diff options
| author | Richard Henderson <rth@twiddle.net> | 2015-07-07 14:38:58 +0100 |
|---|---|---|
| committer | Richard Henderson <rth@twiddle.net> | 2016-02-15 14:50:00 +1100 |
| commit | 7d117ce81ef6258cdcc0d24c774d045fa4b5fd26 (patch) | |
| tree | 527dc8dd09070f575ed06e0677e5e3b9cf206f4a | |
| parent | bdd87b3b591add6e4d7c6b6125fcf0d706cc8bc4 (diff) | |
target-i386: Clear bndregs during legacy near jumps
Signed-off-by: Richard Henderson <rth@twiddle.net>
| -rw-r--r-- | target-i386/helper.h | 1 | ||||
| -rw-r--r-- | target-i386/mpx_helper.c | 8 | ||||
| -rw-r--r-- | target-i386/translate.c | 20 |
3 files changed, 29 insertions, 0 deletions
diff --git a/target-i386/helper.h b/target-i386/helper.h index 709b195fe4..60a615f65b 100644 --- a/target-i386/helper.h +++ b/target-i386/helper.h @@ -21,6 +21,7 @@ DEF_HELPER_FLAGS_3(bndldx32, TCG_CALL_NO_WG, i64, env, tl, tl) DEF_HELPER_FLAGS_3(bndldx64, TCG_CALL_NO_WG, i64, env, tl, tl) DEF_HELPER_FLAGS_5(bndstx32, TCG_CALL_NO_WG, void, env, tl, tl, i64, i64) DEF_HELPER_FLAGS_5(bndstx64, TCG_CALL_NO_WG, void, env, tl, tl, i64, i64) +DEF_HELPER_1(bnd_jmp, void, env) DEF_HELPER_2(aam, void, env, int) DEF_HELPER_2(aad, void, env, int) diff --git a/target-i386/mpx_helper.c b/target-i386/mpx_helper.c index 53d98347d9..1bf717af05 100644 --- a/target-i386/mpx_helper.c +++ b/target-i386/mpx_helper.c @@ -156,3 +156,11 @@ void helper_bndstx32(CPUX86State *env, target_ulong base, target_ulong ptr, cpu_stl_data_ra(env, bte + 4, ub, ra); cpu_stl_data_ra(env, bte + 8, ptr, ra); } + +void helper_bnd_jmp(CPUX86State *env) +{ + if (!(env->hflags2 & HF2_MPX_PR_MASK)) { + memset(env->bnd_regs, 0, sizeof(env->bnd_regs)); + env->hflags &= ~HF_MPX_IU_MASK; + } +} diff --git a/target-i386/translate.c b/target-i386/translate.c index 013c4592aa..ad7053ea1a 100644 --- a/target-i386/translate.c +++ b/target-i386/translate.c @@ -2406,6 +2406,19 @@ static void gen_reset_hflag(DisasContext *s, uint32_t mask) } } +/* Clear BND registers during legacy branches. */ +static void gen_bnd_jmp(DisasContext *s) +{ + /* Do nothing if BND prefix present, MPX is disabled, or if the + BNDREGs are known to be in INIT state already. The helper + itself will check BNDPRESERVE at runtime. */ + if ((s->prefix & PREFIX_REPNZ) == 0 + && (s->flags & HF_MPX_EN_MASK) == 0 + && (s->flags & HF_MPX_IU_MASK) == 0) { + gen_helper_bnd_jmp(cpu_env); + } +} + /* generate a generic end of block. Trace exception is also generated if needed */ static void gen_eob(DisasContext *s) @@ -4795,6 +4808,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s, tcg_gen_movi_tl(cpu_T1, next_eip); gen_push_v(s, cpu_T1); gen_op_jmp_v(cpu_T0); + gen_bnd_jmp(s); gen_eob(s); break; case 3: /* lcall Ev */ @@ -4820,6 +4834,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s, tcg_gen_ext16u_tl(cpu_T0, cpu_T0); } gen_op_jmp_v(cpu_T0); + gen_bnd_jmp(s); gen_eob(s); break; case 5: /* ljmp Ev */ @@ -6201,6 +6216,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s, gen_stack_update(s, val + (1 << ot)); /* Note that gen_pop_T0 uses a zero-extending load. */ gen_op_jmp_v(cpu_T0); + gen_bnd_jmp(s); gen_eob(s); break; case 0xc3: /* ret */ @@ -6208,6 +6224,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s, gen_pop_update(s, ot); /* Note that gen_pop_T0 uses a zero-extending load. */ gen_op_jmp_v(cpu_T0); + gen_bnd_jmp(s); gen_eob(s); break; case 0xca: /* lret im */ @@ -6274,6 +6291,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s, } tcg_gen_movi_tl(cpu_T0, next_eip); gen_push_v(s, cpu_T0); + gen_bnd_jmp(s); gen_jmp(s, tval); } break; @@ -6303,6 +6321,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s, } else if (!CODE64(s)) { tval &= 0xffffffff; } + gen_bnd_jmp(s); gen_jmp(s, tval); break; case 0xea: /* ljmp im */ @@ -6342,6 +6361,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s, if (dflag == MO_16) { tval &= 0xffff; } + gen_bnd_jmp(s); gen_jcc(s, b, tval, next_eip); break; |