Commit 518547b3 authored by Nadav Amit's avatar Nadav Amit Committed by Paolo Bonzini

KVM: x86: Emulator does not calculate address correctly

In long-mode, when the address size is 4 bytes, the linear address is not
truncated as the emulator mistakenly does.  Instead, the offset within the
segment (the ea field) should be truncated according to the address size.

As Intel SDM says: "In 64-bit mode, the effective address components are added
and the effective address is truncated ... before adding the full 64-bit
segment base."
Signed-off-by: default avatarNadav Amit <namit@cs.technion.ac.il>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent 6bdf0662
...@@ -655,7 +655,8 @@ static __always_inline int __linearize(struct x86_emulate_ctxt *ctxt, ...@@ -655,7 +655,8 @@ static __always_inline int __linearize(struct x86_emulate_ctxt *ctxt,
u16 sel; u16 sel;
unsigned cpl; unsigned cpl;
la = seg_base(ctxt, addr.seg) + addr.ea; la = seg_base(ctxt, addr.seg) +
(fetch || ctxt->ad_bytes == 8 ? addr.ea : (u32)addr.ea);
*max_size = 0; *max_size = 0;
switch (ctxt->mode) { switch (ctxt->mode) {
case X86EMUL_MODE_PROT64: case X86EMUL_MODE_PROT64:
...@@ -717,7 +718,7 @@ static __always_inline int __linearize(struct x86_emulate_ctxt *ctxt, ...@@ -717,7 +718,7 @@ static __always_inline int __linearize(struct x86_emulate_ctxt *ctxt,
} }
break; break;
} }
if (fetch ? ctxt->mode != X86EMUL_MODE_PROT64 : ctxt->ad_bytes != 8) if (ctxt->mode != X86EMUL_MODE_PROT64)
la &= (u32)-1; la &= (u32)-1;
if (insn_aligned(ctxt, size) && ((la & (size - 1)) != 0)) if (insn_aligned(ctxt, size) && ((la & (size - 1)) != 0))
return emulate_gp(ctxt, 0); return emulate_gp(ctxt, 0);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment