[Xen-changelog] [xen stable-4.8] x86emul: VEX.B is ignored in compatibility mode

[patchbot@xxxxxxx]

commit 6240d926c4cfe5f83fc940e61d1c0418a8710791
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Thu Feb 9 10:21:50 2017 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Thu Feb 9 10:21:50 2017 +0100

    x86emul: VEX.B is ignored in compatibility mode
    
    While VEX.R and VEX.X are guaranteed to be 1 in compatibility mode
    (and hence a respective mode_64bit() check can be dropped), VEX.B can
    be encoded as zero, but would be ignored by the processor. Since we
    emulate instructions in 64-bit mode (except possibly in the test
    harness), we need to force the bit to 1 in order to not act on the
    wrong {X,Y,Z}MM register (which has no bad effect on 32-bit test
    harness builds, as there the bit would again be ignored by the
    hardware, and would by default be expected to be 1 anyway).
    
    We must not, however, fiddle with the high bit of VEX.VVVV in the
    decode phase, as that would undermine the checking of instructions
    requiring the field to be all ones independent of mode. This is
    being enforced in copy_REX_VEX() instead.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    
    x86emul: correct VEX/XOP/EVEX operand size handling for 16-bit code
    
    Operand size defaults to 32 bits in that case, but would not have been
    set that way in the absence of an operand size override.
    
    Reported-by: Wei Liu <wei.liu2@xxxxxxxxxx> (by AFL fuzzing)
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    master commit: 89c76ee7f60777b81c8fd0475a6af7c84e72a791
    master date: 2017-01-17 10:32:25 +0100
    master commit: beb82042447c5d6e7073d816d6afc25c5a423cde
    master date: 2017-01-25 15:08:59 +0100
---
 xen/arch/x86/x86_emulate/x86_emulate.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c 
b/xen/arch/x86/x86_emulate/x86_emulate.c
index b06c456..651506c 100644
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -331,7 +331,11 @@ union vex {
 
 #define copy_REX_VEX(ptr, rex, vex) do { \
     if ( (vex).opcx != vex_none ) \
+    { \
+        if ( !mode_64bit() ) \
+            vex.reg |= 8; \
         ptr[0] = 0xc4, ptr[1] = (vex).raw[0], ptr[2] = (vex).raw[1]; \
+    } \
     else if ( mode_64bit() ) \
         ptr[1] = rex | REX_PREFIX; \
 } while (0)
@@ -2027,6 +2031,11 @@ x86_decode(
             case 8:
                 /* VEX / XOP / EVEX */
                 generate_exception_if(rex_prefix || vex.pfx, EXC_UD, -1);
+                /*
+                 * With operand size override disallowed (see above), op_bytes
+                 * should not have changed from its default.
+                 */
+                ASSERT(op_bytes == def_op_bytes);
 
                 vex.raw[0] = modrm;
                 if ( b == 0xc5 )
@@ -2053,6 +2062,12 @@ x86_decode(
                             op_bytes = 8;
                         }
                     }
+                    else
+                    {
+                        /* Operand size fixed at 4 (no override via W bit). */
+                        op_bytes = 4;
+                        vex.b = 1;
+                    }
                     switch ( b )
                     {
                     case 0x62:
@@ -2071,7 +2086,7 @@ x86_decode(
                         break;
                     }
                 }
-                if ( mode_64bit() && !vex.r )
+                if ( !vex.r )
                     rex_prefix |= REX_R;
 
                 ext = vex.opcx;
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.8

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog