# HG changeset patch
# User kfraser@xxxxxxxxxxxxxxxxxxxxx
# Date 1168612710 0
# Node ID 7ad205a162a8f4fb1213a4be4e69787bcf98ce9d
# Parent 3f419d1606479facd54b6eebb4226d5223de2574
x86: properly handle LOCK prefix in privileged PV opcode emulation
- include LOCK prefix presence in calculation of which CR/DR is being
targeted by moves to/from these registers
- fail any other opcodes when beingused with lock prefix
Signed-off-by: Jan Beulich <jbeulich@xxxxxxxxxx>
---
xen/arch/x86/traps.c | 16 +++++++++++-----
1 files changed, 11 insertions(+), 5 deletions(-)
diff -r 3f419d160647 -r 7ad205a162a8 xen/arch/x86/traps.c
--- a/xen/arch/x86/traps.c Fri Jan 12 14:33:36 2007 +0000
+++ b/xen/arch/x86/traps.c Fri Jan 12 14:38:30 2007 +0000
@@ -1121,7 +1121,7 @@ static int emulate_privileged_op(struct
{
struct vcpu *v = current;
unsigned long *reg, eip = regs->eip, res;
- u8 opcode, modrm_reg = 0, modrm_rm = 0, rep_prefix = 0, rex = 0;
+ u8 opcode, modrm_reg = 0, modrm_rm = 0, rep_prefix = 0, lock = 0, rex = 0;
enum { lm_seg_none, lm_seg_fs, lm_seg_gs } lm_ovr = lm_seg_none;
unsigned int port, i, data_sel, ar, data, rc;
unsigned int op_bytes, op_default, ad_bytes, ad_default;
@@ -1184,6 +1184,7 @@ static int emulate_privileged_op(struct
data_sel = regs->ss;
continue;
case 0xf0: /* LOCK */
+ lock = 1;
continue;
case 0xf2: /* REPNE/REPNZ */
case 0xf3: /* REP/REPE/REPZ */
@@ -1210,6 +1211,9 @@ static int emulate_privileged_op(struct
if ( opcode == 0x0f )
goto twobyte_opcode;
+ if ( lock )
+ goto fail;
+
/* Input/Output String instructions. */
if ( (opcode >= 0x6c) && (opcode <= 0x6f) )
{
@@ -1472,6 +1476,8 @@ static int emulate_privileged_op(struct
/* Privileged (ring 0) instructions. */
opcode = insn_fetch(u8, code_base, eip, code_limit);
+ if ( lock && (opcode & ~3) != 0x20 )
+ goto fail;
switch ( opcode )
{
case 0x06: /* CLTS */
@@ -1490,7 +1496,7 @@ static int emulate_privileged_op(struct
case 0x20: /* MOV CR?,<reg> */
opcode = insn_fetch(u8, code_base, eip, code_limit);
- modrm_reg |= (opcode >> 3) & 7;
+ modrm_reg += ((opcode >> 3) & 7) + (lock << 3);
modrm_rm |= (opcode >> 0) & 7;
reg = decode_register(modrm_rm, regs, 0);
switch ( modrm_reg )
@@ -1530,7 +1536,7 @@ static int emulate_privileged_op(struct
case 0x21: /* MOV DR?,<reg> */
opcode = insn_fetch(u8, code_base, eip, code_limit);
- modrm_reg |= (opcode >> 3) & 7;
+ modrm_reg += ((opcode >> 3) & 7) + (lock << 3);
modrm_rm |= (opcode >> 0) & 7;
reg = decode_register(modrm_rm, regs, 0);
if ( (res = do_get_debugreg(modrm_reg)) > (unsigned long)-256 )
@@ -1540,7 +1546,7 @@ static int emulate_privileged_op(struct
case 0x22: /* MOV <reg>,CR? */
opcode = insn_fetch(u8, code_base, eip, code_limit);
- modrm_reg |= (opcode >> 3) & 7;
+ modrm_reg += ((opcode >> 3) & 7) + (lock << 3);
modrm_rm |= (opcode >> 0) & 7;
reg = decode_register(modrm_rm, regs, 0);
switch ( modrm_reg )
@@ -1588,7 +1594,7 @@ static int emulate_privileged_op(struct
case 0x23: /* MOV <reg>,DR? */
opcode = insn_fetch(u8, code_base, eip, code_limit);
- modrm_reg |= (opcode >> 3) & 7;
+ modrm_reg += ((opcode >> 3) & 7) + (lock << 3);
modrm_rm |= (opcode >> 0) & 7;
reg = decode_register(modrm_rm, regs, 0);
if ( do_set_debugreg(modrm_reg, *reg) != 0 )
_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog
|
Home