From: "Jan Beulich" <JBeulich@suse.com>
To: xen-devel <xen-devel@lists.xenproject.org>
Cc: Andrew Cooper <andrew.cooper3@citrix.com>, Keir Fraser <keir@xen.org>
Subject: [PATCH 1/5] x86emul: fix rIP handling
Date: Wed, 17 Feb 2016 09:32:21 -0700 [thread overview]
Message-ID: <56C4AEA502000078000D348C@prv-mh.provo.novell.com> (raw)
In-Reply-To: <56C4AC2802000078000D3473@prv-mh.provo.novell.com>
[-- Attachment #1: Type: text/plain, Size: 1694 bytes --]
Deal with rIP just like with any other register: Truncate to designated
width upon entry, write back the zero-extended 32-bit value when
emulating 32-bit code, and leave the upper 48 bits unchanged for 16-bit
code.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -570,7 +570,6 @@ do{ asm volatile (
/* Fetch next part of the instruction being emulated. */
#define insn_fetch_bytes(_size) \
({ unsigned long _x = 0, _eip = _regs.eip; \
- if ( !mode_64bit() ) _eip = (uint32_t)_eip; /* ignore upper dword */ \
_regs.eip += (_size); /* real hardware doesn't truncate */ \
generate_exception_if((uint8_t)(_regs.eip - \
ctxt->regs->eip) > MAX_INST_LEN, \
@@ -1492,6 +1491,10 @@ x86_emulate(
#endif
}
+ /* Truncate rIP to def_ad_bytes (2 or 4) if necessary. */
+ if ( def_ad_bytes < sizeof(_regs.eip) )
+ _regs.eip &= (1UL << (def_ad_bytes * 8)) - 1;
+
/* Prefix bytes. */
for ( ; ; )
{
@@ -3783,6 +3786,21 @@ x86_emulate(
/* Commit shadow register state. */
_regs.eflags &= ~EFLG_RF;
+ switch ( __builtin_expect(def_ad_bytes, sizeof(_regs.eip)) )
+ {
+ uint16_t ip;
+
+ case 2:
+ ip = _regs.eip;
+ _regs.eip = ctxt->regs->eip;
+ *(uint16_t *)&_regs.eip = ip;
+ break;
+#ifdef __x86_64__
+ case 4:
+ _regs.rip = _regs._eip;
+ break;
+#endif
+ }
*ctxt->regs = _regs;
done:
[-- Attachment #2: x86emul-truncate-IP.patch --]
[-- Type: text/plain, Size: 1717 bytes --]
x86emul: fix rIP handling
Deal with rIP just like with any other register: Truncate to designated
width upon entry, write back the zero-extended 32-bit value when
emulating 32-bit code, and leave the upper 48 bits unchanged for 16-bit
code.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -570,7 +570,6 @@ do{ asm volatile (
/* Fetch next part of the instruction being emulated. */
#define insn_fetch_bytes(_size) \
({ unsigned long _x = 0, _eip = _regs.eip; \
- if ( !mode_64bit() ) _eip = (uint32_t)_eip; /* ignore upper dword */ \
_regs.eip += (_size); /* real hardware doesn't truncate */ \
generate_exception_if((uint8_t)(_regs.eip - \
ctxt->regs->eip) > MAX_INST_LEN, \
@@ -1492,6 +1491,10 @@ x86_emulate(
#endif
}
+ /* Truncate rIP to def_ad_bytes (2 or 4) if necessary. */
+ if ( def_ad_bytes < sizeof(_regs.eip) )
+ _regs.eip &= (1UL << (def_ad_bytes * 8)) - 1;
+
/* Prefix bytes. */
for ( ; ; )
{
@@ -3783,6 +3786,21 @@ x86_emulate(
/* Commit shadow register state. */
_regs.eflags &= ~EFLG_RF;
+ switch ( __builtin_expect(def_ad_bytes, sizeof(_regs.eip)) )
+ {
+ uint16_t ip;
+
+ case 2:
+ ip = _regs.eip;
+ _regs.eip = ctxt->regs->eip;
+ *(uint16_t *)&_regs.eip = ip;
+ break;
+#ifdef __x86_64__
+ case 4:
+ _regs.rip = _regs._eip;
+ break;
+#endif
+ }
*ctxt->regs = _regs;
done:
[-- Attachment #3: Type: text/plain, Size: 126 bytes --]
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel
next prev parent reply other threads:[~2016-02-17 16:32 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-17 16:21 [PATCH 0/5] x86: XSA-170 follow-up Jan Beulich
2016-02-17 16:32 ` Jan Beulich [this message]
2016-02-17 17:51 ` [PATCH 1/5] x86emul: fix rIP handling Andrew Cooper
2016-02-17 16:35 ` [PATCH 2/5] x86emul: limit-check branch targets Jan Beulich
2016-02-17 17:59 ` Andrew Cooper
2016-02-25 14:52 ` Ping: " Jan Beulich
2016-02-26 9:44 ` Tim Deegan
2016-02-17 16:36 ` [PATCH 3/5] x86emul: simplify IRET logic Jan Beulich
2016-02-17 18:03 ` Andrew Cooper
2016-02-17 16:37 ` [PATCH 4/5] VMX: fold redundant code Jan Beulich
2016-02-17 18:05 ` Andrew Cooper
2016-02-18 5:26 ` Tian, Kevin
2016-02-17 16:38 ` [PATCH 5/5] x86: drop failsafe callback invocation from assembly Jan Beulich
2016-02-17 19:01 ` Andrew Cooper
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=56C4AEA502000078000D348C@prv-mh.provo.novell.com \
--to=jbeulich@suse.com \
--cc=andrew.cooper3@citrix.com \
--cc=keir@xen.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.