[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-devel] [PATCH] x86/emul: Correct the decoding of mov to/from cr/dr
The mov to/from cr/dr behave as if they were encoded with Mod = 3. When encoded with Mod != 3, no displacement or SIB bytes are fetched. Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx> --- CC: Jan Beulich <JBeulich@xxxxxxxx> --- tools/tests/x86_emulator/test_x86_emulator.c | 21 +++++++++++++++++++++ xen/arch/x86/x86_emulate/x86_emulate.c | 20 +++++++++++++++++++- 2 files changed, 40 insertions(+), 1 deletion(-) diff --git a/tools/tests/x86_emulator/test_x86_emulator.c b/tools/tests/x86_emulator/test_x86_emulator.c index 37d00f1..b588a8d 100644 --- a/tools/tests/x86_emulator/test_x86_emulator.c +++ b/tools/tests/x86_emulator/test_x86_emulator.c @@ -894,6 +894,27 @@ int main(int argc, char **argv) } printf("okay\n"); + printf("%-40s", "Testing mov %%cr4,%%esi (bad ModRM)..."); + /* + * Mod = 1, Reg = 4, R/M = 6 would normally encode a memory reference of + * disp8(%esi), but mov to/from cr/dr are special and behave as if they + * were encoded with Mod == 3. + */ + instr[0] = 0x0f; instr[1] = 0x20, instr[2] = 0146; + instr[3] = 0; /* Supposed disp8. */ + regs.esi = 0; + regs.eip = (unsigned long)&instr[0]; + rc = x86_emulate(&ctxt, &emulops); + /* + * We don't care precicely what gets read from %cr4 into %esi, just so + * long as ModRM is treated as a register operand and 0(%esi) isn't + * followed as a memory reference. + */ + if ( (rc != X86EMUL_OKAY) || + (regs.eip != (unsigned long)&instr[3]) ) + goto fail; + printf("okay\n"); + #define decl_insn(which) extern const unsigned char which[], \ which##_end[] asm ( ".L" #which "_end" ) #define put_insn(which, insn) ".pushsection .test, \"ax\", @progbits\n" \ diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c index ad62420..58be737 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -2086,7 +2086,8 @@ x86_decode_twobyte( } /* fall through */ case 0x21: case 0x23: /* mov to/from dr */ - generate_exception_if(lock_prefix || ea.type != OP_REG, EXC_UD); + ASSERT(ea.type == OP_REG); /* Early operand adjustment ensures this. */ + generate_exception_if(lock_prefix, EXC_UD); op_bytes = mode_64bit() ? 8 : 4; break; @@ -2427,6 +2428,23 @@ x86_decode( break; } } + else if ( ext == ext_0f ) + { + switch ( b ) + { + case 0x20: /* mov cr,reg */ + case 0x21: /* mov dr,reg */ + case 0x22: /* mov reg,cr */ + case 0x23: /* mov reg,dr */ + /* + * Mov to/from cr/dr ignore the encoding of Mod, and behave as + * if they were encoded as reg/reg instructions. No futher + * disp/SIB bytes are fetched. + */ + modrm_mod = 3; + break; + } + } if ( modrm_mod == 3 ) { -- 2.1.4 _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxx https://lists.xen.org/xen-devel
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |