From: Mohammed Gamal <m.gamal005@gmail.com>
To: avi@redhat.com
Cc: mtosatti@redhat.com, kvm@vger.kernel.org,
Mohammed Gamal <m.gamal005@gmail.com>
Subject: [RFC PATCH v3 3/3] x86 emulator: Add segment limit checks to emulator functions
Date: Mon, 12 Jul 2010 01:56:10 +0300 [thread overview]
Message-ID: <1278888970-2936-4-git-send-email-m.gamal005@gmail.com> (raw)
In-Reply-To: <1278888970-2936-1-git-send-email-m.gamal005@gmail.com>
This adds segment limit checks to the emulator. Also changes return value of
emulate_push() and its callers accordingly.
Signed-off-by: Mohammed Gamal <m.gamal005@gmail.com>
---
arch/x86/kvm/emulate.c | 79 ++++++++++++++++++++++++++++++++++-------------
1 files changed, 57 insertions(+), 22 deletions(-)
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index 07ca28e..6cf6bee 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -728,6 +728,10 @@ static int do_fetch_insn_byte(struct x86_emulate_ctxt *ctxt,
if (eip == fc->end) {
cur_size = fc->end - fc->start;
size = min(15UL - cur_size, PAGE_SIZE - offset_in_page(eip));
+ rc = seg_limit_check(ctxt, ops, VCPU_SREGS_CS, ctxt->cs_base + eip,
+ size, GP_VECTOR, 0);
+ if (rc != X86EMUL_CONTINUE)
+ return rc;
rc = ops->fetch(ctxt->cs_base + eip, fc->data + cur_size,
size, ctxt->vcpu, NULL);
if (rc != X86EMUL_CONTINUE)
@@ -1248,6 +1252,8 @@ done_prefixes:
register_address(c, seg_override_base(ctxt, ops, c),
c->regs[VCPU_REGS_RSI]);
c->src.val = 0;
+ rc = seg_limit_check(ctxt, ops, c->seg_override, c->src.ptr,
+ c->src.bytes, GP_VECTOR, 0);
break;
case SrcImmFAddr:
c->src.type = OP_IMM;
@@ -1344,6 +1350,8 @@ done_prefixes:
register_address(c, es_base(ctxt, ops),
c->regs[VCPU_REGS_RDI]);
c->dst.val = 0;
+ rc = seg_limit_check(ctxt, ops, VCPU_SREGS_ES, c->dst.ptr,
+ c->dst.bytes, GP_VECTOR, 0);
break;
}
@@ -1662,7 +1670,7 @@ static inline int writeback(struct x86_emulate_ctxt *ctxt,
return X86EMUL_CONTINUE;
}
-static inline void emulate_push(struct x86_emulate_ctxt *ctxt,
+static inline int emulate_push(struct x86_emulate_ctxt *ctxt,
struct x86_emulate_ops *ops)
{
struct decode_cache *c = &ctxt->decode;
@@ -1673,6 +1681,8 @@ static inline void emulate_push(struct x86_emulate_ctxt *ctxt,
register_address_increment(c, &c->regs[VCPU_REGS_RSP], -c->op_bytes);
c->dst.ptr = (void *) register_address(c, ss_base(ctxt, ops),
c->regs[VCPU_REGS_RSP]);
+ return seg_limit_check(ctxt, ops, VCPU_SREGS_SS, c->dst.ptr, c->dst.bytes,
+ SS_VECTOR, 0);
}
static int emulate_pop(struct x86_emulate_ctxt *ctxt,
@@ -1680,11 +1690,16 @@ static int emulate_pop(struct x86_emulate_ctxt *ctxt,
void *dest, int len)
{
struct decode_cache *c = &ctxt->decode;
+ unsigned long reg_addr = register_address(c, ss_base(ctxt, ops),
+ c->regs[VCPU_REGS_RSP]);
int rc;
- rc = read_emulated(ctxt, ops, register_address(c, ss_base(ctxt, ops),
- c->regs[VCPU_REGS_RSP]),
- dest, len);
+
+ rc = read_emulated(ctxt, ops, reg_addr, dest, len);
+ if (rc != X86EMUL_CONTINUE)
+ return rc;
+ rc = seg_limit_check(ctxt, ops, VCPU_SREGS_SS, reg_addr, len,
+ SS_VECTOR, 0);
if (rc != X86EMUL_CONTINUE)
return rc;
@@ -1735,14 +1750,14 @@ static int emulate_popf(struct x86_emulate_ctxt *ctxt,
return rc;
}
-static void emulate_push_sreg(struct x86_emulate_ctxt *ctxt,
+static int emulate_push_sreg(struct x86_emulate_ctxt *ctxt,
struct x86_emulate_ops *ops, int seg)
{
struct decode_cache *c = &ctxt->decode;
c->src.val = ops->get_segment_selector(seg, ctxt->vcpu);
- emulate_push(ctxt, ops);
+ return emulate_push(ctxt, ops);
}
static int emulate_pop_sreg(struct x86_emulate_ctxt *ctxt,
@@ -1772,7 +1787,9 @@ static int emulate_pusha(struct x86_emulate_ctxt *ctxt,
(reg == VCPU_REGS_RSP) ?
(c->src.val = old_esp) : (c->src.val = c->regs[reg]);
- emulate_push(ctxt, ops);
+ rc = emulate_push(ctxt, ops);
+ if (rc != X86EMUL_CONTINUE)
+ return rc;
rc = writeback(ctxt, ops);
if (rc != X86EMUL_CONTINUE)
@@ -1884,15 +1901,13 @@ static inline int emulate_grp45(struct x86_emulate_ctxt *ctxt,
old_eip = c->eip;
c->eip = c->src.val;
c->src.val = old_eip;
- emulate_push(ctxt, ops);
- break;
+ return emulate_push(ctxt, ops);
}
case 4: /* jmp abs */
c->eip = c->src.val;
break;
case 6: /* push */
- emulate_push(ctxt, ops);
- break;
+ return emulate_push(ctxt, ops);
}
return X86EMUL_CONTINUE;
}
@@ -2548,7 +2563,7 @@ static int emulator_do_task_switch(struct x86_emulate_ctxt *ctxt,
c->op_bytes = c->ad_bytes = (next_tss_desc.type & 8) ? 4 : 2;
c->lock_prefix = 0;
c->src.val = (unsigned long) error_code;
- emulate_push(ctxt, ops);
+ return emulate_push(ctxt, ops);
}
return ret;
@@ -2681,7 +2696,9 @@ special_insn:
emulate_2op_SrcV("add", c->src, c->dst, ctxt->eflags);
break;
case 0x06: /* push es */
- emulate_push_sreg(ctxt, ops, VCPU_SREG_ES);
+ rc = emulate_push_sreg(ctxt, ops, VCPU_SREG_ES);
+ if (rc != X86EMUL_CONTINUE)
+ goto done;
break;
case 0x07: /* pop es */
rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_ES);
@@ -2693,14 +2710,18 @@ special_insn:
emulate_2op_SrcV("or", c->src, c->dst, ctxt->eflags);
break;
case 0x0e: /* push cs */
- emulate_push_sreg(ctxt, ops, VCPU_SREG_CS);
+ rc = emulate_push_sreg(ctxt, ops, VCPU_SREG_CS);
+ if (rc != X86EMUL_CONTINUE)
+ goto done;
break;
case 0x10 ... 0x15:
adc: /* adc */
emulate_2op_SrcV("adc", c->src, c->dst, ctxt->eflags);
break;
case 0x16: /* push ss */
- emulate_push_sreg(ctxt, ops, VCPU_SREG_SS);
+ rc = emulate_push_sreg(ctxt, ops, VCPU_SREG_SS);
+ if (rc != X86EMUL_CONTINUE)
+ goto done;
break;
case 0x17: /* pop ss */
rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_SS);
@@ -2712,7 +2733,9 @@ special_insn:
emulate_2op_SrcV("sbb", c->src, c->dst, ctxt->eflags);
break;
case 0x1e: /* push ds */
- emulate_push_sreg(ctxt, ops, VCPU_SREG_DS);
+ rc = emulate_push_sreg(ctxt, ops, VCPU_SREG_DS);
+ if (rc != X86EMUL_CONTINUE)
+ goto done;
break;
case 0x1f: /* pop ds */
rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_DS);
@@ -2742,7 +2765,9 @@ special_insn:
emulate_1op("dec", c->dst, ctxt->eflags);
break;
case 0x50 ... 0x57: /* push reg */
- emulate_push(ctxt, ops);
+ rc = emulate_push(ctxt, ops);
+ if (rc != X86EMUL_CONTINUE)
+ goto done;
break;
case 0x58 ... 0x5f: /* pop reg */
pop_instruction:
@@ -2767,7 +2792,9 @@ special_insn:
break;
case 0x68: /* push imm */
case 0x6a: /* push imm8 */
- emulate_push(ctxt, ops);
+ rc = emulate_push(ctxt, ops);
+ if (rc != X86EMUL_CONTINUE)
+ goto done;
break;
case 0x6c: /* insb */
case 0x6d: /* insw/insd */
@@ -2895,7 +2922,9 @@ special_insn:
goto xchg;
case 0x9c: /* pushf */
c->src.val = (unsigned long) ctxt->eflags;
- emulate_push(ctxt, ops);
+ rc = emulate_push(ctxt, ops);
+ if (rc != X86EMUL_CONTINUE)
+ goto done;
break;
case 0x9d: /* popf */
c->dst.type = OP_REG;
@@ -2959,7 +2988,9 @@ special_insn:
long int rel = c->src.val;
c->src.val = (unsigned long) c->eip;
jmp_rel(c, rel);
- emulate_push(ctxt, ops);
+ rc = emulate_push(ctxt, ops);
+ if (rc != X86EMUL_CONTINUE)
+ goto done;
break;
}
case 0xe9: /* jmp rel */
@@ -3286,7 +3317,9 @@ twobyte_insn:
c->dst.type = OP_NONE;
break;
case 0xa0: /* push fs */
- emulate_push_sreg(ctxt, ops, VCPU_SREG_FS);
+ rc = emulate_push_sreg(ctxt, ops, VCPU_SREG_FS);
+ if (rc != X86EMUL_CONTINUE)
+ goto done;
break;
case 0xa1: /* pop fs */
rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_FS);
@@ -3305,7 +3338,9 @@ twobyte_insn:
emulate_2op_cl("shld", c->src2, c->src, c->dst, ctxt->eflags);
break;
case 0xa8: /* push gs */
- emulate_push_sreg(ctxt, ops, VCPU_SREG_GS);
+ rc = emulate_push_sreg(ctxt, ops, VCPU_SREG_GS);
+ if (rc != X86EMUL_CONTINUE)
+ goto done;
break;
case 0xa9: /* pop gs */
rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_GS);
--
1.7.0.4
next prev parent reply other threads:[~2010-07-11 22:56 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-07-11 22:56 [RFC PATCH v3 0/3] Add segment limit checks to emulator Mohammed Gamal
2010-07-11 22:56 ` [RFC PATCH v3 1/3] Add helper methods to get segment limits Mohammed Gamal
2010-07-11 22:56 ` [RFC PATCH v3 2/3] x86 emulator: Add segment limit checking helpers Mohammed Gamal
2010-07-11 22:56 ` Mohammed Gamal [this message]
2010-07-12 6:26 ` [RFC PATCH v3 0/3] Add segment limit checks to emulator Avi Kivity
2010-07-12 12:36 ` Mohammed Gamal
2010-07-12 13:13 ` Avi Kivity
[not found] ` <AANLkTimHvpE05chocuoQnY0ydOMchMcIInu9QX5F_pV4@mail.gmail.com>
2010-07-12 13:51 ` Avi Kivity
2010-07-12 14:41 ` Gleb Natapov
2010-07-12 14:49 ` Avi Kivity
2010-07-24 15:45 ` Kevin O'Connor
2010-07-24 16:16 ` Kevin O'Connor
2010-07-25 8:55 ` Avi Kivity
2010-07-25 16:42 ` Kevin O'Connor
2010-07-25 17:19 ` Kevin O'Connor
2010-07-25 18:34 ` Avi Kivity
2010-07-25 18:55 ` Kevin O'Connor
2010-07-25 8:54 ` Avi Kivity
2010-07-25 16:23 ` Kevin O'Connor
2010-07-26 11:47 ` Avi Kivity
2010-07-26 17:47 ` Stefan Hajnoczi
-- strict thread matches above, loose matches on Subject: below --
2010-07-11 23:14 [RFC PATCH v3 3/3] x86 emulator: Add segment limit checks to emulator functions Mohammed Gamal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1278888970-2936-4-git-send-email-m.gamal005@gmail.com \
--to=m.gamal005@gmail.com \
--cc=avi@redhat.com \
--cc=kvm@vger.kernel.org \
--cc=mtosatti@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox