[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH] x86emul: Treat the vector of INT imm8 as unsigned
- To: xen-devel@xxxxxxxxxxxxxxxxxxxx
- From: Stephen Cheng <stephen.cheng@xxxxxxxxxx>
- Date: Thu, 12 Nov 2026 15:23:02 +0800
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=citrix.com; dmarc=pass action=none header.from=citrix.com; dkim=pass header.d=citrix.com; arc=none
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=6XR8JEGoYPCfsZjoILRnh+E5XF2Q/88OwZ/wLa1p470=; b=iGaC7s4lq6SbbgkPC90+gp64Y+UJRw6D1623635FJjQRO/1AcW5ciU/j+UW8knzARHtFS8Zq1+ULlwMDpf6310TmiDoyJqx0CU4kuUGgJhg6Dr7RIo8bK3tWtwyPX1gqlqQ4hriXSkMlw59pBP80keedRLCFksVI//Ug/PKzWWK/Ui4XDNF2K6wjVhk2rTCRhARw6eixTWWQVfe67lFVni9/VxEzUsTUfveVFO2DwtxXTWvQaW3F7ZUXqqEjzqg3IkGMDzH4fBMMirar9boEa+ccflL5XtaT+yrNOCvB4qxzokksQZ3gvGffr8zmqtZWl/o2DDPUdZ0v4Ujqllflgg==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=BHUiqblOJpp+dzFYDTujLtfuuaGdCSK8KgYXJe7sDIxKkAjNBjCd6atURdvfzwDcVtv1BnbB0Ro+RpY4+Og9CvDmRLxggiETl5c0EUm25ERWDrHdONaQNaV1gyaKcqMchZjrkt0tFZR+ILWgJsIF1h458XHN6g62jUSI7KxIpKRo8pVIlf1FrQArv9fEETMwy2VAOnFICKL099T5NA38Jsqnk2D8gsVZgKCEyeapIK2U2E9DuBE+BA+K3oMe/yIpIRe83B4R12i0KlPxf1vDtT/Z/WempjqMO7wykikye4TS2hNJPk+FwlNAwFyJNtvMccHFZ51mPhkDKRy3yNYeNw==
- Authentication-results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=citrix.com header.i="@citrix.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck"
- Authentication-results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=citrix.com;
- Cc: Ross Lagerwall <ross.lagerwall@xxxxxxxxxx>, Stephen Cheng <stephen.cheng@xxxxxxxxxx>, Jan Beulich <jbeulich@xxxxxxxx>, Andrew Cooper <andrew.cooper3@xxxxxxxxxx>, Roger Pau Monné <roger@xxxxxxxxxxxxxx>, Teddy Astie <teddy.astie@xxxxxxxxxx>
- Delivery-date: Thu, 12 Nov 2026 07:23:50 +0000
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
The decoder sign-extends all 8-bit immediates (SrcImmByte). For INT
imm8 the immediate is the vector, which is unsigned. So INT $0x80 to
INT $0xff put a negative vector into the event (e.g. -128 for 0x80).
hvm_inject_event() then fails its "vector == event->vector" assertion,
and a debug Xen panics. An HVM guest can trigger this with the forced
emulation prefix (hvm_fep).
Cast the vector to uint8_t, as is already done for the port of IN/OUT
and the operand of AAM/AAD.
Fixes: 52053d5fc2f9 ("x86/emul: Drop swint_emulate infrastructure")
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Stephen Cheng <stephen.cheng@xxxxxxxxxx>
---
I found this with an XTF test which runs "int $0x80" with the forced
emulation prefix. Tested on AMD with a debug build: without the patch
the host panics, with it the guest gets vector 0x80 (also 0x21, 0x7f
and 0xff).
xen/arch/x86/x86_emulate/x86_emulate.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c
b/xen/arch/x86/x86_emulate/x86_emulate.c
index f168f3ebcf..8d53873c67 100644
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -2453,7 +2453,7 @@ x86_emulate(
ctxt->event.type = X86_ET_SW_EXC;
break;
case 0xcd: /* int imm8 */
- ctxt->event.vector = imm1;
+ ctxt->event.vector = (uint8_t)imm1;
ctxt->event.type = X86_ET_SW_INT;
break;
case 0xce: /* into */
--
2.49.0
|
