From 518547b32ab41b12c1303d12e6e15fb1621dca4c Mon Sep 17 00:00:00 2001 From: Nadav Amit Date: Tue, 30 Sep 2014 20:49:19 +0300 Subject: [PATCH] KVM: x86: Emulator does not calculate address correctly In long-mode, when the address size is 4 bytes, the linear address is not truncated as the emulator mistakenly does. Instead, the offset within the segment (the ea field) should be truncated according to the address size. As Intel SDM says: "In 64-bit mode, the effective address components are added and the effective address is truncated ... before adding the full 64-bit segment base." Signed-off-by: Nadav Amit Signed-off-by: Paolo Bonzini --- arch/x86/kvm/emulate.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c index 058aff86cfba..bdd4197e31fa 100644 --- a/arch/x86/kvm/emulate.c +++ b/arch/x86/kvm/emulate.c @@ -655,7 +655,8 @@ static __always_inline int __linearize(struct x86_emulate_ctxt *ctxt, u16 sel; unsigned cpl; - la = seg_base(ctxt, addr.seg) + addr.ea; + la = seg_base(ctxt, addr.seg) + + (fetch || ctxt->ad_bytes == 8 ? addr.ea : (u32)addr.ea); *max_size = 0; switch (ctxt->mode) { case X86EMUL_MODE_PROT64: @@ -717,7 +718,7 @@ static __always_inline int __linearize(struct x86_emulate_ctxt *ctxt, } break; } - if (fetch ? ctxt->mode != X86EMUL_MODE_PROT64 : ctxt->ad_bytes != 8) + if (ctxt->mode != X86EMUL_MODE_PROT64) la &= (u32)-1; if (insn_aligned(ctxt, size) && ((la & (size - 1)) != 0)) return emulate_gp(ctxt, 0);