[Xen-changelog] [xen stable-4.6] x86emul: correct loading of %ss

[patchbot@xxxxxxx]

commit a4badfa6e7accc1f35f1f09795b40e2715bad3a9
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Wed Sep 28 17:03:13 2016 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Wed Sep 28 17:03:13 2016 +0200

    x86emul: correct loading of %ss
    
    - Instead of #NP, #SS needs to be raised for non-present descriptors.
    - Loading a null selector is fine in 64-bit mode at CPL != 3, as long
      as RPL == CPL.
    - Don't lose the low two selector bits on null selector loads (also
      applies to %ds, %es, %fs, %gs, and LDTR).
    
    Since we need CPL earlier now, also switch to using get_cpl() (instead
    of open coding it).
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    master commit: 5602e74c60c1ec2feef4cdd75376e4b1a1d7e681
    master date: 2016-09-26 17:26:21 +0200
---
 xen/arch/x86/x86_emulate/x86_emulate.c | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c 
b/xen/arch/x86/x86_emulate/x86_emulate.c
index af90884..157c55f 100644
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -588,7 +588,7 @@ do{ asm volatile (                                          
            \
 })
 #define truncate_ea(ea) truncate_word((ea), ad_bytes)
 
-#define mode_64bit() (def_ad_bytes == 8)
+#define mode_64bit() (ctxt->addr_size == 64)
 
 #define fail_if(p)                                      \
 do {                                                    \
@@ -1133,18 +1133,25 @@ protmode_load_seg(
     struct x86_emulate_ctxt *ctxt,
     const struct x86_emulate_ops *ops)
 {
-    struct segment_register desctab, ss;
+    struct segment_register desctab;
     struct { uint32_t a, b; } desc;
-    uint8_t dpl, rpl, cpl;
+    uint8_t dpl, rpl;
+    int cpl = get_cpl(ctxt, ops);
     uint32_t new_desc_b, a_flag = 0x100;
     int rc, fault_type = EXC_GP;
 
+    if ( cpl < 0 )
+        return X86EMUL_UNHANDLEABLE;
+
     /* NULL selector? */
     if ( (sel & 0xfffc) == 0 )
     {
-        if ( (seg == x86_seg_cs) || (seg == x86_seg_ss) )
+        if ( (seg == x86_seg_cs) ||
+             ((seg == x86_seg_ss) &&
+              (!mode_64bit() || (cpl == 3) || (cpl != sel))) )
             goto raise_exn;
         memset(sreg, 0, sizeof(*sreg));
+        sreg->sel = sel;
         return X86EMUL_OKAY;
     }
 
@@ -1152,8 +1159,7 @@ protmode_load_seg(
     if ( !is_x86_user_segment(seg) && (sel & 4) )
         goto raise_exn;
 
-    if ( (rc = ops->read_segment(x86_seg_ss, &ss, ctxt)) ||
-         (rc = ops->read_segment((sel & 4) ? x86_seg_ldtr : x86_seg_gdtr,
+    if ( (rc = ops->read_segment((sel & 4) ? x86_seg_ldtr : x86_seg_gdtr,
                                  &desctab, ctxt)) )
         return rc;
 
@@ -1168,7 +1174,7 @@ protmode_load_seg(
     /* Segment present in memory? */
     if ( !(desc.b & (1u<<15)) )
     {
-        fault_type = EXC_NP;
+        fault_type = seg != x86_seg_ss ? EXC_NP : EXC_SS;
         goto raise_exn;
     }
 
@@ -1187,7 +1193,6 @@ protmode_load_seg(
 
     dpl = (desc.b >> 13) & 3;
     rpl = sel & 3;
-    cpl = ss.attr.fields.dpl;
 
     switch ( seg )
     {
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.6

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog