[Xen-changelog] [xen master] x86emul: suppress memory writes after faulting FPU insns

[patchbot@xxxxxxx]

commit 48965ec2c624d15b0e10ca21da379f45c77f35c4
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Tue Jan 17 10:31:39 2017 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue Jan 17 10:31:39 2017 +0100

    x86emul: suppress memory writes after faulting FPU insns
    
    FPU insns writing to memory must not touch memory if they latch #MF (to
    be delivered on the next waiting FPU insn). Note that inspecting FSW.ES
    needs to be avoided for all FNST* insns, as they don't raise exceptions
    themselves, but may instead be invoked with the bit already set.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
---
 xen/arch/x86/x86_emulate/x86_emulate.c | 36 ++++++++++++++++++++++++++++++++--
 1 file changed, 34 insertions(+), 2 deletions(-)

diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c 
b/xen/arch/x86/x86_emulate/x86_emulate.c
index e9ac1fc..de239b6 100644
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -463,6 +463,9 @@ typedef union {
 #define EFLG_MBS  (1<<1)
 #define EFLG_CF   (1<<0)
 
+/* Floating point status word definitions. */
+#define FSW_ES    (1U << 7)
+
 /* MXCSR bit definitions. */
 #define MXCSR_MM  (1U << 17)
 
@@ -871,6 +874,15 @@ do {                                                       
     \
                           (_fic)->exn_raised);                  \
 } while (0)
 
+static inline bool fpu_check_write(void)
+{
+    uint16_t fsw;
+
+    asm ( "fnstsw %0" : "=am" (fsw) );
+
+    return !(fsw & FSW_ES);
+}
+
 #define emulate_fpu_insn(_op)                           \
     asm volatile (                                      \
         "movb $2f-1f,%0 \n"                             \
@@ -3824,6 +3836,13 @@ x86_emulate(
             default:
                 generate_exception(EXC_UD);
             }
+            /*
+             * Control instructions can't raise FPU exceptions, so we need
+             * to consider suppressing writes only for non-control ones. All
+             * of them in this group have data width 4.
+             */
+            if ( dst.type == OP_MEM && dst.bytes == 4 && !fpu_check_write() )
+                dst.type = OP_NONE;
         }
         put_fpu(&fic);
         break;
@@ -3936,7 +3955,8 @@ x86_emulate(
             case 7: /* fstp m80fp */
                 fail_if(!ops->write);
                 emulate_fpu_insn_memdst("fstpt", *mmvalp);
-                if ( (rc = ops->write(ea.mem.seg, ea.mem.off, mmvalp,
+                if ( fpu_check_write() &&
+                     (rc = ops->write(ea.mem.seg, ea.mem.off, mmvalp,
                                       10, ctxt)) != X86EMUL_OKAY )
                     goto done;
                 dst.type = OP_NONE;
@@ -3944,6 +3964,8 @@ x86_emulate(
             default:
                 generate_exception(EXC_UD);
             }
+            if ( dst.type == OP_MEM && !fpu_check_write() )
+                dst.type = OP_NONE;
         }
         put_fpu(&fic);
         break;
@@ -4047,6 +4069,13 @@ x86_emulate(
             default:
                 generate_exception(EXC_UD);
             }
+            /*
+             * Control instructions can't raise FPU exceptions, so we need
+             * to consider suppressing writes only for non-control ones. All
+             * of them in this group have data width 8.
+             */
+            if ( dst.type == OP_MEM && dst.bytes == 8 && !fpu_check_write() )
+                dst.type = OP_NONE;
         }
         put_fpu(&fic);
         break;
@@ -4164,7 +4193,8 @@ x86_emulate(
             case 6: /* fbstp packed bcd */
                 fail_if(!ops->write);
                 emulate_fpu_insn_memdst("fbstp", *mmvalp);
-                if ( (rc = ops->write(ea.mem.seg, ea.mem.off, mmvalp,
+                if ( fpu_check_write() &&
+                     (rc = ops->write(ea.mem.seg, ea.mem.off, mmvalp,
                                       10, ctxt)) != X86EMUL_OKAY )
                     goto done;
                 dst.type = OP_NONE;
@@ -4174,6 +4204,8 @@ x86_emulate(
                 dst.bytes = 8;
                 break;
             }
+            if ( dst.type == OP_MEM && !fpu_check_write() )
+                dst.type = OP_NONE;
         }
         put_fpu(&fic);
         break;
--
generated by git-patchbot for /home/xen/git/xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog