[Xen-changelog] [xen stable-4.6] x86/emulate: don't assume that addr_size == 32 implies protected mode

[patchbot@xxxxxxx]

commit 576f319a804bce8c9a7fb70a042f873f5eaf0151
Author:     George Dunlap <george.dunlap@xxxxxxxxxx>
AuthorDate: Thu Feb 9 10:37:08 2017 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Thu Feb 9 10:37:08 2017 +0100

    x86/emulate: don't assume that addr_size == 32 implies protected mode
    
    Callers of x86_emulate() generally define addr_size based on the code
    segment.  In vm86 mode, the code segment is set by the hardware to be
    16-bits; but it is entirely possible to enable protected mode, set the
    CS to 32-bits, and then disable protected mode.  (This is commonly
    called "unreal mode".)
    
    But the instruction decoder only checks for protected mode when
    addr_size == 16.  So in unreal mode, hardware will throw a #UD for VEX
    prefixes, but our instruction decoder will decode them, triggering an
    ASSERT() further on in _get_fpu().  (With debug=n the emulator will
    incorrectly emulate the instruction rather than throwing a #UD, but
    this is only a bug, not a crash, so it's not a security issue.)
    
    Teach the instruction decoder to check that we're in protected mode,
    even if addr_size is 32.
    
    Signed-off-by: George Dunlap <george.dunlap@xxxxxxxxxx>
    
    Split real mode and VM86 mode handling, as VM86 mode is strictly 16-bit
    at all times. Re-base.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    master commit: 05118b1596ffe4559549edbb28bd0124a7316123
    master date: 2017-01-25 15:09:55 +0100
---
 xen/arch/x86/x86_emulate/x86_emulate.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c 
b/xen/arch/x86/x86_emulate/x86_emulate.c
index ad26983d..cca9034 100644
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -1689,11 +1689,11 @@ x86_emulate(
             default:
                 BUG();
             case 2:
-                if ( in_realmode(ctxt, ops) || (_regs.eflags & EFLG_VM) )
+                if ( _regs.eflags & EFLG_VM )
                     break;
                 /* fall through */
             case 4:
-                if ( modrm_mod != 3 )
+                if ( modrm_mod != 3 || in_realmode(ctxt, ops) )
                     break;
                 /* fall through */
             case 8:
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.6

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog