File 5800caec-x86emul-fix-pushing-of-selector-regist... of Package xen.10696

Overview Repositories Revisions Requests Users Attributes Meta

File 5800caec-x86emul-fix-pushing-of-selector-registers.patch of Package xen.10696

# Commit 373923ed9c2ed36925f574387db2be2ebe5ce45a
# Date 2016-10-14 14:09:16 +0200
# Author Jan Beulich <jbeulich@suse.com>
# Committer Jan Beulich <jbeulich@suse.com>
x86emul: fix pushing of selector registers

Both explicit PUSH and far CALL currently push unrelated data (the
segment attributes word) in the high half (attributes and limit in the
64-bit case in the high 48 bits) instead of zero. To avoid having to
apply this and further changes in multiple places, also fold the two
(respectively) far call/jmp instances into one.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>

--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -2085,13 +2085,8 @@ x86_emulate(
         fail_if(ops->read_segment == NULL);
         if ( (rc = ops->read_segment(src.val, &reg, ctxt)) != 0 )
             return rc;
-        /* 64-bit mode: PUSH defaults to a 64-bit operand. */
-        if ( mode_64bit() && (op_bytes == 4) )
-            op_bytes = 8;
-        if ( (rc = ops->write(x86_seg_ss, sp_pre_dec(op_bytes),
-                              &reg.sel, op_bytes, ctxt)) != 0 )
-            goto done;
-        break;
+        src.val = reg.sel;
+        goto push;
     }
 
     case 0x07: /* pop %%es */
@@ -2536,8 +2531,9 @@ x86_emulate(
         if ( (rc = ops->read_segment(x86_seg_cs, &reg, ctxt)) ||
              (rc = load_seg(x86_seg_cs, sel, 0, &cs, ctxt, ops)) ||
              (validate_far_branch(&cs, eip),
+              src.val = reg.sel,
               rc = ops->write(x86_seg_ss, sp_pre_dec(op_bytes),
-                              &reg.sel, op_bytes, ctxt)) ||
+                              &src.val, op_bytes, ctxt)) ||
              (rc = ops->write(x86_seg_ss, sp_pre_dec(op_bytes),
                               &_regs.eip, op_bytes, ctxt)) ||
              (rc = ops->write_segment(x86_seg_cs, &cs, ctxt)) )
@@ -3826,8 +3822,9 @@ x86_emulate(
                 if ( (rc = ops->read_segment(x86_seg_cs, &reg, ctxt)) ||
                      (rc = load_seg(x86_seg_cs, sel, 0, &cs, ctxt, ops)) ||
                      (validate_far_branch(&cs, src.val),
+                      dst.val = reg.sel,
                       rc = ops->write(x86_seg_ss, sp_pre_dec(op_bytes),
-                                      &reg.sel, op_bytes, ctxt)) ||
+                                      &dst.val, op_bytes, ctxt)) ||
                      (rc = ops->write(x86_seg_ss, sp_pre_dec(op_bytes),
                                       &_regs.eip, op_bytes, ctxt)) ||
                      (rc = ops->write_segment(x86_seg_cs, &cs, ctxt)) )

Places

File 5800caec-x86emul-fix-pushing-of-selector-registers.patch of Package xen.10696

Places