[Xen-devel] [PATCH] x86/emul: Fix the decoding of segment overrides in 64bit mode

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

Explicit segment overides other than %fs and %gs are documented as ignored by
both Intel and AMD.

In practice, this means that:

 * Explicit uses of %ss don't actually yield #SS[0] for non-canonical
   memory references.
 * Explicit uses of %{e,c,d}s don't override %rbp/%rsp-based memory references
   to yield #GP[0] for non-canonical memory references.

Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
---
CC: Jan Beulich <JBeulich@xxxxxxxx>

I've got 3/4's of an XTF test for this, but not enough time to get it finished
in any reasable period.  I noticed the issue originally when getting some
unexpected results from VMX_INSTRUCTION_INFO in some unrelated nested virt
work.
---
 xen/arch/x86/x86_emulate/x86_emulate.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c 
b/xen/arch/x86/x86_emulate/x86_emulate.c
index d192280..85383ea 100644
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -2505,6 +2505,10 @@ x86_decode(
     }
  done_prefixes:
 
+    /* %{e,c,s,d}s overrides are ignored in 64bit mode. */
+    if ( mode_64bit() && override_seg < x86_seg_fs )
+        override_seg = x86_seg_none;
+
     if ( rex_prefix & REX_W )
         op_bytes = 8;
 
-- 
2.1.4


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel