[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH] x86emul: Treat the vector of INT imm8 as unsigned
- To: jbeulich@xxxxxxxx
- From: Stephen Cheng <stephen.cheng@xxxxxxxxxx>
- Date: Thu, 12 Nov 2026 18:31:33 +0800
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=citrix.com; dmarc=pass action=none header.from=citrix.com; dkim=pass header.d=citrix.com; arc=none
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Z+cy3quM3jUuaEVRC1Z7UOiyA5Me0X4vpg4ZUNh8PTs=; b=isrU3QVQBgBrpCj5DEd5ov4cOcY6QND9BrTrDhtTcyoFosDCw/tez0V4TbmVkb5flQYeP2552IOGX9jW11JOk/DWbo5iNos3SZjUdYTuRMI4MKlDy4UXJy6Dvgr4Qd15+UUWS7fh29o2gLTBOlw2hvyK+dO+AYwkGUuklNoGyBXqKqJhFPyEfDFAiawN5zCZxV4S7vqaSk2V2CDVkKR6OxPxL7hbQI7eMFb4oWJGxh0wV8+K2wkst5XhyMDWvnXcRdclcqOCU1xrj0x9xq3V70ppaw3pafigc5LPNhZLo+PJs5Z9BopZ7Pw2PKDUx0jbhtnL7Ury0SNWKYx0cs8uvw==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=viYKQz5P8t+KhlHd7zcaS1qeGeUaJifmVji2HDIogdizcq8I+2jxHn2Ltsntss1UFeAp4yNB0CsMAvAix99vp43m/ngd/2oV7WAzKTJqr/43rQHP+g3CbzBCA4BYyxwWwZPyP1p/Da6gPm5PtxgxjHc7Ho2ogbYoRM2G33JlgvxLwUotqNKhgYNxh7FWEcUU8qyHWpSFGHfQYYszLnlz1VeDmtUZlRVRoTqCvuP3aKvUV1SSqUWFLb5B1FEoMqEDI/G8XebSQ7xHqIuuy171aaqDdzKmV37ahwKCAG67g6PwImB0ffn0QjoQt7MxHEVKdxj93Zu4XHay/EZeoNrmqw==
- Authentication-results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=citrix.com header.i="@citrix.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck"
- Authentication-results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=citrix.com;
- Cc: andrew.cooper3@xxxxxxxxxx, roger@xxxxxxxxxxxxxx, ross.lagerwall@xxxxxxxxxx, stephen.cheng@xxxxxxxxxx, teddy.astie@xxxxxxxxxx, xen-devel@xxxxxxxxxxxxxxxxxxxx
- Delivery-date: Thu, 12 Nov 2026 10:32:07 +0000
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
On 12.11.2026 10:29, Jan Beulich wrote:
> On 12.11.2026 08:23, Stephen Cheng wrote:
>> The decoder sign-extends all 8-bit immediates (SrcImmByte). For INT
>> imm8 the immediate is the vector, which is unsigned. So INT $0x80 to
>> INT $0xff put a negative vector into the event (e.g. -128 for 0x80).
>>
>> hvm_inject_event() then fails its "vector == event->vector" assertion,
>> and a debug Xen panics. An HVM guest can trigger this with the forced
>> emulation prefix (hvm_fep).
>>
>> Cast the vector to uint8_t, as is already done for the port of IN/OUT
>> and the operand of AAM/AAD.
>
> I'm afraid this isn't sufficient: At least x86_insn_immediate() is also
> affected, and then also for the other insns you mention above plus quite
> a few more (in particular uniformly for 0F, 0F3A and XOP08). I think
> this needs sorting in x86_decode_onebyte() for all of the former (some
> of which I then need to mirror into the APX series for Map4), and in the
> switch() below setting ctxt->opcode and s->desc (where decode_*() are
> called) for the latter three.
>
> There'll then want to be a 2nd Fixes: tag for the commit which
> introduced x86_insn_immediate().
Thanks Jan, I see. I'll move the fix into the decoder and add the 2nd
Fixes: tag in v2.
Two questions:
1. Which other one-byte insns do you mean by "quite a few more"? I can
see the shift/rotate counts (C0, C1). Are there others?
2. Should I keep the existing (uint8_t) casts at the IN/OUT and AAM/AAD
use sites, or drop them?
Stephen
|
