[Xen-changelog] [xen stable-4.6] x86emul: fix pushing of selector registers

[patchbot@xxxxxxx]

commit d2b7b92d7e3566d43e74a161a50bcf2942a67b33
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Tue Oct 25 17:18:16 2016 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue Oct 25 17:18:16 2016 +0200

    x86emul: fix pushing of selector registers
    
    Both explicit PUSH and far CALL currently push unrelated data (the
    segment attributes word) in the high half (attributes and limit in the
    64-bit case in the high 48 bits) instead of zero. To avoid having to
    apply this and further changes in multiple places, also fold the two
    (respectively) far call/jmp instances into one.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    master commit: 373923ed9c2ed36925f574387db2be2ebe5ce45a
    master date: 2016-10-14 14:09:16 +0200
---
 xen/arch/x86/x86_emulate/x86_emulate.c | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c 
b/xen/arch/x86/x86_emulate/x86_emulate.c
index ad24d6a..a1db36f 100644
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -2090,13 +2090,8 @@ x86_emulate(
         fail_if(ops->read_segment == NULL);
         if ( (rc = ops->read_segment(src.val, &reg, ctxt)) != 0 )
             return rc;
-        /* 64-bit mode: PUSH defaults to a 64-bit operand. */
-        if ( mode_64bit() && (op_bytes == 4) )
-            op_bytes = 8;
-        if ( (rc = ops->write(x86_seg_ss, sp_pre_dec(op_bytes),
-                              &reg.sel, op_bytes, ctxt)) != 0 )
-            goto done;
-        break;
+        src.val = reg.sel;
+        goto push;
     }
 
     case 0x07: /* pop %%es */
@@ -2541,8 +2536,9 @@ x86_emulate(
         if ( (rc = ops->read_segment(x86_seg_cs, &reg, ctxt)) ||
              (rc = load_seg(x86_seg_cs, sel, 0, &cs, ctxt, ops)) ||
              (validate_far_branch(&cs, eip),
+              src.val = reg.sel,
               rc = ops->write(x86_seg_ss, sp_pre_dec(op_bytes),
-                              &reg.sel, op_bytes, ctxt)) ||
+                              &src.val, op_bytes, ctxt)) ||
              (rc = ops->write(x86_seg_ss, sp_pre_dec(op_bytes),
                               &_regs.eip, op_bytes, ctxt)) ||
              (rc = ops->write_segment(x86_seg_cs, &cs, ctxt)) )
@@ -3841,8 +3837,9 @@ x86_emulate(
                 if ( (rc = ops->read_segment(x86_seg_cs, &reg, ctxt)) ||
                      (rc = load_seg(x86_seg_cs, sel, 0, &cs, ctxt, ops)) ||
                      (validate_far_branch(&cs, src.val),
+                      dst.val = reg.sel,
                       rc = ops->write(x86_seg_ss, sp_pre_dec(op_bytes),
-                                      &reg.sel, op_bytes, ctxt)) ||
+                                      &dst.val, op_bytes, ctxt)) ||
                      (rc = ops->write(x86_seg_ss, sp_pre_dec(op_bytes),
                                       &_regs.eip, op_bytes, ctxt)) ||
                      (rc = ops->write_segment(x86_seg_cs, &cs, ctxt)) )
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.6

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog