From patchwork Tue Mar 24 16:26:03 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Beulich X-Patchwork-Id: 11455977 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 862D817D4 for ; Tue, 24 Mar 2020 16:27:16 +0000 (UTC) Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 6C44D208CA for ; Tue, 24 Mar 2020 16:27:16 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 6C44D208CA Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=suse.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1jGmNT-00032X-Oa; Tue, 24 Mar 2020 16:26:07 +0000 Received: from all-amaz-eas1.inumbo.com ([34.197.232.57] helo=us1-amaz-eas2.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1jGmNT-00032S-4J for xen-devel@lists.xenproject.org; Tue, 24 Mar 2020 16:26:07 +0000 X-Inumbo-ID: 28bf6436-6dec-11ea-8475-12813bfff9fa Received: from mx2.suse.de (unknown [195.135.220.15]) by us1-amaz-eas2.inumbo.com (Halon) with ESMTPS id 28bf6436-6dec-11ea-8475-12813bfff9fa; Tue, 24 Mar 2020 16:26:05 +0000 (UTC) X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id 8C3C2AC19; Tue, 24 Mar 2020 16:26:04 +0000 (UTC) From: Jan Beulich To: "xen-devel@lists.xenproject.org" References: Message-ID: <553aaf64-1171-2354-95a9-d5e54d3b21c4@suse.com> Date: Tue, 24 Mar 2020 17:26:03 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.6.0 MIME-Version: 1.0 In-Reply-To: Content-Language: en-US Subject: [Xen-devel] [PATCH 1/7] x86emul: add wrappers to check for AMD-like behavior X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Cc: Andrew Cooper , Wei Liu , =?utf-8?q?Roger_Pau_Monn=C3=A9?= Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" These are to aid readbility at their use sites, in particular because we're going to gain more of them. Suggested-by: Andrew Cooper Signed-off-by: Jan Beulich --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -1836,6 +1836,18 @@ in_protmode( return !(in_realmode(ctxt, ops) || (ctxt->regs->eflags & X86_EFLAGS_VM)); } +static bool +_amd_like(const struct cpuid_policy *cp) +{ + return cp->x86_vendor & (X86_VENDOR_AMD | X86_VENDOR_HYGON); +} + +static bool +amd_like(const struct x86_emulate_ctxt *ctxt) +{ + return _amd_like(ctxt->cpuid); +} + #define vcpu_has_fpu() (ctxt->cpuid->basic.fpu) #define vcpu_has_sep() (ctxt->cpuid->basic.sep) #define vcpu_has_cx8() (ctxt->cpuid->basic.cx8) @@ -1995,7 +2007,7 @@ protmode_load_seg( case x86_seg_tr: goto raise_exn; } - if ( !(cp->x86_vendor & (X86_VENDOR_AMD | X86_VENDOR_HYGON)) || + if ( !_amd_like(cp) || !ops->read_segment || ops->read_segment(seg, sreg, ctxt) != X86EMUL_OKAY ) memset(sreg, 0, sizeof(*sreg)); @@ -2122,9 +2134,7 @@ protmode_load_seg( * - all 16 bytes read with the high 8 bytes ignored on AMD. */ bool wide = desc.b & 0x1000 - ? false : (desc.b & 0xf00) != 0xc00 && - !(cp->x86_vendor & - (X86_VENDOR_AMD | X86_VENDOR_HYGON)) + ? false : (desc.b & 0xf00) != 0xc00 && !_amd_like(cp) ? mode_64bit() : ctxt->lma; if ( wide ) @@ -2142,9 +2152,7 @@ protmode_load_seg( default: return rc; } - if ( !mode_64bit() && - (cp->x86_vendor & (X86_VENDOR_AMD | X86_VENDOR_HYGON)) && - (desc.b & 0xf00) != 0xc00 ) + if ( !mode_64bit() && _amd_like(cp) && (desc.b & 0xf00) != 0xc00 ) desc_hi.b = desc_hi.a = 0; if ( (desc_hi.b & 0x00001f00) || (seg != x86_seg_none && @@ -2525,9 +2533,7 @@ x86_decode_onebyte( case 3: /* call (far, absolute indirect) */ case 5: /* jmp (far, absolute indirect) */ /* REX.W ignored on a vendor-dependent basis. */ - if ( op_bytes == 8 && - (ctxt->cpuid->x86_vendor & - (X86_VENDOR_AMD | X86_VENDOR_HYGON)) ) + if ( op_bytes == 8 && amd_like(ctxt) ) op_bytes = 4; state->desc = DstNone | SrcMem | Mov; break; @@ -2651,8 +2657,7 @@ x86_decode_twobyte( case 0xb4: /* lfs */ case 0xb5: /* lgs */ /* REX.W ignored on a vendor-dependent basis. */ - if ( op_bytes == 8 && - (ctxt->cpuid->x86_vendor & (X86_VENDOR_AMD | X86_VENDOR_HYGON)) ) + if ( op_bytes == 8 && amd_like(ctxt) ) op_bytes = 4; break; @@ -4068,9 +4073,7 @@ x86_emulate( if ( ea.type == OP_REG ) src.val = *ea.reg; else if ( (rc = read_ulong(ea.mem.seg, ea.mem.off, &src.val, - (op_bytes == 2 && - !(ctxt->cpuid->x86_vendor & - (X86_VENDOR_AMD | X86_VENDOR_HYGON)) + (op_bytes == 2 && !amd_like(ctxt) ? 2 : 4), ctxt, ops)) ) goto done; From patchwork Tue Mar 24 16:26:34 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Beulich X-Patchwork-Id: 11455987 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id CB9F414B4 for ; Tue, 24 Mar 2020 16:27:51 +0000 (UTC) Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id B0ECA20774 for ; Tue, 24 Mar 2020 16:27:51 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org B0ECA20774 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=suse.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1jGmNy-00035B-6b; Tue, 24 Mar 2020 16:26:38 +0000 Received: from us1-rack-iad1.inumbo.com ([172.99.69.81]) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1jGmNx-000353-BE for xen-devel@lists.xenproject.org; Tue, 24 Mar 2020 16:26:37 +0000 X-Inumbo-ID: 3b157d96-6dec-11ea-bec1-bc764e2007e4 Received: from mx2.suse.de (unknown [195.135.220.15]) by us1-rack-iad1.inumbo.com (Halon) with ESMTPS id 3b157d96-6dec-11ea-bec1-bc764e2007e4; Tue, 24 Mar 2020 16:26:36 +0000 (UTC) X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id 78D97AC4A; Tue, 24 Mar 2020 16:26:35 +0000 (UTC) From: Jan Beulich To: "xen-devel@lists.xenproject.org" References: Message-ID: <8a51dc9e-851a-4d6d-aa04-aa660ae122a9@suse.com> Date: Tue, 24 Mar 2020 17:26:34 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.6.0 MIME-Version: 1.0 In-Reply-To: Content-Language: en-US Subject: [Xen-devel] [PATCH 2/7] x86emul: vendor specific near RET behavior in 64-bit mode X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Cc: Andrew Cooper , Wei Liu , =?utf-8?q?Roger_Pau_Monn=C3=A9?= Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" Intel CPUs ignore operand size overrides here, while AMD ones don't. Signed-off-by: Jan Beulich Acked-by: Andrew Cooper --- a/tools/tests/x86_emulator/test_x86_emulator.c +++ b/tools/tests/x86_emulator/test_x86_emulator.c @@ -733,6 +733,34 @@ static struct x86_emulate_ops emulops = #define EFLAGS_ALWAYS_SET (X86_EFLAGS_IF | X86_EFLAGS_MBS) #define EFLAGS_MASK (X86_EFLAGS_ARITH_MASK | EFLAGS_ALWAYS_SET) +#define MMAP_ADDR 0x100000 + +#ifdef __x86_64__ +# define STKVAL_DISP 64 +static const struct { + const char *descr; + uint8_t opcode[8]; + /* Index 0: AMD, index 1: Intel. */ + uint8_t opc_len[2]; + int8_t stkoff[2]; + int32_t disp[2]; +} vendor_tests[] = { + { + .descr = "retw", + .opcode = { 0x66, 0xc3 }, + .opc_len = { 2, 2 }, + .stkoff = { 2, 8 }, + .disp = { STKVAL_DISP - MMAP_ADDR, STKVAL_DISP }, + }, { + .descr = "retw $16", + .opcode = { 0x66, 0xc2, 0x10, 0x00 }, + .opc_len = { 4, 4 }, + .stkoff = { 2 + 16, 8 + 16 }, + .disp = { STKVAL_DISP - MMAP_ADDR, STKVAL_DISP }, + }, +}; +#endif + int main(int argc, char **argv) { struct x86_emulate_ctxt ctxt; @@ -741,7 +769,9 @@ int main(int argc, char **argv) unsigned int *res, i, j; bool stack_exec; int rc; -#ifndef __x86_64__ +#ifdef __x86_64__ + unsigned int vendor_native; +#else unsigned int bcdres_native, bcdres_emul; #endif @@ -755,7 +785,7 @@ int main(int argc, char **argv) ctxt.addr_size = 8 * sizeof(void *); ctxt.sp_size = 8 * sizeof(void *); - res = mmap((void *)0x100000, MMAP_SZ, PROT_READ|PROT_WRITE|PROT_EXEC, + res = mmap((void *)MMAP_ADDR, MMAP_SZ, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_FIXED|MAP_PRIVATE|MAP_ANONYMOUS, 0, 0); if ( res == MAP_FAILED ) { @@ -1323,7 +1353,41 @@ int main(int argc, char **argv) (regs.eip != (unsigned long)&instr[3]) ) goto fail; printf("okay\n"); -#endif + + vendor_native = cp.x86_vendor; + for ( cp.x86_vendor = X86_VENDOR_AMD; ; ) + { + unsigned int v = cp.x86_vendor == X86_VENDOR_INTEL; + const char *vendor = cp.x86_vendor == X86_VENDOR_INTEL ? "Intel" : "AMD"; + uint64_t *stk = (void *)res + MMAP_SZ - 16; + + for ( i = 0; i < ARRAY_SIZE(vendor_tests); ++i ) + { + printf("%-*s", + 40 - printf("Testing %s [%s]", vendor_tests[i].descr, vendor), + "..."); + memcpy(instr, vendor_tests[i].opcode, vendor_tests[i].opc_len[v]); + regs.eflags = EFLAGS_ALWAYS_SET; + regs.rip = (unsigned long)instr; + regs.rsp = (unsigned long)stk; + stk[0] = regs.rip + STKVAL_DISP; + rc = x86_emulate(&ctxt, &emulops); + if ( (rc != X86EMUL_OKAY) || + (regs.eflags != EFLAGS_ALWAYS_SET) || + (regs.rip != (unsigned long)instr + + (vendor_tests[i].disp[v] + ?: vendor_tests[i].opc_len[v])) || + (regs.rsp != (unsigned long)stk + vendor_tests[i].stkoff[v]) ) + goto fail; + printf("okay\n"); + } + + if ( cp.x86_vendor == X86_VENDOR_INTEL ) + break; + cp.x86_vendor = X86_VENDOR_INTEL; + } + cp.x86_vendor = vendor_native; +#endif /* x86-64 */ printf("%-40s", "Testing shld $1,%ecx,(%edx)..."); res[0] = 0x12345678; --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -4611,7 +4611,8 @@ x86_emulate( case 0xc2: /* ret imm16 (near) */ case 0xc3: /* ret (near) */ - op_bytes = ((op_bytes == 4) && mode_64bit()) ? 8 : op_bytes; + op_bytes = (op_bytes == 4 || !amd_like(ctxt)) && mode_64bit() + ? 8 : op_bytes; if ( (rc = read_ulong(x86_seg_ss, sp_post_inc(op_bytes + src.val), &dst.val, op_bytes, ctxt, ops)) != 0 || (rc = ops->insn_fetch(x86_seg_cs, dst.val, NULL, 0, ctxt)) ) From patchwork Tue Mar 24 16:27:08 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Beulich X-Patchwork-Id: 11455989 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 383B715AB for ; Tue, 24 Mar 2020 16:28:13 +0000 (UTC) Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 1E7F420774 for ; Tue, 24 Mar 2020 16:28:13 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 1E7F420774 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=suse.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1jGmOY-0003BD-GS; Tue, 24 Mar 2020 16:27:14 +0000 Received: from all-amaz-eas1.inumbo.com ([34.197.232.57] helo=us1-amaz-eas2.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1jGmOW-0003Ax-IC for xen-devel@lists.xenproject.org; Tue, 24 Mar 2020 16:27:12 +0000 X-Inumbo-ID: 5028661c-6dec-11ea-8475-12813bfff9fa Received: from mx2.suse.de (unknown [195.135.220.15]) by us1-amaz-eas2.inumbo.com (Halon) with ESMTPS id 5028661c-6dec-11ea-8475-12813bfff9fa; Tue, 24 Mar 2020 16:27:11 +0000 (UTC) X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id D0BC6ABF4; Tue, 24 Mar 2020 16:27:10 +0000 (UTC) From: Jan Beulich To: "xen-devel@lists.xenproject.org" References: Message-ID: <5fbb2e32-ad0f-af25-35de-720baff3351e@suse.com> Date: Tue, 24 Mar 2020 17:27:08 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.6.0 MIME-Version: 1.0 In-Reply-To: Content-Language: en-US Subject: [Xen-devel] [PATCH 3/7] x86emul: vendor specific direct branch behavior in 64-bit mode X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Cc: Andrew Cooper , Wei Liu , =?utf-8?q?Roger_Pau_Monn=C3=A9?= Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" Intel CPUs ignore operand size overrides here, while AMD ones don't. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper --- a/tools/tests/x86_emulator/test_x86_emulator.c +++ b/tools/tests/x86_emulator/test_x86_emulator.c @@ -757,6 +757,62 @@ static const struct { .opc_len = { 4, 4 }, .stkoff = { 2 + 16, 8 + 16 }, .disp = { STKVAL_DISP - MMAP_ADDR, STKVAL_DISP }, + }, { + .descr = "jmpw .+16", + .opcode = { 0x66, 0xeb, 0x10 }, + .opc_len = { 3, 3 }, + .disp = { 3 + 16 - MMAP_ADDR, 3 + 16 }, + }, { + .descr = "jmpw .+128", + .opcode = { 0x66, 0xe9, 0x80, 0x00, 0x00, 0x00 }, + .opc_len = { 4, 6 }, + .disp = { 4 + 128 - MMAP_ADDR, 6 + 128 }, + }, { + .descr = "callw .+16", + .opcode = { 0x66, 0xe8, 0x10, 0x00, 0x00, 0x00 }, + .opc_len = { 4, 6 }, + .stkoff = { -2, -8 }, + .disp = { 4 + 16 - MMAP_ADDR, 6 + 16 }, + }, { + .descr = "jzw .+16", + .opcode = { 0x66, 0x74, 0x10 }, + .opc_len = { 3, 3 }, + .disp = { 3, 3 }, + }, { + .descr = "jzw .+128", + .opcode = { 0x66, 0x0f, 0x84, 0x80, 0x00, 0x00, 0x00 }, + .opc_len = { 5, 7 }, + .disp = { 5, 7 }, + }, { + .descr = "jnzw .+16", + .opcode = { 0x66, 0x75, 0x10 }, + .opc_len = { 3, 3 }, + .disp = { 3 + 16 - MMAP_ADDR, 3 + 16 }, + }, { + .descr = "jnzw .+128", + .opcode = { 0x66, 0x0f, 0x85, 0x80, 0x00, 0x00, 0x00 }, + .opc_len = { 5, 7 }, + .disp = { 5 + 128 - MMAP_ADDR, 7 + 128 }, + }, { + .descr = "loopqw .+16 (RCX>1)", + .opcode = { 0x66, 0xe0, 0x10 }, + .opc_len = { 3, 3 }, + .disp = { 3 + 16 - MMAP_ADDR, 3 + 16 }, + }, { + .descr = "looplw .+16 (ECX=1)", + .opcode = { 0x66, 0x67, 0xe0, 0x10 }, + .opc_len = { 4, 4 }, + .disp = { 4, 4 }, + }, { + .descr = "jrcxzw .+16 (RCX>0)", + .opcode = { 0x66, 0xe3, 0x10 }, + .opc_len = { 3, 3 }, + .disp = { 3, 3 }, + }, { + .descr = "jecxzw .+16 (ECX=0)", + .opcode = { 0x66, 0x67, 0xe3, 0x10 }, + .opc_len = { 4, 4 }, + .disp = { 4 + 16 - MMAP_ADDR, 4 + 16 }, }, }; #endif @@ -1361,6 +1417,7 @@ int main(int argc, char **argv) const char *vendor = cp.x86_vendor == X86_VENDOR_INTEL ? "Intel" : "AMD"; uint64_t *stk = (void *)res + MMAP_SZ - 16; + regs.rcx = 2; for ( i = 0; i < ARRAY_SIZE(vendor_tests); ++i ) { printf("%-*s", @@ -1370,6 +1427,7 @@ int main(int argc, char **argv) regs.eflags = EFLAGS_ALWAYS_SET; regs.rip = (unsigned long)instr; regs.rsp = (unsigned long)stk; + regs.rcx |= 0x8765432100000000UL; stk[0] = regs.rip + STKVAL_DISP; rc = x86_emulate(&ctxt, &emulops); if ( (rc != X86EMUL_OKAY) || @@ -1379,6 +1437,16 @@ int main(int argc, char **argv) ?: vendor_tests[i].opc_len[v])) || (regs.rsp != (unsigned long)stk + vendor_tests[i].stkoff[v]) ) goto fail; + /* For now only call insns push something onto the stack. */ + if ( regs.rsp < (unsigned long)stk ) + { + unsigned long opc_end = (unsigned long)instr + + vendor_tests[i].opc_len[v]; + + if ( memcmp(&opc_end, (void *)regs.rsp, + min((unsigned long)stk - regs.rsp, 8UL)) ) + goto fail; + } printf("okay\n"); } --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -1273,7 +1273,7 @@ do { #define jmp_rel(rel) \ do { \ unsigned long ip = _regs.r(ip) + (int)(rel); \ - if ( op_bytes == 2 ) \ + if ( op_bytes == 2 && (amd_like(ctxt) || !mode_64bit()) ) \ ip = (uint16_t)ip; \ else if ( !mode_64bit() ) \ ip = (uint32_t)ip; \ @@ -3392,7 +3392,13 @@ x86_decode( case SrcImm: if ( !(d & ByteOp) ) + { + if ( mode_64bit() && !amd_like(ctxt) && + ((ext == ext_none && (b | 1) == 0xe9) /* call / jmp */ || + (ext == ext_0f && (b | 0xf) == 0x8f) /* jcc */ ) ) + op_bytes = 4; bytes = op_bytes != 8 ? op_bytes : 4; + } else { case SrcImmByte: From patchwork Tue Mar 24 16:27:37 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Beulich X-Patchwork-Id: 11455991 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id CF06E14B4 for ; Tue, 24 Mar 2020 16:28:38 +0000 (UTC) Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id B647320774 for ; Tue, 24 Mar 2020 16:28:38 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org B647320774 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=suse.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1jGmOz-0003FI-Pw; Tue, 24 Mar 2020 16:27:41 +0000 Received: from us1-rack-iad1.inumbo.com ([172.99.69.81]) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1jGmOy-0003F5-VS for xen-devel@lists.xenproject.org; Tue, 24 Mar 2020 16:27:40 +0000 X-Inumbo-ID: 60b06264-6dec-11ea-a6c1-bc764e2007e4 Received: from mx2.suse.de (unknown [195.135.220.15]) by us1-rack-iad1.inumbo.com (Halon) with ESMTPS id 60b06264-6dec-11ea-a6c1-bc764e2007e4; Tue, 24 Mar 2020 16:27:39 +0000 (UTC) X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id 89F6CACC2; Tue, 24 Mar 2020 16:27:38 +0000 (UTC) From: Jan Beulich To: "xen-devel@lists.xenproject.org" References: Message-ID: Date: Tue, 24 Mar 2020 17:27:37 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.6.0 MIME-Version: 1.0 In-Reply-To: Content-Language: en-US Subject: [Xen-devel] [PATCH 4/7] x86emul: vendor specific near indirect branch behavior in 64-bit mode X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Cc: Andrew Cooper , Wei Liu , =?utf-8?q?Roger_Pau_Monn=C3=A9?= Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" Intel CPUs ignore operand size overrides here, while AMD ones don't. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper --- a/tools/tests/x86_emulator/test_x86_emulator.c +++ b/tools/tests/x86_emulator/test_x86_emulator.c @@ -813,6 +813,17 @@ static const struct { .opcode = { 0x66, 0x67, 0xe3, 0x10 }, .opc_len = { 4, 4 }, .disp = { 4 + 16 - MMAP_ADDR, 4 + 16 }, + }, { + .descr = "jmpw *(%rsp)", + .opcode = { 0x66, 0xff, 0x24, 0x24 }, + .opc_len = { 4, 4 }, + .disp = { STKVAL_DISP - MMAP_ADDR, STKVAL_DISP }, + }, { + .descr = "callw *(%rsp)", + .opcode = { 0x66, 0xff, 0x14, 0x24 }, + .opc_len = { 4, 4 }, + .stkoff = { -2, -8 }, + .disp = { STKVAL_DISP - MMAP_ADDR, STKVAL_DISP }, }, }; #endif --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -2524,8 +2524,7 @@ x86_decode_onebyte( { case 2: /* call (near) */ case 4: /* jmp (near) */ - case 6: /* push */ - if ( mode_64bit() && op_bytes == 4 ) + if ( mode_64bit() && (op_bytes == 4 || !amd_like(ctxt)) ) op_bytes = 8; state->desc = DstNone | SrcMem | Mov; break; @@ -2537,6 +2536,12 @@ x86_decode_onebyte( op_bytes = 4; state->desc = DstNone | SrcMem | Mov; break; + + case 6: /* push */ + if ( mode_64bit() && op_bytes == 4 ) + op_bytes = 8; + state->desc = DstNone | SrcMem | Mov; + break; } break; } From patchwork Tue Mar 24 16:28:17 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Beulich X-Patchwork-Id: 11455993 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id D490715AB for ; Tue, 24 Mar 2020 16:29:19 +0000 (UTC) Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id B860F2076F for ; Tue, 24 Mar 2020 16:29:19 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org B860F2076F Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=suse.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1jGmPe-0003NC-3l; Tue, 24 Mar 2020 16:28:22 +0000 Received: from us1-rack-iad1.inumbo.com ([172.99.69.81]) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1jGmPc-0003My-UJ for xen-devel@lists.xenproject.org; Tue, 24 Mar 2020 16:28:20 +0000 X-Inumbo-ID: 79192958-6dec-11ea-bec1-bc764e2007e4 Received: from mx2.suse.de (unknown [195.135.220.15]) by us1-rack-iad1.inumbo.com (Halon) with ESMTPS id 79192958-6dec-11ea-bec1-bc764e2007e4; Tue, 24 Mar 2020 16:28:20 +0000 (UTC) X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id A829AABF4; Tue, 24 Mar 2020 16:28:19 +0000 (UTC) From: Jan Beulich To: "xen-devel@lists.xenproject.org" References: Message-ID: <8cf000a6-a8ac-22b6-422d-c11dc8b6454a@suse.com> Date: Tue, 24 Mar 2020 17:28:17 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.6.0 MIME-Version: 1.0 In-Reply-To: Content-Language: en-US Subject: [Xen-devel] [PATCH 5/7] x86emul: vendor specific SYSENTER/SYSEXIT behavior in long mode X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Cc: Andrew Cooper , Wei Liu , =?utf-8?q?Roger_Pau_Monn=C3=A9?= Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" Intel CPUs permit both insns there while AMD ones don't. While at it also - drop the ring 0 check from SYSENTER handling - neither Intel's nor AMD's insn pages have any indication of #GP(0) getting raised when executed from ring 0, and trying it out in practice also confirms the check shouldn't be there, - move SYSENTER segment register writing until after the (in principle able to fail) MSR reads. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -6588,7 +6588,7 @@ x86_emulate( case X86EMUL_OPC(0x0f, 0x34): /* sysenter */ vcpu_must_have(sep); - generate_exception_if(mode_ring0(), EXC_GP, 0); + generate_exception_if(amd_like(ctxt) && ctxt->lma, EXC_UD); generate_exception_if(!in_protmode(ctxt, ops), EXC_GP, 0); fail_if(ops->read_msr == NULL); @@ -6611,11 +6611,6 @@ x86_emulate( sreg.limit = ~0u; /* 4GB limit */ sreg.attr = 0xc93; /* G+DB+P+S+Data */ - fail_if(ops->write_segment == NULL); - if ( (rc = ops->write_segment(x86_seg_cs, &cs, ctxt)) != 0 || - (rc = ops->write_segment(x86_seg_ss, &sreg, ctxt)) != 0 ) - goto done; - if ( (rc = ops->read_msr(MSR_IA32_SYSENTER_EIP, &msr_val, ctxt)) != X86EMUL_OKAY ) goto done; @@ -6626,11 +6621,19 @@ x86_emulate( goto done; _regs.r(sp) = ctxt->lma ? msr_val : (uint32_t)msr_val; + fail_if(!ops->write_segment); + if ( (rc = ops->write_segment(x86_seg_cs, &cs, + ctxt)) != X86EMUL_OKAY || + (rc = ops->write_segment(x86_seg_ss, &sreg, + ctxt)) != X86EMUL_OKAY ) + goto done; + singlestep = _regs.eflags & X86_EFLAGS_TF; break; case X86EMUL_OPC(0x0f, 0x35): /* sysexit */ vcpu_must_have(sep); + generate_exception_if(amd_like(ctxt) && ctxt->lma, EXC_UD); generate_exception_if(!mode_ring0(), EXC_GP, 0); generate_exception_if(!in_protmode(ctxt, ops), EXC_GP, 0); From patchwork Tue Mar 24 16:28:50 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Beulich X-Patchwork-Id: 11455995 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 60D3B139A for ; Tue, 24 Mar 2020 16:29:49 +0000 (UTC) Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 46F8A2076F for ; Tue, 24 Mar 2020 16:29:49 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 46F8A2076F Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=suse.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1jGmQA-0003So-DZ; Tue, 24 Mar 2020 16:28:54 +0000 Received: from us1-rack-iad1.inumbo.com ([172.99.69.81]) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1jGmQ9-0003Sd-Hx for xen-devel@lists.xenproject.org; Tue, 24 Mar 2020 16:28:53 +0000 X-Inumbo-ID: 8c5952ae-6dec-11ea-b34e-bc764e2007e4 Received: from mx2.suse.de (unknown [195.135.220.15]) by us1-rack-iad1.inumbo.com (Halon) with ESMTPS id 8c5952ae-6dec-11ea-b34e-bc764e2007e4; Tue, 24 Mar 2020 16:28:52 +0000 (UTC) X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id CCAF5ABF4; Tue, 24 Mar 2020 16:28:51 +0000 (UTC) From: Jan Beulich To: "xen-devel@lists.xenproject.org" References: Message-ID: <7c4b7701-0840-1e06-3b54-e259c223e61c@suse.com> Date: Tue, 24 Mar 2020 17:28:50 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.6.0 MIME-Version: 1.0 In-Reply-To: Content-Language: en-US Subject: [Xen-devel] [PATCH 6/7] x86emul: vendor specific SYSCALL behavior X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Cc: Andrew Cooper , Wei Liu , =?utf-8?q?Roger_Pau_Monn=C3=A9?= Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" AMD CPUs permit the insn everywhere (even outside of protected mode), while Intel ones restrict it to 64-bit mode. While at it also add the so far missing CPUID bit check. Signed-off-by: Jan Beulich --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -1870,6 +1870,7 @@ amd_like(const struct x86_emulate_ctxt * #define vcpu_has_f16c() (ctxt->cpuid->basic.f16c) #define vcpu_has_rdrand() (ctxt->cpuid->basic.rdrand) +#define vcpu_has_syscall() (ctxt->cpuid->extd.syscall) #define vcpu_has_mmxext() (ctxt->cpuid->extd.mmxext || vcpu_has_sse()) #define vcpu_has_3dnow_ext() (ctxt->cpuid->extd._3dnowext) #define vcpu_has_3dnow() (ctxt->cpuid->extd._3dnow) @@ -5897,13 +5898,13 @@ x86_emulate( break; case X86EMUL_OPC(0x0f, 0x05): /* syscall */ - generate_exception_if(!in_protmode(ctxt, ops), EXC_UD); - + vcpu_must_have(syscall); /* Inject #UD if syscall/sysret are disabled. */ fail_if(ops->read_msr == NULL); if ( (rc = ops->read_msr(MSR_EFER, &msr_val, ctxt)) != X86EMUL_OKAY ) goto done; generate_exception_if((msr_val & EFER_SCE) == 0, EXC_UD); + generate_exception_if(!amd_like(ctxt) && !mode_64bit(), EXC_UD); if ( (rc = ops->read_msr(MSR_STAR, &msr_val, ctxt)) != X86EMUL_OKAY ) goto done; From patchwork Tue Mar 24 16:29:13 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Beulich X-Patchwork-Id: 11455997 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 8EC396CA for ; Tue, 24 Mar 2020 16:30:41 +0000 (UTC) Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 730362076F for ; Tue, 24 Mar 2020 16:30:41 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 730362076F Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=suse.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1jGmQX-0003XL-NI; Tue, 24 Mar 2020 16:29:17 +0000 Received: from all-amaz-eas1.inumbo.com ([34.197.232.57] helo=us1-amaz-eas2.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1jGmQW-0003Ws-48 for xen-devel@lists.xenproject.org; Tue, 24 Mar 2020 16:29:16 +0000 X-Inumbo-ID: 99e3203a-6dec-11ea-8476-12813bfff9fa Received: from mx2.suse.de (unknown [195.135.220.15]) by us1-amaz-eas2.inumbo.com (Halon) with ESMTPS id 99e3203a-6dec-11ea-8476-12813bfff9fa; Tue, 24 Mar 2020 16:29:15 +0000 (UTC) X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id 86765ABF4; Tue, 24 Mar 2020 16:29:14 +0000 (UTC) From: Jan Beulich To: "xen-devel@lists.xenproject.org" , Andrew Cooper , =?utf-8?q?Roger_Pau_Monn=C3=A9?= , Wei Liu References: Message-ID: <78b62646-6fd4-e5b3-bc09-783bb017eaaa@suse.com> Date: Tue, 24 Mar 2020 17:29:13 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.6.0 MIME-Version: 1.0 In-Reply-To: Content-Language: en-US Subject: [Xen-devel] [PATCH 7/7] x86emul: support SYSRET X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" This is to augment SYSCALL, which has been supported for quite some time. Signed-off-by: Jan Beulich --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -5975,6 +5975,60 @@ x86_emulate( goto done; break; + case X86EMUL_OPC(0x0f, 0x07): /* sysret */ + vcpu_must_have(syscall); + /* Inject #UD if syscall/sysret are disabled. */ + fail_if(!ops->read_msr); + if ( (rc = ops->read_msr(MSR_EFER, &msr_val, ctxt)) != X86EMUL_OKAY ) + goto done; + generate_exception_if((msr_val & EFER_SCE) == 0, EXC_UD); + generate_exception_if(!amd_like(ctxt) && !mode_64bit(), EXC_UD); + generate_exception_if(!mode_ring0(), EXC_GP, 0); + generate_exception_if(!in_protmode(ctxt, ops), EXC_GP, 0); + + if ( (rc = ops->read_msr(MSR_STAR, &msr_val, ctxt)) != X86EMUL_OKAY ) + goto done; + + sreg.sel = ((msr_val >> 48) + 8) | 3; /* SELECTOR_RPL_MASK */ + cs.sel = op_bytes == 8 ? sreg.sel + 8 : sreg.sel - 8; + + cs.base = sreg.base = 0; /* flat segment */ + cs.limit = sreg.limit = ~0u; /* 4GB limit */ + cs.attr = 0xcfb; /* G+DB+P+DPL3+S+Code */ + sreg.attr = 0xcf3; /* G+DB+P+DPL3+S+Data */ + +#ifdef __x86_64__ + if ( mode_64bit() ) + { + if ( op_bytes == 8 ) + { + cs.attr = 0xafb; /* L+DB+P+DPL3+S+Code */ + generate_exception_if(!is_canonical_address(_regs.rcx) && + !amd_like(ctxt), EXC_GP, 0); + _regs.rip = _regs.rcx; + } + else + _regs.rip = _regs.ecx; + + _regs.eflags = _regs.r11 & ~(X86_EFLAGS_RF | X86_EFLAGS_VM); + } + else +#endif + { + _regs.r(ip) = _regs.ecx; + _regs.eflags |= X86_EFLAGS_IF; + } + + fail_if(!ops->write_segment); + if ( (rc = ops->write_segment(x86_seg_cs, &cs, ctxt)) != X86EMUL_OKAY || + (!amd_like(ctxt) && + (rc = ops->write_segment(x86_seg_ss, &sreg, + ctxt)) != X86EMUL_OKAY) ) + goto done; + + singlestep = _regs.eflags & X86_EFLAGS_TF; + break; + case X86EMUL_OPC(0x0f, 0x08): /* invd */ case X86EMUL_OPC(0x0f, 0x09): /* wbinvd / wbnoinvd */ generate_exception_if(!mode_ring0(), EXC_GP, 0);