[Xen-changelog] [xen master] x86emul: correct compat mode system descriptor handling

[patchbot@xxxxxxx]

commit 39f79c4723460d89ed0e0c7aef5630c5a05abb1a
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Fri Apr 7 09:04:02 2017 +0000
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Fri Apr 7 12:07:24 2017 +0100

    x86emul: correct compat mode system descriptor handling
    
    There are some oddities to take care of here - see the code comment.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Tested-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
---
 xen/arch/x86/x86_emulate/x86_emulate.c | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c 
b/xen/arch/x86/x86_emulate/x86_emulate.c
index 9841fdd..c32fe2d 100644
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -1802,9 +1802,22 @@ protmode_load_seg(
 
     if ( !is_x86_user_segment(seg) )
     {
-        bool lm = (desc.b & (1u << 12)) ? false : ctxt->lma;
+        /*
+         * Whether to use an 8- or 16-byte descriptor in long mode depends
+         * on sub-mode, descriptor type, and vendor:
+         * - non-system descriptors are always 8-byte ones,
+         * - system descriptors are always 16-byte ones in 64-bit mode,
+         * - (call) gates are always 16-byte ones,
+         * - other system descriptors in compatibility mode have
+         *   - only their low 8-byte bytes read on Intel,
+         *   - all 16 bytes read with the high 8 bytes ignored on AMD.
+         */
+        bool wide = desc.b & 0x1000
+                    ? false : (desc.b & 0xf00) != 0xc00 &&
+                               ctxt->vendor != X86_VENDOR_AMD
+                               ? mode_64bit() : ctxt->lma;
 
-        if ( lm )
+        if ( wide )
         {
             switch ( rc = ops->read(sel_seg, (sel & 0xfff8) + 8,
                                     &desc_hi, sizeof(desc_hi), ctxt) )
@@ -1819,6 +1832,9 @@ protmode_load_seg(
             default:
                 return rc;
             }
+            if ( !mode_64bit() && ctxt->vendor == X86_VENDOR_AMD &&
+                 (desc.b & 0xf00) != 0xc00 )
+                desc_hi.b = desc_hi.a = 0;
             if ( (desc_hi.b & 0x00001f00) ||
                  (seg != x86_seg_none &&
                   !is_canonical_address((uint64_t)desc_hi.a << 32)) )
--
generated by git-patchbot for /home/xen/git/xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog