This is a note to let you know that I've just added the patch titled
KVM: x86: Fix wrong masking on relative jump/call
to the 3.17-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
kvm-x86-fix-wrong-masking-on-relative-jump-call.patch
and it can be found in the queue-3.17 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 05c83ec9b73c8124555b706f6af777b10adf0862 Mon Sep 17 00:00:00 2001
From: Nadav Amit <namit@xxxxxxxxxxxxxxxxx>
Date: Thu, 18 Sep 2014 22:39:37 +0300
Subject: KVM: x86: Fix wrong masking on relative jump/call
From: Nadav Amit <namit@xxxxxxxxxxxxxxxxx>
commit 05c83ec9b73c8124555b706f6af777b10adf0862 upstream.
Relative jumps and calls do the masking according to the operand size, and not
according to the address size as the KVM emulator does today.
This patch fixes KVM behavior.
Signed-off-by: Nadav Amit <namit@xxxxxxxxxxxxxxxxx>
Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
arch/x86/kvm/emulate.c | 27 ++++++++++++++++++++++-----
1 file changed, 22 insertions(+), 5 deletions(-)
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -504,11 +504,6 @@ static void rsp_increment(struct x86_emu
masked_increment(reg_rmw(ctxt, VCPU_REGS_RSP), stack_mask(ctxt), inc);
}
-static inline void jmp_rel(struct x86_emulate_ctxt *ctxt, int rel)
-{
- register_address_increment(ctxt, &ctxt->_eip, rel);
-}
-
static u32 desc_limit_scaled(struct desc_struct *desc)
{
u32 limit = get_desc_limit(desc);
@@ -568,6 +563,28 @@ static int emulate_nm(struct x86_emulate
return emulate_exception(ctxt, NM_VECTOR, 0, false);
}
+static inline void assign_eip_near(struct x86_emulate_ctxt *ctxt, ulong dst)
+{
+ switch (ctxt->op_bytes) {
+ case 2:
+ ctxt->_eip = (u16)dst;
+ break;
+ case 4:
+ ctxt->_eip = (u32)dst;
+ break;
+ case 8:
+ ctxt->_eip = dst;
+ break;
+ default:
+ WARN(1, "unsupported eip assignment size\n");
+ }
+}
+
+static inline void jmp_rel(struct x86_emulate_ctxt *ctxt, int rel)
+{
+ assign_eip_near(ctxt, ctxt->_eip + rel);
+}
+
static u16 get_segment_selector(struct x86_emulate_ctxt *ctxt, unsigned seg)
{
u16 selector;
Patches currently in stable-queue which might be from namit@xxxxxxxxxxxxxxxxx are
queue-3.17/kvm-x86-emulator-fixes-for-eip-canonical-checks-on-near-branches.patch
queue-3.17/kvm-x86-check-non-canonical-addresses-upon-wrmsr.patch
queue-3.17/kvm-x86-handle-errors-when-rip-is-set-during-far-jumps.patch
queue-3.17/kvm-x86-emulator-does-not-decode-clflush-well.patch
queue-3.17/kvm-x86-prefetch-and-hint_nop-should-have-srcmem-flag.patch
queue-3.17/kvm-x86-fix-wrong-masking-on-relative-jump-call.patch
queue-3.17/kvm-x86-decoding-guest-instructions-which-cross-page-boundary-may-fail.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html