The exit_code parameter of cpu_vmexit is declared as uint32_t, but exit codes are 64 bits wide according to the AMD SVM specification. And because uint32_t is unsigned, this causes exit codes to be zero-extended, for example writing SVM_EXIT_ERR as 0xffff_ffff instead of the expected 0xffff_ffff_ffff_ffff.
Cc: [email protected] Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2977 Signed-off-by: Paolo Bonzini <[email protected]> --- target/i386/tcg/helper-tcg.h | 2 +- target/i386/tcg/system/svm_helper.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/target/i386/tcg/helper-tcg.h b/target/i386/tcg/helper-tcg.h index be011b06b7c..e41cbda407a 100644 --- a/target/i386/tcg/helper-tcg.h +++ b/target/i386/tcg/helper-tcg.h @@ -99,7 +99,7 @@ void cpu_load_eflags(CPUX86State *env, int eflags, int update_mask); /* system/svm_helper.c */ #ifndef CONFIG_USER_ONLY -G_NORETURN void cpu_vmexit(CPUX86State *nenv, uint32_t exit_code, +G_NORETURN void cpu_vmexit(CPUX86State *nenv, uint64_t exit_code, uint64_t exit_info_1, uintptr_t retaddr); void do_vmexit(CPUX86State *env); #endif diff --git a/target/i386/tcg/system/svm_helper.c b/target/i386/tcg/system/svm_helper.c index 505788b0e26..4b86796518f 100644 --- a/target/i386/tcg/system/svm_helper.c +++ b/target/i386/tcg/system/svm_helper.c @@ -128,7 +128,7 @@ static inline bool virtual_gif_enabled(CPUX86State *env) return false; } -static inline bool virtual_vm_load_save_enabled(CPUX86State *env, uint32_t exit_code, uintptr_t retaddr) +static inline bool virtual_vm_load_save_enabled(CPUX86State *env, uint64_t exit_code, uintptr_t retaddr) { uint64_t lbr_ctl; @@ -723,7 +723,7 @@ void helper_svm_check_io(CPUX86State *env, uint32_t port, uint32_t param, } } -void cpu_vmexit(CPUX86State *env, uint32_t exit_code, uint64_t exit_info_1, +void cpu_vmexit(CPUX86State *env, uint64_t exit_code, uint64_t exit_info_1, uintptr_t retaddr) { CPUState *cs = env_cpu(env); @@ -732,7 +732,7 @@ void cpu_vmexit(CPUX86State *env, uint32_t exit_code, uint64_t exit_info_1, qemu_log_mask(CPU_LOG_TB_IN_ASM, "vmexit(%08x, %016" PRIx64 ", %016" PRIx64 ", " TARGET_FMT_lx ")!\n", - exit_code, exit_info_1, + (uint32_t)exit_code, exit_info_1, x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2)), env->eip); -- 2.51.1
