Commit 05c83ec9b73c8124555b706f6af777b10adf0862
Committed by
Paolo Bonzini
Paolo Bonzini
1 parent
2febc83913
Exists in
ti-lsk-linux-4.1.y
and in
10 other branches
KVM: x86: Fix wrong masking on relative jump/call
Relative jumps and calls do the masking according to the operand size, and not according to the address size as the KVM emulator does today. This patch fixes KVM behavior. Cc: stable@vger.kernel.org Signed-off-by: Nadav Amit <namit@cs.technion.ac.il> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Showing 1 changed file with 22 additions and 5 deletions Side-by-side Diff
arch/x86/kvm/emulate.c
| ... | ... | @@ -504,11 +504,6 @@ |
| 504 | 504 | masked_increment(reg_rmw(ctxt, VCPU_REGS_RSP), stack_mask(ctxt), inc); |
| 505 | 505 | } |
| 506 | 506 | |
| 507 | -static inline void jmp_rel(struct x86_emulate_ctxt *ctxt, int rel) | |
| 508 | -{ | |
| 509 | - register_address_increment(ctxt, &ctxt->_eip, rel); | |
| 510 | -} | |
| 511 | - | |
| 512 | 507 | static u32 desc_limit_scaled(struct desc_struct *desc) |
| 513 | 508 | { |
| 514 | 509 | u32 limit = get_desc_limit(desc); |
| ... | ... | @@ -567,6 +562,28 @@ |
| 567 | 562 | static int emulate_nm(struct x86_emulate_ctxt *ctxt) |
| 568 | 563 | { |
| 569 | 564 | return emulate_exception(ctxt, NM_VECTOR, 0, false); |
| 565 | +} | |
| 566 | + | |
| 567 | +static inline void assign_eip_near(struct x86_emulate_ctxt *ctxt, ulong dst) | |
| 568 | +{ | |
| 569 | + switch (ctxt->op_bytes) { | |
| 570 | + case 2: | |
| 571 | + ctxt->_eip = (u16)dst; | |
| 572 | + break; | |
| 573 | + case 4: | |
| 574 | + ctxt->_eip = (u32)dst; | |
| 575 | + break; | |
| 576 | + case 8: | |
| 577 | + ctxt->_eip = dst; | |
| 578 | + break; | |
| 579 | + default: | |
| 580 | + WARN(1, "unsupported eip assignment size\n"); | |
| 581 | + } | |
| 582 | +} | |
| 583 | + | |
| 584 | +static inline void jmp_rel(struct x86_emulate_ctxt *ctxt, int rel) | |
| 585 | +{ | |
| 586 | + assign_eip_near(ctxt, ctxt->_eip + rel); | |
| 570 | 587 | } |
| 571 | 588 | |
| 572 | 589 | static u16 get_segment_selector(struct x86_emulate_ctxt *ctxt, unsigned seg) |
