From: Nadav Amit <namit@cs.technion.ac.il>
To: pbonzini@redhat.com
Cc: kvm@vger.kernel.org, Nadav Amit <namit@cs.technion.ac.il>
Subject: [PATCH 6/8] KVM: x86: POP [ESP] is not emulated correctly
Date: Thu, 25 Dec 2014 02:52:21 +0200 [thread overview]
Message-ID: <1419468743-23732-7-git-send-email-namit@cs.technion.ac.il> (raw)
In-Reply-To: <1419468743-23732-1-git-send-email-namit@cs.technion.ac.il>
According to Intel SDM: "If the ESP register is used as a base register for
addressing a destination operand in memory, the POP instruction computes the
effective address of the operand after it increments the ESP register."
The current emulation does not behave so. The fix required to waste another
of the precious instruction flags and to check the flag in decode_modrm.
Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
---
arch/x86/kvm/emulate.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index 7f80f01..7bf3548 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -171,6 +171,7 @@
#define PrivUD ((u64)1 << 51) /* #UD instead of #GP on CPL > 0 */
#define NearBranch ((u64)1 << 52) /* Near branches */
#define No16 ((u64)1 << 53) /* No 16 bit operand */
+#define IncSP ((u64)1 << 54) /* SP is incremented before ModRM calc */
#define DstXacc (DstAccLo | SrcAccHi | SrcWrite)
@@ -1229,6 +1230,10 @@ static int decode_modrm(struct x86_emulate_ctxt *ctxt,
else {
modrm_ea += reg_read(ctxt, base_reg);
adjust_modrm_seg(ctxt, base_reg);
+ /* Increment ESP on POP [ESP] */
+ if ((ctxt->d & IncSP) &&
+ base_reg == VCPU_REGS_RSP)
+ modrm_ea += ctxt->op_bytes;
}
if (index_reg != 4)
modrm_ea += reg_read(ctxt, index_reg) << scale;
@@ -3825,7 +3830,7 @@ static const struct opcode group1[] = {
};
static const struct opcode group1A[] = {
- I(DstMem | SrcNone | Mov | Stack, em_pop), N, N, N, N, N, N, N,
+ I(DstMem | SrcNone | Mov | Stack | IncSP, em_pop), N, N, N, N, N, N, N,
};
static const struct opcode group2[] = {
--
1.9.1
next prev parent reply other threads:[~2014-12-25 0:52 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-12-25 0:52 [PATCH 0/8] KVM: x86: Emulator fixes Nadav Amit
2014-12-25 0:52 ` [PATCH 1/8] KVM: x86: #PF error-code on R/W operations is wrong Nadav Amit
2014-12-26 7:25 ` Wu, Feng
2014-12-27 19:55 ` Nadav Amit
2014-12-25 0:52 ` [PATCH 2/8] KVM: x86: pop sreg accesses only 2 bytes Nadav Amit
2014-12-25 9:10 ` Chen, Tiejun
2014-12-25 9:55 ` Nadav Amit
2014-12-26 1:54 ` Chen, Tiejun
2014-12-26 7:25 ` Wu, Feng
2014-12-27 20:05 ` Nadav Amit
2014-12-25 0:52 ` [PATCH 3/8] KVM: x86: fnstcw and fnstsw may cause spurious exception Nadav Amit
2014-12-25 0:52 ` [PATCH 4/8] KVM: x86: JMP/CALL using call- or task-gate causes exception Nadav Amit
2014-12-25 0:52 ` [PATCH 5/8] KVM: x86: em_call_far should return failure result Nadav Amit
2014-12-25 0:52 ` Nadav Amit [this message]
2014-12-25 0:52 ` [PATCH 7/8] KVM: x86: Do not set access bit on accessed segments Nadav Amit
2014-12-25 0:52 ` [PATCH 8/8] KVM: x86: Access to LDT/GDT that wraparound is incorrect Nadav Amit
2014-12-27 22:24 ` [PATCH 0/8] KVM: x86: Emulator fixes Paolo Bonzini
2015-01-08 10:42 ` Paolo Bonzini
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1419468743-23732-7-git-send-email-namit@cs.technion.ac.il \
--to=namit@cs.technion.ac.il \
--cc=kvm@vger.kernel.org \
--cc=pbonzini@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.