@@ -2902,51 +2902,38 @@ void helper_fxrstor(CPUX86State *env, target_ulong ptr)
do_fxrstor(&ac, ptr);
}
-static void do_xrstor(CPUX86State *env, target_ulong ptr, uint64_t rfbm, uintptr_t ra)
+static bool valid_xrstor_header(X86Access *ac, uint64_t *pxsbv,
+ target_ulong ptr)
{
uint64_t xstate_bv, xcomp_bv, reserve0;
- X86Access ac;
- unsigned size, size_ext;
- rfbm &= env->xcr0;
+ xstate_bv = access_ldq(ac, ptr + XO(header.xstate_bv));
+ xcomp_bv = access_ldq(ac, ptr + XO(header.xcomp_bv));
+ reserve0 = access_ldq(ac, ptr + XO(header.reserve0));
+ *pxsbv = xstate_bv;
- size = sizeof(X86LegacyXSaveArea) + sizeof(X86XSaveHeader);
- access_prepare(&ac, env, ptr, size, MMU_DATA_LOAD, ra);
-
- xstate_bv = access_ldq(&ac, ptr + XO(header.xstate_bv));
-
- if ((int64_t)xstate_bv < 0) {
- /* FIXME: Compact form. */
- raise_exception_ra(env, EXCP0D_GPF, ra);
+ /*
+ * XCOMP_BV bit 63 indicates compact form, which we do not support,
+ * and thus must raise #GP. That leaves us in standard form.
+ * In standard form, bytes 23:8 must be zero -- which is both
+ * XCOMP_BV and the following 64-bit field.
+ */
+ if (xcomp_bv || reserve0) {
+ return false;
}
- /* Standard form. */
-
/* The XSTATE_BV field must not set bits not present in XCR0. */
- if (xstate_bv & ~env->xcr0) {
- raise_exception_ra(env, EXCP0D_GPF, ra);
- }
+ return (xstate_bv & ~ac->env->xcr0) == 0;
+}
- /* The XCOMP_BV field must be zero. Note that, as of the April 2016
- revision, the description of the XSAVE Header (Vol 1, Sec 13.4.2)
- describes only XCOMP_BV, but the description of the standard form
- of XRSTOR (Vol 1, Sec 13.8.1) checks bytes 23:8 for zero, which
- includes the next 64-bit field. */
- xcomp_bv = access_ldq(&ac, ptr + XO(header.xcomp_bv));
- reserve0 = access_ldq(&ac, ptr + XO(header.reserve0));
- if (xcomp_bv || reserve0) {
- raise_exception_ra(env, EXCP0D_GPF, ra);
- }
-
- size_ext = xsave_area_size(rfbm & xstate_bv, false);
- if (size < size_ext) {
- /* TODO: See if existing page probe has covered extra size. */
- access_prepare(&ac, env, ptr, size_ext, MMU_DATA_LOAD, ra);
- }
+static void do_xrstor(X86Access *ac, target_ulong ptr,
+ uint64_t rfbm, uint64_t xstate_bv)
+{
+ CPUX86State *env = ac->env;
if (rfbm & XSTATE_FP_MASK) {
if (xstate_bv & XSTATE_FP_MASK) {
- do_xrstor_fpu(&ac, ptr);
+ do_xrstor_fpu(ac, ptr);
} else {
do_fninit(env);
memset(env->fpregs, 0, sizeof(env->fpregs));
@@ -2955,23 +2942,23 @@ static void do_xrstor(CPUX86State *env, target_ulong ptr, uint64_t rfbm, uintptr
if (rfbm & XSTATE_SSE_MASK) {
/* Note that the standard form of XRSTOR loads MXCSR from memory
whether or not the XSTATE_BV bit is set. */
- do_xrstor_mxcsr(&ac, ptr);
+ do_xrstor_mxcsr(ac, ptr);
if (xstate_bv & XSTATE_SSE_MASK) {
- do_xrstor_sse(&ac, ptr);
+ do_xrstor_sse(ac, ptr);
} else {
do_clear_sse(env);
}
}
if (rfbm & XSTATE_YMM_MASK) {
if (xstate_bv & XSTATE_YMM_MASK) {
- do_xrstor_ymmh(&ac, ptr + XO(avx_state));
+ do_xrstor_ymmh(ac, ptr + XO(avx_state));
} else {
do_clear_ymmh(env);
}
}
if (rfbm & XSTATE_BNDREGS_MASK) {
if (xstate_bv & XSTATE_BNDREGS_MASK) {
- do_xrstor_bndregs(&ac, ptr + XO(bndreg_state));
+ do_xrstor_bndregs(ac, ptr + XO(bndreg_state));
env->hflags |= HF_MPX_IU_MASK;
} else {
memset(env->bnd_regs, 0, sizeof(env->bnd_regs));
@@ -2980,7 +2967,7 @@ static void do_xrstor(CPUX86State *env, target_ulong ptr, uint64_t rfbm, uintptr
}
if (rfbm & XSTATE_BNDCSR_MASK) {
if (xstate_bv & XSTATE_BNDCSR_MASK) {
- do_xrstor_bndcsr(&ac, ptr + XO(bndcsr_state));
+ do_xrstor_bndcsr(ac, ptr + XO(bndcsr_state));
} else {
memset(&env->bndcs_regs, 0, sizeof(env->bndcs_regs));
}
@@ -2989,7 +2976,7 @@ static void do_xrstor(CPUX86State *env, target_ulong ptr, uint64_t rfbm, uintptr
if (rfbm & XSTATE_PKRU_MASK) {
uint64_t old_pkru = env->pkru;
if (xstate_bv & XSTATE_PKRU_MASK) {
- do_xrstor_pkru(&ac, ptr + XO(pkru_state));
+ do_xrstor_pkru(ac, ptr + XO(pkru_state));
} else {
env->pkru = 0;
}
@@ -3005,9 +2992,27 @@ static void do_xrstor(CPUX86State *env, target_ulong ptr, uint64_t rfbm, uintptr
void helper_xrstor(CPUX86State *env, target_ulong ptr, uint64_t rfbm)
{
uintptr_t ra = GETPC();
+ X86Access ac;
+ uint64_t xstate_bv;
+ unsigned size, size_ext;
do_xsave_chk(env, ptr, ra);
- do_xrstor(env, ptr, rfbm, ra);
+
+ /* Begin with just the minimum size to validate the header. */
+ size = sizeof(X86LegacyXSaveArea) + sizeof(X86XSaveHeader);
+ access_prepare(&ac, env, ptr, size, MMU_DATA_LOAD, ra);
+ if (!valid_xrstor_header(&ac, &xstate_bv, ptr)) {
+ raise_exception_ra(env, EXCP0D_GPF, ra);
+ }
+
+ rfbm &= env->xcr0;
+ size_ext = xsave_area_size(rfbm & xstate_bv, false);
+ if (size < size_ext) {
+ /* TODO: See if existing page probe has covered extra size. */
+ access_prepare(&ac, env, ptr, size_ext, MMU_DATA_LOAD, ra);
+ }
+
+ do_xrstor(&ac, ptr, rfbm, xstate_bv);
}
#if defined(CONFIG_USER_ONLY)
@@ -3065,7 +3070,24 @@ void cpu_x86_xsave(CPUX86State *env, target_ulong ptr, uint64_t rfbm)
void cpu_x86_xrstor(CPUX86State *env, target_ulong ptr, uint64_t rfbm)
{
- do_xrstor(env, ptr, rfbm, 0);
+ X86Access ac;
+ uint64_t xstate_bv;
+ unsigned size;
+
+ /*
+ * Since this is only called from user-level signal handling,
+ * we should have done the job correctly there.
+ */
+ assert((rfbm & ~env->xcr0) == 0);
+ size = xsave_area_size(rfbm, false);
+ access_prepare(&ac, env, ptr, size, MMU_DATA_LOAD, 0);
+
+ if (!valid_xrstor_header(&ac, &xstate_bv, ptr)) {
+ /* TODO: Report failure to caller. */
+ xstate_bv &= env->xcr0;
+ }
+
+ do_xrstor(&ac, ptr, rfbm, xstate_bv);
}
#endif
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> --- target/i386/tcg/fpu_helper.c | 106 +++++++++++++++++++++-------------- 1 file changed, 64 insertions(+), 42 deletions(-)