diff mbox series

[5/7] x86emul: vendor specific SYSENTER/SYSEXIT behavior in long mode

Message ID 8cf000a6-a8ac-22b6-422d-c11dc8b6454a@suse.com (mailing list archive)
State Superseded
Headers show
Series x86emul: (mainly) vendor specific behavior adjustments | expand

Commit Message

Jan Beulich March 24, 2020, 4:28 p.m. UTC 
Intel CPUs permit both insns there while AMD ones don't.

While at it also
- drop the ring 0 check from SYSENTER handling - neither Intel's nor
  AMD's insn pages have any indication of #GP(0) getting raised when
  executed from ring 0, and trying it out in practice also confirms
  the check shouldn't be there,
- move SYSENTER segment register writing until after the (in principle
  able to fail) MSR reads.

Signed-off-by: Jan Beulich <jbeulich@suse.com>

Comments

Andrew Cooper March 25, 2020, 2:15 p.m. UTC | #1 
On 24/03/2020 16:28, Jan Beulich wrote:
> Intel CPUs permit both insns there while AMD ones don't.
>
> While at it also
> - drop the ring 0 check from SYSENTER handling - neither Intel's nor
>   AMD's insn pages have any indication of #GP(0) getting raised when
>   executed from ring 0, and trying it out in practice also confirms
>   the check shouldn't be there,
> - move SYSENTER segment register writing until after the (in principle
>   able to fail) MSR reads.
>
> Signed-off-by: Jan Beulich <jbeulich@suse.com>

Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
diff mbox series

Patch

--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -6588,7 +6588,7 @@  x86_emulate(
 
     case X86EMUL_OPC(0x0f, 0x34): /* sysenter */
         vcpu_must_have(sep);
-        generate_exception_if(mode_ring0(), EXC_GP, 0);
+        generate_exception_if(amd_like(ctxt) && ctxt->lma, EXC_UD);
         generate_exception_if(!in_protmode(ctxt, ops), EXC_GP, 0);
 
         fail_if(ops->read_msr == NULL);
@@ -6611,11 +6611,6 @@  x86_emulate(
         sreg.limit = ~0u;  /* 4GB limit */
         sreg.attr = 0xc93; /* G+DB+P+S+Data */
 
-        fail_if(ops->write_segment == NULL);
-        if ( (rc = ops->write_segment(x86_seg_cs, &cs, ctxt)) != 0 ||
-             (rc = ops->write_segment(x86_seg_ss, &sreg, ctxt)) != 0 )
-            goto done;
-
         if ( (rc = ops->read_msr(MSR_IA32_SYSENTER_EIP,
                                  &msr_val, ctxt)) != X86EMUL_OKAY )
             goto done;
@@ -6626,11 +6621,19 @@  x86_emulate(
             goto done;
         _regs.r(sp) = ctxt->lma ? msr_val : (uint32_t)msr_val;
 
+        fail_if(!ops->write_segment);
+        if ( (rc = ops->write_segment(x86_seg_cs, &cs,
+                                      ctxt)) != X86EMUL_OKAY ||
+             (rc = ops->write_segment(x86_seg_ss, &sreg,
+                                      ctxt)) != X86EMUL_OKAY )
+            goto done;
+
         singlestep = _regs.eflags & X86_EFLAGS_TF;
         break;
 
     case X86EMUL_OPC(0x0f, 0x35): /* sysexit */
         vcpu_must_have(sep);
+        generate_exception_if(amd_like(ctxt) && ctxt->lma, EXC_UD);
         generate_exception_if(!mode_ring0(), EXC_GP, 0);
         generate_exception_if(!in_protmode(ctxt, ops), EXC_GP, 0);