sysret */
453            RegVal star = ((RegVal)sret << 48) | ((RegVal)scall << 32);
454            tc->setMiscReg(MISCREG_STAR, star);
455            RegVal lstar = (RegVal)syscallCodeVirtAddr;
456            tc->setMiscReg(MISCREG_LSTAR, lstar);
457            RegVal sfmask = (1 << 8) | (1 << 10); // TF | DF
458            tc->setMiscReg(MISCREG_SF_MASK, sfmask);
459        }
460
461        /* Set up the content of the TSS and write it to physical memory. */
462
463        struct {
464            uint32_t reserved0;        // +00h
465            uint32_t RSP0_low;         // +04h
466            uint32_t RSP0_high;        // +08h
467            uint32_t RSP1_low;         // +0Ch
468            uint32_t RSP1_high;        // +10h
469            uint32_t RSP2_low;         // +14h
470            uint32_t RSP2_high;        // +18h
471            uint32_t reserved1;        // +1Ch
472            uint32_t reserved2;        // +20h
473            uint32_t IST1_low;         // +24h
474            uint32_t IST1_high;        // +28h
475            uint32_t IST2_low;         // +2Ch
476            uint32_t IST2_high;        // +30h
477            uint32_t IST3_low;         // +34h
478            uint32_t IST3_high;        // +38h
479            uint32_t IST4_low;         // +3Ch
480            uint32_t IST4_high;        // +40h
481            uint32_t IST5_low;         // +44h
482            uint32_t IST5_high;        // +48h
483            uint32_t IST6_low;         // +4Ch
484            uint32_t IST6_high;        // +50h
485            uint32_t IST7_low;         // +54h
486            uint32_t IST7_high;        // +58h
487            uint32_t reserved3;        // +5Ch
488            uint32_t reserved4;        // +60h
489            uint16_t reserved5;        // +64h
490            uint16_t IO_MapBase;       // +66h
491        } tss;
492
493        /** setting Interrupt Stack Table */
494        uint64_t IST_start = ISTVirtAddr + PageBytes;
495        tss.IST1_low  = IST_start;
496        tss.IST1_high = IST_start >> 32;
497        tss.RSP0_low  = tss.IST1_low;
498        tss.RSP0_high = tss.IST1_high;
499        tss.RSP1_low  = tss.IST1_low;
500        tss.RSP1_high = tss.IST1_high;
501        tss.RSP2_low  = tss.IST1_low;
502        tss.RSP2_high = tss.IST1_high;
503        physProxy.writeBlob(tssPhysAddr, &tss, sizeof(tss));
504
505        /* Setting IDT gates */
506        GateDescriptorLow PFGateLow = 0;
507        PFGateLow.offsetHigh = bits(PFHandlerVirtAddr, 31, 16);
508        PFGateLow.offsetLow = bits(PFHandlerVirtAddr, 15, 0);
509        PFGateLow.selector = csLowPL;
510        PFGateLow.p = 1;
511        PFGateLow.dpl = 0;
512        PFGateLow.type = 0xe;      // gate interrupt type
513        PFGateLow.IST = 0;         // setting IST to 0 and using RSP0
514
515        GateDescriptorHigh PFGateHigh = 0;
516        PFGateHigh.offset = bits(PFHandlerVirtAddr, 63, 32);
517
518        struct {
519            uint64_t low;
520            uint64_t high;
521        } PFGate = {PFGateLow, PFGateHigh};
522
523        physProxy.writeBlob(idtPhysAddr + 0xE0, &PFGate, sizeof(PFGate));
524
525        /* System call handler */
526        uint8_t syscallBlob[] = {
527            // mov    %rax, (0xffffc90000005600)
528            0x48, 0xa3, 0x00, 0x60, 0x00,
529            0x00, 0x00, 0xc9, 0xff, 0xff,
530            // sysret
531            0x48, 0x0f, 0x07
532        };
533
534        physProxy.writeBlob(syscallCodePhysAddr,
535                            syscallBlob, sizeof(syscallBlob));
536
537        /** Page fault handler */
538        uint8_t faultBlob[] = {
539            // mov    %rax, (0xffffc90000005700)
540            0x48, 0xa3, 0x00, 0x61, 0x00,
541            0x00, 0x00, 0xc9, 0xff, 0xff,
542            // add    $0x8, %rsp # skip error
543            0x48, 0x83, 0xc4, 0x08,
544            // iretq
545            0x48, 0xcf
546        };
547
548        physProxy.writeBlob(pfHandlerPhysAddr, faultBlob, sizeof(faultBlob));
549
550        /* Syscall handler */
551        pTable->map(syscallCodeVirtAddr, syscallCodePhysAddr,
552                    PageBytes, false);
553        /* GDT */
554        pTable->map(GDTVirtAddr, gdtPhysAddr, PageBytes, false);
555        /* IDT */
556        pTable->map(IDTVirtAddr, idtPhysAddr, PageBytes, false);
557        /* TSS */
558        pTable->map(TSSVirtAddr, tssPhysAddr, PageBytes, false);
559        /* IST */
560        pTable->map(ISTVirtAddr, istPhysAddr, PageBytes, false);
561        /* PF handler */
562        pTable->map(PFHandlerVirtAddr, pfHandlerPhysAddr, PageBytes, false);
563        /* MMIO region for m5ops */
564        pTable->map(MMIORegionVirtAddr, MMIORegionPhysAddr,
565                    16 * PageBytes, false);
566    } else {
567        for (int i = 0; i < contextIds.size(); i++) {
568            ThreadContext * tc = system->getThreadContext(contextIds[i]);
569
570            SegAttr dataAttr = 0;
571            dataAttr.dpl = 3;
572            dataAttr.unusable = 0;
573            dataAttr.defaultSize = 1;
574            dataAttr.longMode = 1;
575            dataAttr.avl = 0;
576            dataAttr.granularity = 1;
577            dataAttr.present = 1;
578            dataAttr.type = 3;
579            dataAttr.writable = 1;
580            dataAttr.readable = 1;
581            dataAttr.expandDown = 0;
582            dataAttr.system = 1;
583
584            // Initialize the segment registers.
585            for (int seg = 0; seg < NUM_SEGMENTREGS; seg++) {
586                tc->setMiscRegNoEffect(MISCREG_SEG_BASE(seg), 0);
587                tc->setMiscRegNoEffect(MISCREG_SEG_EFF_BASE(seg), 0);
588                tc->setMiscRegNoEffect(MISCREG_SEG_ATTR(seg), dataAttr);
589            }
590
591            SegAttr csAttr = 0;
592            csAttr.dpl = 3;
593            csAttr.unusable = 0;
594            csAttr.defaultSize = 0;
595            csAttr.longMode = 1;
596            csAttr.avl = 0;
597            csAttr.granularity = 1;
598            csAttr.present = 1;
599            csAttr.type = 10;
600            csAttr.writable = 0;
601            csAttr.readable = 1;
602            csAttr.expandDown = 0;
603            csAttr.system = 1;
604
605            tc->setMiscRegNoEffect(MISCREG_CS_ATTR, csAttr);
606
607            Efer efer = 0;
608            efer.sce = 1; // Enable system call extensions.
609            efer.lme = 1; // Enable long mode.
610            efer.lma = 1; // Activate long mode.
611            efer.nxe = 1; // Enable nx support.
612            efer.svme = 0; // Disable svm support for now. It isn't implemented.
613            efer.ffxsr = 1; // Turn on fast fxsave and fxrstor.
614            tc->setMiscReg(MISCREG_EFER, efer);
615
616            // Set up the registers that describe the operating mode.
617            CR0 cr0 = 0;
618            cr0.pg = 1; // Turn on paging.
619            cr0.cd = 0; // Don't disable caching.
620            cr0.nw = 0; // This is bit is defined to be ignored.
621            cr0.am = 0; // No alignment checking
622            cr0.wp = 0; // Supervisor mode can write read only pages
623            cr0.ne = 1;
624            cr0.et = 1; // This should always be 1
625            cr0.ts = 0; // We don't do task switching, so causing fp exceptions
626                        // would be pointless.
627            cr0.em = 0; // Allow x87 instructions to execute natively.
628            cr0.mp = 1; // This doesn't really matter, but the manual suggests
629                        // setting it to one.
630            cr0.pe = 1; // We're definitely in protected mode.
631            tc->setMiscReg(MISCREG_CR0, cr0);
632
633            tc->setMiscReg(MISCREG_MXCSR, 0x1f80);
634        }
635    }
636}
637
638void
639I386Process::initState()
640{
641    X86Process::initState();
642
643    argsInit(PageBytes);
644
645    /*
646     * Set up a GDT for this process. The whole GDT wouldn't really be for
647     * this process, but the only parts we care about are.
648     */
649    allocateMem(_gdtStart, _gdtSize);
650    uint64_t zero = 0;
651    assert(_gdtSize % sizeof(zero) == 0);
652    for (Addr gdtCurrent = _gdtStart;
653            gdtCurrent < _gdtStart + _gdtSize; gdtCurrent += sizeof(zero)) {
654        initVirtMem.write(gdtCurrent, zero);
655    }
656
657    // Set up the vsyscall page for this process.
658    allocateMem(vsyscallPage.base, vsyscallPage.size);
659    uint8_t vsyscallBlob[] = {
660        0x51,       // push %ecx
661        0x52,       // push %edp
662        0x55,       // push %ebp
663        0x89, 0xe5, // mov %esp, %ebp
664        0x0f, 0x34  // sysenter
665    };
666    initVirtMem.writeBlob(vsyscallPage.base + vsyscallPage.vsyscallOffset,
667            vsyscallBlob, sizeof(vsyscallBlob));
668
669    uint8_t vsysexitBlob[] = {
670        0x5d,       // pop %ebp
671        0x5a,       // pop %edx
672        0x59,       // pop %ecx
673        0xc3        // ret
674    };
675    initVirtMem.writeBlob(vsyscallPage.base + vsyscallPage.vsysexitOffset,
676            vsysexitBlob, sizeof(vsysexitBlob));
677
678    for (int i = 0; i < contextIds.size(); i++) {
679        ThreadContext * tc = system->getThreadContext(contextIds[i]);
680
681        SegAttr dataAttr = 0;
682        dataAttr.dpl = 3;
683        dataAttr.unusable = 0;
684        dataAttr.defaultSize = 1;
685        dataAttr.longMode = 0;
686        dataAttr.avl = 0;
687        dataAttr.granularity = 1;
688        dataAttr.present = 1;
689        dataAttr.type = 3;
690        dataAttr.writable = 1;
691        dataAttr.readable = 1;
692        dataAttr.expandDown = 0;
693        dataAttr.system = 1;
694
695        // Initialize the segment registers.
696        for (int seg = 0; seg < NUM_SEGMENTREGS; seg++) {
697            tc->setMiscRegNoEffect(MISCREG_SEG_BASE(seg), 0);
698            tc->setMiscRegNoEffect(MISCREG_SEG_EFF_BASE(seg), 0);
699            tc->setMiscRegNoEffect(MISCREG_SEG_ATTR(seg), dataAttr);
700            tc->setMiscRegNoEffect(MISCREG_SEG_SEL(seg), 0xB);
701            tc->setMiscRegNoEffect(MISCREG_SEG_LIMIT(seg), (uint32_t)(-1));
702        }
703
704        SegAttr csAttr = 0;
705        csAttr.dpl = 3;
706        csAttr.unusable = 0;
707        csAttr.defaultSize = 1;
708        csAttr.longMode = 0;
709        csAttr.avl = 0;
710        csAttr.granularity = 1;
711        csAttr.present = 1;
712        csAttr.type = 0xa;
713        csAttr.writable = 0;
714        csAttr.readable = 1;
715        csAttr.expandDown = 0;
716        csAttr.system = 1;
717
718        tc->setMiscRegNoEffect(MISCREG_CS_ATTR, csAttr);
719
720        tc->setMiscRegNoEffect(MISCREG_TSG_BASE, _gdtStart);
721        tc->setMiscRegNoEffect(MISCREG_TSG_EFF_BASE, _gdtStart);
722        tc->setMiscRegNoEffect(MISCREG_TSG_LIMIT, _gdtStart + _gdtSize - 1);
723
724        // Set the LDT selector to 0 to deactivate it.
725        tc->setMiscRegNoEffect(MISCREG_TSL, 0);
726
727        Efer efer = 0;
728        efer.sce = 1; // Enable system call extensions.
729        efer.lme = 1; // Enable long mode.
730        efer.lma = 0; // Deactivate long mode.
731        efer.nxe = 1; // Enable nx support.
732        efer.svme = 0; // Disable svm support for now. It isn't implemented.
733        efer.ffxsr = 1; // Turn on fast fxsave and fxrstor.
734        tc->setMiscReg(MISCREG_EFER, efer);
735
736        // Set up the registers that describe the operating mode.
737        CR0 cr0 = 0;
738        cr0.pg = 1; // Turn on paging.
739        cr0.cd = 0; // Don't disable caching.
740        cr0.nw = 0; // This is bit is defined to be ignored.
741        cr0.am = 0; // No alignment checking
742        cr0.wp = 0; // Supervisor mode can write read only pages
743        cr0.ne = 1;
744        cr0.et = 1; // This should always be 1
745        cr0.ts = 0; // We don't do task switching, so causing fp exceptions
746                    // would be pointless.
747        cr0.em = 0; // Allow x87 instructions to execute natively.
748        cr0.mp = 1; // This doesn't really matter, but the manual suggests
749                    // setting it to one.
750        cr0.pe = 1; // We're definitely in protected mode.
751        tc->setMiscReg(MISCREG_CR0, cr0);
752
753        tc->setMiscReg(MISCREG_MXCSR, 0x1f80);
754    }
755}
756
757template<class IntType>
758void
759X86Process::argsInit(int pageSize,
760                     std::vector<AuxVector<IntType> > extraAuxvs)
761{
762    int intSize = sizeof(IntType);
763
764    std::vector<AuxVector<IntType>> auxv = extraAuxvs;
765
766    string filename;
767    if (argv.size() < 1)
768        filename = "";
769    else
770        filename = argv[0];
771
772    // We want 16 byte alignment
773    uint64_t align = 16;
774
775    // Patch the ld_bias for dynamic executables.
776    updateBias();
777
778    // load object file into target memory
779    objFile->loadSections(initVirtMem);
780
781    enum X86CpuFeature {
782        X86_OnboardFPU = 1 << 0,
783        X86_VirtualModeExtensions = 1 << 1,
784        X86_DebuggingExtensions = 1 << 2,
785        X86_PageSizeExtensions = 1 << 3,
786
787        X86_TimeStampCounter = 1 << 4,
788        X86_ModelSpecificRegisters = 1 << 5,
789        X86_PhysicalAddressExtensions = 1 << 6,
790        X86_MachineCheckExtensions = 1 << 7,
791
792        X86_CMPXCHG8Instruction = 1 << 8,
793        X86_OnboardAPIC = 1 << 9,
794        X86_SYSENTER_SYSEXIT = 1 << 11,
795
796        X86_MemoryTypeRangeRegisters = 1 << 12,
797        X86_PageGlobalEnable = 1 << 13,
798        X86_MachineCheckArchitecture = 1 << 14,
799        X86_CMOVInstruction = 1 << 15,
800
801        X86_PageAttributeTable = 1 << 16,
802        X86_36BitPSEs = 1 << 17,
803        X86_ProcessorSerialNumber = 1 << 18,
804        X86_CLFLUSHInstruction = 1 << 19,
805
806        X86_DebugTraceStore = 1 << 21,
807        X86_ACPIViaMSR = 1 << 22,
808        X86_MultimediaExtensions = 1 << 23,
809
810        X86_FXSAVE_FXRSTOR = 1 << 24,
811        X86_StreamingSIMDExtensions = 1 << 25,
812        X86_StreamingSIMDExtensions2 = 1 << 26,
813        X86_CPUSelfSnoop = 1 << 27,
814
815        X86_HyperThreading = 1 << 28,
816        X86_AutomaticClockControl = 1 << 29,
817        X86_IA64Processor = 1 << 30
818    };
819
820    // Setup the auxiliary vectors. These will already have endian
821    // conversion. Auxiliary vectors are loaded only for elf formatted
822    // executables; the auxv is responsible for passing information from
823    // the OS to the interpreter.
824    ElfObject * elfObject = dynamic_cast<ElfObject *>(objFile);
825    if (elfObject) {
826        uint64_t features =
827            X86_OnboardFPU |
828            X86_VirtualModeExtensions |
829            X86_DebuggingExtensions |
830            X86_PageSizeExtensions |
831            X86_TimeStampCounter |
832            X86_ModelSpecificRegisters |
833            X86_PhysicalAddressExtensions |
834            X86_MachineCheckExtensions |
835            X86_CMPXCHG8Instruction |
836            X86_OnboardAPIC |
837            X86_SYSENTER_SYSEXIT |
838            X86_MemoryTypeRangeRegisters |
839            X86_PageGlobalEnable |
840            X86_MachineCheckArchitecture |
841            X86_CMOVInstruction |
842            X86_PageAttributeTable |
843            X86_36BitPSEs |
844//            X86_ProcessorSerialNumber |
845            X86_CLFLUSHInstruction |
846//            X86_DebugTraceStore |
847//            X86_ACPIViaMSR |
848            X86_MultimediaExtensions |
849            X86_FXSAVE_FXRSTOR |
850            X86_StreamingSIMDExtensions |
851            X86_StreamingSIMDExtensions2 |
852//            X86_CPUSelfSnoop |
853//            X86_HyperThreading |
854//            X86_AutomaticClockControl |
855//            X86_IA64Processor |
856            0;
857
858        // Bits which describe the system hardware capabilities
859        // XXX Figure out what these should be
860        auxv.emplace_back(M5_AT_HWCAP, features);
861        // The system page size
862        auxv.emplace_back(M5_AT_PAGESZ, X86ISA::PageBytes);
863        // Frequency at which times() increments
864        // Defined to be 100 in the kernel source.
865        auxv.emplace_back(M5_AT_CLKTCK, 100);
866        // This is the virtual address of the program header tables if they
867        // appear in the executable image.
868        auxv.emplace_back(M5_AT_PHDR, elfObject->programHeaderTable());
869        // This is the size of a program header entry from the elf file.
870        auxv.emplace_back(M5_AT_PHENT, elfObject->programHeaderSize());
871        // This is the number of program headers from the original elf file.
872        auxv.emplace_back(M5_AT_PHNUM, elfObject->programHeaderCount());
873        // This is the base address of the ELF interpreter; it should be
874        // zero for static executables or contain the base address for
875        // dynamic executables.
876        auxv.emplace_back(M5_AT_BASE, getBias());
877        // XXX Figure out what this should be.
878        auxv.emplace_back(M5_AT_FLAGS, 0);
879        // The entry point to the program
880        auxv.emplace_back(M5_AT_ENTRY, objFile->entryPoint());
881        // Different user and group IDs
882        auxv.emplace_back(M5_AT_UID, uid());
883        auxv.emplace_back(M5_AT_EUID, euid());
884        auxv.emplace_back(M5_AT_GID, gid());
885        auxv.emplace_back(M5_AT_EGID, egid());
886        // Whether to enable "secure mode" in the executable
887        auxv.emplace_back(M5_AT_SECURE, 0);
888        // The address of 16 "random" bytes.
889        auxv.emplace_back(M5_AT_RANDOM, 0);
890        // The name of the program
891        auxv.emplace_back(M5_AT_EXECFN, 0);
892        // The platform string
893        auxv.emplace_back(M5_AT_PLATFORM, 0);
894    }
895
896    // Figure out how big the initial stack needs to be
897
898    // A sentry NULL void pointer at the top of the stack.
899    int sentry_size = intSize;
900
901    // This is the name of the file which is present on the initial stack
902    // It's purpose is to let the user space linker examine the original file.
903    int file_name_size = filename.size() + 1;
904
905    const int numRandomBytes = 16;
906    int aux_data_size = numRandomBytes;
907
908    string platform = "x86_64";
909    aux_data_size += platform.size() + 1;
910
911    int env_data_size = 0;
912    for (int i = 0; i < envp.size(); ++i)
913        env_data_size += envp[i].size() + 1;
914    int arg_data_size = 0;
915    for (int i = 0; i < argv.size(); ++i)
916        arg_data_size += argv[i].size() + 1;
917
918    // The info_block needs to be padded so its size is a multiple of the
919    // alignment mask. Also, it appears that there needs to be at least some
920    // padding, so if the size is already a multiple, we need to increase it
921    // anyway.
922    int base_info_block_size =
923        sentry_size + file_name_size + env_data_size + arg_data_size;
924
925    int info_block_size = roundUp(base_info_block_size, align);
926
927    int info_block_padding = info_block_size - base_info_block_size;
928
929    // Each auxiliary vector is two 8 byte words
930    int aux_array_size = intSize * 2 * (auxv.size() + 1);
931
932    int envp_array_size = intSize * (envp.size() + 1);
933    int argv_array_size = intSize * (argv.size() + 1);
934
935    int argc_size = intSize;
936
937    // Figure out the size of the contents of the actual initial frame
938    int frame_size =
939        aux_array_size +
940        envp_array_size +
941        argv_array_size +
942        argc_size;
943
944    // There needs to be padding after the auxiliary vector data so that the
945    // very bottom of the stack is aligned properly.
946    int partial_size = frame_size + aux_data_size;
947    int aligned_partial_size = roundUp(partial_size, align);
948    int aux_padding = aligned_partial_size - partial_size;
949
950    int space_needed =
951        info_block_size +
952        aux_data_size +
953        aux_padding +
954        frame_size;
955
956    Addr stack_base = memState->getStackBase();
957
958    Addr stack_min = stack_base - space_needed;
959    stack_min = roundDown(stack_min, align);
960
961    unsigned stack_size = stack_base - stack_min;
962    stack_size = roundUp(stack_size, pageSize);
963    memState->setStackSize(stack_size);
964
965    // map memory
966    Addr stack_end = roundDown(stack_base - stack_size, pageSize);
967
968    DPRINTF(Stack, "Mapping the stack: 0x%x %dB\n", stack_end, stack_size);
969    allocateMem(stack_end, stack_size);
970
971    // map out initial stack contents
972    IntType sentry_base = stack_base - sentry_size;
973    IntType file_name_base = sentry_base - file_name_size;
974    IntType env_data_base = file_name_base - env_data_size;
975    IntType arg_data_base = env_data_base - arg_data_size;
976    IntType aux_data_base = arg_data_base - info_block_padding - aux_data_size;
977    IntType auxv_array_base = aux_data_base - aux_array_size - aux_padding;
978    IntType envp_array_base = auxv_array_base - envp_array_size;
979    IntType argv_array_base = envp_array_base - argv_array_size;
980    IntType argc_base = argv_array_base - argc_size;
981
982    DPRINTF(Stack, "The addresses of items on the initial stack:\n");
983    DPRINTF(Stack, "0x%x - file name\n", file_name_base);
984    DPRINTF(Stack, "0x%x - env data\n", env_data_base);
985    DPRINTF(Stack, "0x%x - arg data\n", arg_data_base);
986    DPRINTF(Stack, "0x%x - aux data\n", aux_data_base);
987    DPRINTF(Stack, "0x%x - auxv array\n", auxv_array_base);
988    DPRINTF(Stack, "0x%x - envp array\n", envp_array_base);
989    DPRINTF(Stack, "0x%x - argv array\n", argv_array_base);
990    DPRINTF(Stack, "0x%x - argc \n", argc_base);
991    DPRINTF(Stack, "0x%x - stack min\n", stack_min);
992
993    // write contents to stack
994
995    // figure out argc
996    IntType argc = argv.size();
997    IntType guestArgc = X86ISA::htog(argc);
998
999    // Write out the sentry void *
1000    IntType sentry_NULL = 0;
1001    initVirtMem.writeBlob(sentry_base, &sentry_NULL, sentry_size);
1002
1003    // Write the file name
1004    initVirtMem.writeString(file_name_base, filename.c_str());
1005
1006    // Fix up the aux vectors which point to data
1007    assert(auxv[auxv.size() - 3].type == M5_AT_RANDOM);
1008    auxv[auxv.size() - 3].val = aux_data_base;
1009    assert(auxv[auxv.size() - 2].type == M5_AT_EXECFN);
1010    auxv[auxv.size() - 2].val = argv_array_base;
1011    assert(auxv[auxv.size() - 1].type == M5_AT_PLATFORM);
1012    auxv[auxv.size() - 1].val = aux_data_base + numRandomBytes;
1013
1014
1015    // Copy the aux stuff
1016    Addr auxv_array_end = auxv_array_base;
1017    for (const auto &aux: auxv) {
1018        initVirtMem.write(auxv_array_end, aux, GuestByteOrder);
1019        auxv_array_end += sizeof(aux);
1020    }
1021    // Write out the terminating zeroed auxiliary vector
1022    const AuxVector<uint64_t> zero(0, 0);
1023    initVirtMem.write(auxv_array_end, zero);
1024    auxv_array_end += sizeof(zero);
1025
1026    initVirtMem.writeString(aux_data_base, platform.c_str());
1027
1028    copyStringArray(envp, envp_array_base, env_data_base, initVirtMem);
1029    copyStringArray(argv, argv_array_base, arg_data_base, initVirtMem);
1030
1031    initVirtMem.writeBlob(argc_base, &guestArgc, intSize);
1032
1033    ThreadContext *tc = system->getThreadContext(contextIds[0]);
1034    // Set the stack pointer register
1035    tc->setIntReg(StackPointerReg, stack_min);
1036
1037    // There doesn't need to be any segment base added in since we're dealing
1038    // with the flat segmentation model.
1039    tc->pcState(getStartPC());
1040
1041    // Align the "stack_min" to a page boundary.
1042    memState->setStackMin(roundDown(stack_min, pageSize));
1043}
1044
1045void
1046X86_64Process::argsInit(int pageSize)
1047{
1048    std::vector<AuxVector<uint64_t> > extraAuxvs;
1049    extraAuxvs.emplace_back(M5_AT_SYSINFO_EHDR, vsyscallPage.base);
1050    X86Process::argsInit<uint64_t>(pageSize, extraAuxvs);
1051}
1052
1053void
1054I386Process::argsInit(int pageSize)
1055{
1056    std::vector<AuxVector<uint32_t> > extraAuxvs;
1057    //Tell the binary where the vsyscall part of the vsyscall page is.
1058    extraAuxvs.emplace_back(M5_AT_SYSINFO,
1059            vsyscallPage.base + vsyscallPage.vsyscallOffset);
1060    extraAuxvs.emplace_back(M5_AT_SYSINFO_EHDR, vsyscallPage.base);
1061    X86Process::argsInit<uint32_t>(pageSize, extraAuxvs);
1062}
1063
1064void
1065X86Process::setSyscallReturn(ThreadContext *tc, SyscallReturn retval)
1066{
1067    tc->setIntReg(INTREG_RAX, retval.encodedValue());
1068}
1069
1070RegVal
1071X86_64Process::getSyscallArg(ThreadContext *tc, int &i)
1072{
1073    assert(i < NumArgumentRegs);
1074    return tc->readIntReg(ArgumentReg[i++]);
1075}
1076
1077void
1078X86_64Process::setSyscallArg(ThreadContext *tc, int i, RegVal val)
1079{
1080    assert(i < NumArgumentRegs);
1081    return tc->setIntReg(ArgumentReg[i], val);
1082}
1083
1084void
1085X86_64Process::clone(ThreadContext *old_tc, ThreadContext *new_tc,
1086                     Process *p, RegVal flags)
1087{
1088    X86Process::clone(old_tc, new_tc, p, flags);
1089    ((X86_64Process*)p)->vsyscallPage = vsyscallPage;
1090}
1091
1092RegVal
1093I386Process::getSyscallArg(ThreadContext *tc, int &i)
1094{
1095    assert(i < NumArgumentRegs32);
1096    return tc->readIntReg(ArgumentReg32[i++]);
1097}
1098
1099RegVal
1100I386Process::getSyscallArg(ThreadContext *tc, int &i, int width)
1101{
1102    assert(width == 32 || width == 64);
1103    assert(i < NumArgumentRegs);
1104    uint64_t retVal = tc->readIntReg(ArgumentReg32[i++]) & mask(32);
1105    if (width == 64)
1106        retVal |= ((uint64_t)tc->readIntReg(ArgumentReg[i++]) << 32);
1107    return retVal;
1108}
1109
1110void
1111I386Process::setSyscallArg(ThreadContext *tc, int i, RegVal val)
1112{
1113    assert(i < NumArgumentRegs);
1114    return tc->setIntReg(ArgumentReg[i], val);
1115}
1116
1117void
1118I386Process::clone(ThreadContext *old_tc, ThreadContext *new_tc,
1119                   Process *p, RegVal flags)
1120{
1121    X86Process::clone(old_tc, new_tc, p, flags);
1122    ((I386Process*)p)->vsyscallPage = vsyscallPage;
1123}
1124