Re: [Xen-devel] [PATCH 2/2] x86/emulate: don't assume that addr_size == 32 implies protected mode

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

On 25/01/17 10:32, Jan Beulich wrote:
> From: George Dunlap <george.dunlap@xxxxxxxxxx>
>
> Callers of x86_emulate() generally define addr_size based on the code
> segment.  In vm86 mode, the code segment is set by the hardware to be
> 16-bits; but it is entirely possible to enable protected mode, set the
> CS to 32-bits, and then disable protected mode.  (This is commonly
> called "unreal mode".)
>
> But the instruction decoder only checks for protected mode when
> addr_size == 16.  So in unreal mode, hardware will throw a #UD for VEX
> prefixes, but our instruction decoder will decode them, triggering an
> ASSERT() further on in _get_fpu().  (With debug=n the emulator will
> incorrectly emulate the instruction rather than throwing a #UD, but
> this is only a bug, not a crash, so it's not a security issue.)
>
> Teach the instruction decoder to check that we're in protected mode,
> even if addr_size is 32.
>
> While we're here, replace the open-coded protected mode check with
> in_protmode().
>
> Signed-off-by: George Dunlap <george.dunlap@xxxxxxxxxx>
>
> Split real mode and VM86 mode handling, as VM86 mode is strictly 16-bit
> at all times. Re-base.
>
> Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>

Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>, although you
might want to remove the in_protmode() paragraph from the commit message
as it is no longer applicable.

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel