yuzu/unicorn
1
0
Fork 0
mirror of https://github.com/yuzu-emu/unicorn.git synced 2025-02-25 21:57:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

target-i386: Clear bndregs during legacy near jumps

Browse source 
Backports commit 7d117ce81ef6258cdcc0d24c774d045fa4b5fd26 from qemu
This commit is contained in:
Richard Henderson 2018-02-20 14:36:06 -05:00 committed by Lioncash
parent 8ca89461b5
commit 86cc5862a1
No known key found for this signature in database
GPG key ID: 4E3C3CC1031BA9C7
3 changed files with 33 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
qemu/target-i386/helper.h
View file

@ -23,6 +23,7 @@ DEF_HELPER_FLAGS_3(bndldx32, TCG_CALL_NO_WG, i64, env, tl, tl)
DEF_HELPER_FLAGS_3(bndldx64, TCG_CALL_NO_WG, i64, env, tl, tl) DEF_HELPER_FLAGS_3(bndldx64, TCG_CALL_NO_WG, i64, env, tl, tl)
DEF_HELPER_FLAGS_5(bndstx32, TCG_CALL_NO_WG, void, env, tl, tl, i64, i64) DEF_HELPER_FLAGS_5(bndstx32, TCG_CALL_NO_WG, void, env, tl, tl, i64, i64)
DEF_HELPER_FLAGS_5(bndstx64, TCG_CALL_NO_WG, void, env, tl, tl, i64, i64) DEF_HELPER_FLAGS_5(bndstx64, TCG_CALL_NO_WG, void, env, tl, tl, i64, i64)
DEF_HELPER_1(bnd_jmp, void, env)
DEF_HELPER_2(aam, void, env, int) DEF_HELPER_2(aam, void, env, int)
DEF_HELPER_2(aad, void, env, int) DEF_HELPER_2(aad, void, env, int)

9
qemu/target-i386/mpx_helper.c
View file

@ -156,3 +156,12 @@ void helper_bndstx32(CPUX86State *env, target_ulong base, target_ulong ptr,
cpu_stl_data_ra(env, bte + 4, ub, ra); cpu_stl_data_ra(env, bte + 4, ub, ra);
cpu_stl_data_ra(env, bte + 8, ptr, ra); cpu_stl_data_ra(env, bte + 8, ptr, ra);
} }
void helper_bnd_jmp(CPUX86State *env)
{
if (!(env->hflags2 & HF2_MPX_PR_MASK)) {
memset(env->bnd_regs, 0, sizeof(env->bnd_regs));
env->hflags &= ~HF_MPX_IU_MASK;
}
}

23
qemu/target-i386/translate.c
View file

@ -2744,6 +2744,22 @@ static void gen_reset_hflag(DisasContext *s, uint32_t mask)
} }
} }
/* Clear BND registers during legacy branches. */
static void gen_bnd_jmp(DisasContext *s)
{
TCGContext *tcg_ctx = s->uc->tcg_ctx;
TCGv_ptr cpu_env = tcg_ctx->cpu_env;
/* Do nothing if BND prefix present, MPX is disabled, or if the
BNDREGs are known to be in INIT state already. The helper
itself will check BNDPRESERVE at runtime. */
if ((s->prefix & PREFIX_REPNZ) == 0
&& (s->flags & HF_MPX_EN_MASK) == 0
&& (s->flags & HF_MPX_IU_MASK) == 0) {
gen_helper_bnd_jmp(tcg_ctx, cpu_env);
}
}
/* generate a generic end of block. Trace exception is also generated /* generate a generic end of block. Trace exception is also generated
if needed */ if needed */
static void gen_eob(DisasContext *s) static void gen_eob(DisasContext *s)
@ -5444,6 +5460,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
tcg_gen_movi_tl(tcg_ctx, cpu_T1, next_eip); tcg_gen_movi_tl(tcg_ctx, cpu_T1, next_eip);
gen_push_v(s, cpu_T1); gen_push_v(s, cpu_T1);
gen_op_jmp_v(tcg_ctx, cpu_T0); gen_op_jmp_v(tcg_ctx, cpu_T0);
gen_bnd_jmp(s);
gen_eob(s); gen_eob(s);
break; break;
case 3: /* lcall Ev */ case 3: /* lcall Ev */
@ -5469,6 +5486,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
tcg_gen_ext16u_tl(tcg_ctx, cpu_T0, cpu_T0); tcg_gen_ext16u_tl(tcg_ctx, cpu_T0, cpu_T0);
} }
gen_op_jmp_v(tcg_ctx, cpu_T0); gen_op_jmp_v(tcg_ctx, cpu_T0);
gen_bnd_jmp(s);
gen_eob(s); gen_eob(s);
break; break;
case 5: /* ljmp Ev */ case 5: /* ljmp Ev */
@ -6869,6 +6887,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
gen_stack_update(s, val + (1 << ot)); gen_stack_update(s, val + (1 << ot));
/* Note that gen_pop_T0 uses a zero-extending load. */ /* Note that gen_pop_T0 uses a zero-extending load. */
gen_op_jmp_v(tcg_ctx, cpu_T0); gen_op_jmp_v(tcg_ctx, cpu_T0);
gen_bnd_jmp(s);
gen_eob(s); gen_eob(s);
break; break;
case 0xc3: /* ret */ case 0xc3: /* ret */
@ -6876,6 +6895,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
gen_pop_update(s, ot); gen_pop_update(s, ot);
/* Note that gen_pop_T0 uses a zero-extending load. */ /* Note that gen_pop_T0 uses a zero-extending load. */
gen_op_jmp_v(tcg_ctx, cpu_T0); gen_op_jmp_v(tcg_ctx, cpu_T0);
gen_bnd_jmp(s);
gen_eob(s); gen_eob(s);
break; break;
case 0xca: /* lret im */ case 0xca: /* lret im */
@ -6942,6 +6962,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
} }
tcg_gen_movi_tl(tcg_ctx, cpu_T0, next_eip); tcg_gen_movi_tl(tcg_ctx, cpu_T0, next_eip);
gen_push_v(s, cpu_T0); gen_push_v(s, cpu_T0);
gen_bnd_jmp(s);
gen_jmp(s, tval); gen_jmp(s, tval);
} }
break; break;
@ -6971,6 +6992,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
} else if (!CODE64(s)) { } else if (!CODE64(s)) {
tval &= 0xffffffff; tval &= 0xffffffff;
} }
gen_bnd_jmp(s);
gen_jmp(s, tval); gen_jmp(s, tval);
break; break;
case 0xea: /* ljmp im */ case 0xea: /* ljmp im */
@ -7014,6 +7036,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
if (dflag == MO_16) { if (dflag == MO_16) {
tval &= 0xffff; tval &= 0xffff;
} }
gen_bnd_jmp(s);
gen_jcc(s, b, tval, next_eip); gen_jcc(s, b, tval, next_eip);
break; break;