[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH] x86emul: Treat the vector of INT imm8 as unsigned
- To: Stephen Cheng <stephen.cheng@xxxxxxxxxx>, xen-devel@xxxxxxxxxxxxxxxxxxxx
- From: Ross Lagerwall <ross.lagerwall@xxxxxxxxxx>
- Date: Thu, 12 Nov 2026 09:22:30 +0000
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=citrix.com; dmarc=pass action=none header.from=citrix.com; dkim=pass header.d=citrix.com; arc=none
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ja/d1sveR1AQ2luHbo4VNLAQvVgdkYyRQXcz65zgy3U=; b=ydezs3BEkNvgyUrmtwqylNlHV6rzxT6TVpXYgw5X1JDPOQaq2AJrqvp/kLeQ1jSgLUIWRgy6JROZv0U/D0yOz2fYvMIcC45JS+wJZtshWvsYeDMR42/iy8yDaIOoPjqjATltUWHX3mHoishhVG9K6PzPbEeOa6TSVPwyDSpQotzIAVskHEyrYr3PN3ryxz+wmNqL73LBRlC+iJOyIkX40z1g25MU7EZAaSYAYPZOxCx14/5Ir5XK7tb8vj/p1YLv1VqnPTfaiiCvbu6ctc2p3r+55HBzZedIGunPko6xaYllHw9m7zuBhWJRoBGZfRCsW1gKlSv4moXhkciRtVIJQA==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=he0iMyPXgqXEo/x5UW9L3DjVSnlsGWnUAyqNHUPIk+8tLigyC1sW055vJP22nuO1RUBNE6JnYwtTkY9yLZEl0kKoJGwne/2q0l8i9PgH0xlhKPB5GLfjdh/pIKN7Y02A8I4z6h8GTi10op+dIp+pFAdSO+auKcsbDpNXTsByMt7JxUeuMy9N1dwy7Vd5I5Q0K7UsH9a4D4veET0i63hICO6BfjBVl2AWz1UIx8ZDlElgW9QZbossx3jrPUm+7al7GYpy6BwAN621w/4r5sTgt38ZgzxoJejlPeOVBIsCW66qnR2VL75pZTSGz+GqOQJE18Ps28PPl1MritJF+NCmsg==
- Authentication-results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=citrix.com header.i="@citrix.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck"
- Authentication-results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=citrix.com;
- Cc: Jan Beulich <jbeulich@xxxxxxxx>, Andrew Cooper <andrew.cooper3@xxxxxxxxxx>, Roger Pau Monné <roger@xxxxxxxxxxxxxx>, Teddy Astie <teddy.astie@xxxxxxxxxx>
- Delivery-date: Thu, 12 Nov 2026 09:22:46 +0000
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
On 11/12/26 7:23 AM, Stephen Cheng wrote:
The decoder sign-extends all 8-bit immediates (SrcImmByte). For INT
imm8 the immediate is the vector, which is unsigned. So INT $0x80 to
INT $0xff put a negative vector into the event (e.g. -128 for 0x80).
hvm_inject_event() then fails its "vector == event->vector" assertion,
and a debug Xen panics. An HVM guest can trigger this with the forced
emulation prefix (hvm_fep).
Cast the vector to uint8_t, as is already done for the port of IN/OUT
and the operand of AAM/AAD.
Fixes: 52053d5fc2f9 ("x86/emul: Drop swint_emulate infrastructure")
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Stephen Cheng <stephen.cheng@xxxxxxxxxx>
---
I found this with an XTF test which runs "int $0x80" with the forced
emulation prefix. Tested on AMD with a debug build: without the patch
the host panics, with it the guest gets vector 0x80 (also 0x21, 0x7f
and 0xff).
xen/arch/x86/x86_emulate/x86_emulate.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c
b/xen/arch/x86/x86_emulate/x86_emulate.c
index f168f3ebcf..8d53873c67 100644
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -2453,7 +2453,7 @@ x86_emulate(
ctxt->event.type = X86_ET_SW_EXC;
break;
case 0xcd: /* int imm8 */
- ctxt->event.vector = imm1;
+ ctxt->event.vector = (uint8_t)imm1;
ctxt->event.type = X86_ET_SW_INT;
break;
case 0xce: /* into */
Reviewed-by: Ross Lagerwall <ross.lagerwall@xxxxxxxxxx>
Thanks,
Ross
|
