target/i386: emulate, hvf: rdmsr/wrmsr GPF handling
In that case, the instruction pointer mustn't be incremented. Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr> Link: https://lore.kernel.org/r/20260422214225.2242-34-mohamed@unpredictable.fr Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Mohamed Mediouni committed
Apr 22, 2026 at 23:42 UTC
de03f1bf1ab0bb35cf8228e4c5eb6dc91150f399
4 files changed
+17
-10
target/i386/emulate/x86_emu.c
+6
-4
@@ -792,15 +792,17 @@ void x86_emul_raise_exception(CPUX86State *env, int exception_index, int error_c
792
793
static bool exec_rdmsr(CPUX86State *env, struct x86_decode *decode)
794
{
795
- emul_ops->simulate_rdmsr(env_cpu(env));
796
- env->eip += decode->len;
795
+ if (!emul_ops->simulate_rdmsr(env_cpu(env))) {
796
+ env->eip += decode->len;
797
+ }
798
return 0;
799
}
800
801
static bool exec_wrmsr(CPUX86State *env, struct x86_decode *decode)
802
{
802
- emul_ops->simulate_wrmsr(env_cpu(env));
803
- env->eip += decode->len;
803
+ if (!emul_ops->simulate_wrmsr(env_cpu(env))) {
804
+ env->eip += decode->len;
805
+ }
806
return 0;
807
}
808
target/i386/emulate/x86_emu.h
+2
-2
@@ -31,8 +31,8 @@ struct x86_emul_ops {
31
target_ulong (*read_cr) (CPUState *cpu, int cr);
32
void (*handle_io)(CPUState *cpu, uint16_t port, void *data, int direction,
33
int size, int count);
34
- void (*simulate_rdmsr)(CPUState *cs);
35
- void (*simulate_wrmsr)(CPUState *cs);
34
+ bool (*simulate_rdmsr)(CPUState *cs);
35
+ bool (*simulate_wrmsr)(CPUState *cs);
36
bool (*is_protected_mode)(CPUState *cpu);
37
bool (*is_long_mode)(CPUState *cpu);
38
bool (*is_user_mode)(CPUState *cpu);
target/i386/hvf/hvf-i386.h
+2
-2
@@ -19,8 +19,8 @@
19
uint32_t hvf_get_supported_cpuid(uint32_t func, uint32_t idx, int reg);
20
21
void hvf_handle_io(CPUState *, uint16_t, void *, int, int, int);
22
-void hvf_simulate_rdmsr(CPUState *cpu);
23
-void hvf_simulate_wrmsr(CPUState *cpu);
22
+bool hvf_simulate_rdmsr(CPUState *cpu);
23
+bool hvf_simulate_wrmsr(CPUState *cpu);
24
25
/* Host specific functions */
26
int hvf_inject_interrupt(CPUArchState *env, int vector);
target/i386/hvf/hvf.c
+7
-2
@@ -536,7 +536,7 @@ void hvf_store_regs(CPUState *cs)
536
macvm_set_rip(cs, env->eip);
537
}
538
539
-void hvf_simulate_rdmsr(CPUState *cs)
539
+bool hvf_simulate_rdmsr(CPUState *cs)
540
{
541
X86CPU *cpu = X86_CPU(cs);
542
CPUX86State *env = &cpu->env;
@@ -557,6 +557,7 @@ void hvf_simulate_rdmsr(CPUState *cs)
557
ret = apic_msr_read(cpu->apic_state, index, &val);
558
if (ret < 0) {
559
x86_emul_raise_exception(env, EXCP0D_GPF, 0);
560
+ return 1;
561
}
562
563
break;
@@ -639,9 +640,10 @@ void hvf_simulate_rdmsr(CPUState *cs)
640
641
RAX(env) = (uint32_t)val;
642
RDX(env) = (uint32_t)(val >> 32);
643
+ return 0;
644
}
645
644
-void hvf_simulate_wrmsr(CPUState *cs)
646
+bool hvf_simulate_wrmsr(CPUState *cs)
647
{
648
X86CPU *cpu = X86_CPU(cs);
649
CPUX86State *env = &cpu->env;
@@ -657,6 +659,7 @@ void hvf_simulate_wrmsr(CPUState *cs)
659
r = cpu_set_apic_base(cpu->apic_state, data);
660
if (r < 0) {
661
x86_emul_raise_exception(env, EXCP0D_GPF, 0);
662
+ return 1;
663
}
664
665
break;
@@ -668,6 +671,7 @@ void hvf_simulate_wrmsr(CPUState *cs)
671
ret = apic_msr_write(cpu->apic_state, index, data);
672
if (ret < 0) {
673
x86_emul_raise_exception(env, EXCP0D_GPF, 0);
674
+ return 1;
675
}
676
677
break;
@@ -746,6 +750,7 @@ void hvf_simulate_wrmsr(CPUState *cs)
750
g_hypervisor_iface->wrmsr_handler(cs, msr, data);
751
752
printf("write msr %llx\n", RCX(cs));*/
753
+ return 0;
754
}
755
756
static int hvf_handle_vmexit(CPUState *cpu)