[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 14/16] target-i386: Clear bndregs during legacy near
From: |
Richard Henderson |
Subject: |
[Qemu-devel] [PATCH 14/16] target-i386: Clear bndregs during legacy near jumps |
Date: |
Wed, 10 Feb 2016 04:43:50 +1100 |
Signed-off-by: Richard Henderson <address@hidden>
---
target-i386/helper.h | 1 +
target-i386/mpx_helper.c | 8 ++++++++
target-i386/translate.c | 20 ++++++++++++++++++++
3 files changed, 29 insertions(+)
diff --git a/target-i386/helper.h b/target-i386/helper.h
index 709b195..60a615f 100644
--- a/target-i386/helper.h
+++ b/target-i386/helper.h
@@ -21,6 +21,7 @@ DEF_HELPER_FLAGS_3(bndldx32, TCG_CALL_NO_WG, i64, env, tl, tl)
DEF_HELPER_FLAGS_3(bndldx64, TCG_CALL_NO_WG, i64, env, tl, tl)
DEF_HELPER_FLAGS_5(bndstx32, TCG_CALL_NO_WG, void, env, tl, tl, i64, i64)
DEF_HELPER_FLAGS_5(bndstx64, TCG_CALL_NO_WG, void, env, tl, tl, i64, i64)
+DEF_HELPER_1(bnd_jmp, void, env)
DEF_HELPER_2(aam, void, env, int)
DEF_HELPER_2(aad, void, env, int)
diff --git a/target-i386/mpx_helper.c b/target-i386/mpx_helper.c
index 53d9834..1bf717a 100644
--- a/target-i386/mpx_helper.c
+++ b/target-i386/mpx_helper.c
@@ -156,3 +156,11 @@ void helper_bndstx32(CPUX86State *env, target_ulong base,
target_ulong ptr,
cpu_stl_data_ra(env, bte + 4, ub, ra);
cpu_stl_data_ra(env, bte + 8, ptr, ra);
}
+
+void helper_bnd_jmp(CPUX86State *env)
+{
+ if (!(env->hflags2 & HF2_MPX_PR_MASK)) {
+ memset(env->bnd_regs, 0, sizeof(env->bnd_regs));
+ env->hflags &= ~HF_MPX_IU_MASK;
+ }
+}
diff --git a/target-i386/translate.c b/target-i386/translate.c
index 0dda4a8..59470f7 100644
--- a/target-i386/translate.c
+++ b/target-i386/translate.c
@@ -2406,6 +2406,19 @@ static void gen_reset_hflag(DisasContext *s, uint32_t
mask)
}
}
+/* Clear BND registers during legacy branches. */
+static void gen_bnd_jmp(DisasContext *s)
+{
+ /* Do nothing if BND prefix present, MPX is disabled, or if the
+ BNDREGs are known to be in INIT state already. The helper
+ itself will check BNDPRESERVE at runtime. */
+ if ((s->prefix & PREFIX_REPNZ) == 0
+ && (s->flags & HF_MPX_EN_MASK) == 0
+ && (s->flags & HF_MPX_IU_MASK) == 0) {
+ gen_helper_bnd_jmp(cpu_env);
+ }
+}
+
/* generate a generic end of block. Trace exception is also generated
if needed */
static void gen_eob(DisasContext *s)
@@ -4794,6 +4807,7 @@ static target_ulong disas_insn(CPUX86State *env,
DisasContext *s,
tcg_gen_movi_tl(cpu_T1, next_eip);
gen_push_v(s, cpu_T1);
gen_op_jmp_v(cpu_T0);
+ gen_bnd_jmp(s);
gen_eob(s);
break;
case 3: /* lcall Ev */
@@ -4819,6 +4833,7 @@ static target_ulong disas_insn(CPUX86State *env,
DisasContext *s,
tcg_gen_ext16u_tl(cpu_T0, cpu_T0);
}
gen_op_jmp_v(cpu_T0);
+ gen_bnd_jmp(s);
gen_eob(s);
break;
case 5: /* ljmp Ev */
@@ -6200,6 +6215,7 @@ static target_ulong disas_insn(CPUX86State *env,
DisasContext *s,
gen_stack_update(s, val + (1 << ot));
/* Note that gen_pop_T0 uses a zero-extending load. */
gen_op_jmp_v(cpu_T0);
+ gen_bnd_jmp(s);
gen_eob(s);
break;
case 0xc3: /* ret */
@@ -6207,6 +6223,7 @@ static target_ulong disas_insn(CPUX86State *env,
DisasContext *s,
gen_pop_update(s, ot);
/* Note that gen_pop_T0 uses a zero-extending load. */
gen_op_jmp_v(cpu_T0);
+ gen_bnd_jmp(s);
gen_eob(s);
break;
case 0xca: /* lret im */
@@ -6273,6 +6290,7 @@ static target_ulong disas_insn(CPUX86State *env,
DisasContext *s,
}
tcg_gen_movi_tl(cpu_T0, next_eip);
gen_push_v(s, cpu_T0);
+ gen_bnd_jmp(s);
gen_jmp(s, tval);
}
break;
@@ -6302,6 +6320,7 @@ static target_ulong disas_insn(CPUX86State *env,
DisasContext *s,
} else if (!CODE64(s)) {
tval &= 0xffffffff;
}
+ gen_bnd_jmp(s);
gen_jmp(s, tval);
break;
case 0xea: /* ljmp im */
@@ -6341,6 +6360,7 @@ static target_ulong disas_insn(CPUX86State *env,
DisasContext *s,
if (dflag == MO_16) {
tval &= 0xffff;
}
+ gen_bnd_jmp(s);
gen_jcc(s, b, tval, next_eip);
break;
--
2.5.0
- [Qemu-devel] [PATCH 04/16] target-i386: Add XSAVE extension, (continued)
- [Qemu-devel] [PATCH 04/16] target-i386: Add XSAVE extension, Richard Henderson, 2016/02/09
- [Qemu-devel] [PATCH 05/16] target-i386: Implement XSAVEOPT, Richard Henderson, 2016/02/09
- [Qemu-devel] [PATCH 06/16] target-i386: Enable control registers for MPX, Richard Henderson, 2016/02/09
- [Qemu-devel] [PATCH 09/16] target-i386: Implement BNDMK, Richard Henderson, 2016/02/09
- [Qemu-devel] [PATCH 07/16] target-i386: Perform set/reset_inhibit_irq inline, Richard Henderson, 2016/02/09
- [Qemu-devel] [PATCH 08/16] target-i386: Split up gen_lea_modrm, Richard Henderson, 2016/02/09
- [Qemu-devel] [PATCH 10/16] target-i386: Implement BNDMOV, Richard Henderson, 2016/02/09
- [Qemu-devel] [PATCH 11/16] target-i386: Implement BNDCL, BNDCU, BNDCN, Richard Henderson, 2016/02/09
- [Qemu-devel] [PATCH 12/16] target-i386: Update BNDSTATUS for exceptions raised by BOUND, Richard Henderson, 2016/02/09
- [Qemu-devel] [PATCH 13/16] target-i386: Implement BNDLDX, BNDSTX, Richard Henderson, 2016/02/09
- [Qemu-devel] [PATCH 14/16] target-i386: Clear bndregs during legacy near jumps,
Richard Henderson <=
- [Qemu-devel] [PATCH 15/16] target-i386: Enable CR4/XCR0 features for user-mode, Richard Henderson, 2016/02/09
- [Qemu-devel] [PATCH 16/16] target-i386: Implement FSGSBASE, Richard Henderson, 2016/02/09