From: Jan Beulich Date: Wed, 21 Dec 2016 15:58:20 +0000 (+0100) Subject: x86emul: don't unconditionally clear segment bases upon null selector loads X-Git-Tag: archive/raspbian/4.11.1-1+rpi1~1^2~66^2~3095 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=bd755bf9170ef10e1c14ee4ba8399a5153debf21;p=xen.git x86emul: don't unconditionally clear segment bases upon null selector loads AMD explicitly documents that namely FS and GS don't have their bases cleared in that case, and I see no reason why guests may not rely on that behavior. To facilitate this a new input field (the CPU vendor) is being added. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper --- diff --git a/tools/tests/x86_emulator/test_x86_emulator.c b/tools/tests/x86_emulator/test_x86_emulator.c index 79d8311dd5..2de8cbb57c 100644 --- a/tools/tests/x86_emulator/test_x86_emulator.c +++ b/tools/tests/x86_emulator/test_x86_emulator.c @@ -119,6 +119,7 @@ int main(int argc, char **argv) ctxt.regs = ®s; ctxt.force_writeback = 0; + ctxt.vendor = X86_VENDOR_UNKNOWN; ctxt.addr_size = 8 * sizeof(void *); ctxt.sp_size = 8 * sizeof(void *); diff --git a/tools/tests/x86_emulator/x86_emulate.h b/tools/tests/x86_emulator/x86_emulate.h index aef6af59a0..c14c61322e 100644 --- a/tools/tests/x86_emulator/x86_emulate.h +++ b/tools/tests/x86_emulator/x86_emulate.h @@ -38,6 +38,11 @@ #define is_canonical_address(x) (((int64_t)(x) >> 47) == ((int64_t)(x) >> 63)) +/* There's no strict need for these to be in sync with processor.h. */ +#define X86_VENDOR_INTEL 0 +#define X86_VENDOR_AMD 2 +#define X86_VENDOR_UNKNOWN 0xff + #define MMAP_SZ 16384 bool emul_test_make_stack_executable(void); diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c index ecc107bc0a..24754d3a8e 100644 --- a/xen/arch/x86/hvm/emulate.c +++ b/xen/arch/x86/hvm/emulate.c @@ -1899,6 +1899,7 @@ void hvm_emulate_init_once( hvmemul_get_seg_reg(x86_seg_ss, hvmemul_ctxt); hvmemul_ctxt->ctxt.regs = regs; + hvmemul_ctxt->ctxt.vendor = curr->domain->arch.x86_vendor; hvmemul_ctxt->ctxt.force_writeback = true; if ( cpu_has_vmx ) diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c index 8a9fe8fa9a..d707d1c30c 100644 --- a/xen/arch/x86/mm.c +++ b/xen/arch/x86/mm.c @@ -5358,6 +5358,7 @@ int ptwr_do_page_fault(struct vcpu *v, unsigned long addr, struct ptwr_emulate_ctxt ptwr_ctxt = { .ctxt = { .regs = regs, + .vendor = d->arch.x86_vendor, .addr_size = is_pv_32bit_domain(d) ? 32 : BITS_PER_LONG, .sp_size = is_pv_32bit_domain(d) ? 32 : BITS_PER_LONG, .swint_emulate = x86_swint_emulate_none, @@ -5513,6 +5514,7 @@ int mmio_ro_do_page_fault(struct vcpu *v, unsigned long addr, struct mmio_ro_emulate_ctxt mmio_ro_ctxt = { .cr2 = addr }; struct x86_emulate_ctxt ctxt = { .regs = regs, + .vendor = v->domain->arch.x86_vendor, .addr_size = addr_size, .sp_size = addr_size, .swint_emulate = x86_swint_emulate_none, diff --git a/xen/arch/x86/mm/shadow/common.c b/xen/arch/x86/mm/shadow/common.c index 6689acefd1..d2bf2666b5 100644 --- a/xen/arch/x86/mm/shadow/common.c +++ b/xen/arch/x86/mm/shadow/common.c @@ -330,6 +330,7 @@ const struct x86_emulate_ops *shadow_init_emulation( memset(sh_ctxt, 0, sizeof(*sh_ctxt)); sh_ctxt->ctxt.regs = regs; + sh_ctxt->ctxt.vendor = v->domain->arch.x86_vendor; sh_ctxt->ctxt.swint_emulate = x86_swint_emulate_none; /* Segment cache initialisation. Primed with CS. */ diff --git a/xen/arch/x86/traps.c b/xen/arch/x86/traps.c index d69c02d76a..d2be7ed4f1 100644 --- a/xen/arch/x86/traps.c +++ b/xen/arch/x86/traps.c @@ -3352,7 +3352,10 @@ static int emulate_privileged_op(struct cpu_user_regs *regs) { struct vcpu *curr = current; struct domain *currd = curr->domain; - struct priv_op_ctxt ctxt = { .ctxt.regs = regs }; + struct priv_op_ctxt ctxt = { + .ctxt.regs = regs, + .ctxt.vendor = currd->arch.x86_vendor, + }; int rc; unsigned int eflags, ar; diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c index f134b1fa62..b6d73588a0 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -1396,7 +1396,11 @@ protmode_load_seg( case x86_seg_tr: goto raise_exn; } - memset(sreg, 0, sizeof(*sreg)); + if ( ctxt->vendor != X86_VENDOR_AMD || !ops->read_segment || + ops->read_segment(seg, sreg, ctxt) != X86EMUL_OKAY ) + memset(sreg, 0, sizeof(*sreg)); + else + sreg->attr.bytes = 0; sreg->sel = sel; return X86EMUL_OKAY; } diff --git a/xen/arch/x86/x86_emulate/x86_emulate.h b/xen/arch/x86/x86_emulate/x86_emulate.h index c55e1c2056..75f57ba308 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.h +++ b/xen/arch/x86/x86_emulate/x86_emulate.h @@ -462,6 +462,9 @@ struct x86_emulate_ctxt /* Software event injection support. */ enum x86_swint_emulation swint_emulate; + /* CPU vendor (X86_VENDOR_UNKNOWN for "don't care") */ + unsigned char vendor; + /* Set this if writes may have side effects. */ bool force_writeback;