From: George Dunlap Date: Wed, 25 Jan 2017 14:09:55 +0000 (+0100) Subject: x86/emulate: don't assume that addr_size == 32 implies protected mode X-Git-Tag: archive/raspbian/4.11.1-1+rpi1~1^2~66^2~2891 X-Git-Url: https://dgit.raspbian.org/%22http:/www.example.com/cgi/%22https:/%22bookmarks://%22%22/%22http:/www.example.com/cgi/%22https:/%22bookmarks:/%22%22?a=commitdiff_plain;h=05118b1596ffe4559549edbb28bd0124a7316123;p=xen.git x86/emulate: don't assume that addr_size == 32 implies protected mode Callers of x86_emulate() generally define addr_size based on the code segment. In vm86 mode, the code segment is set by the hardware to be 16-bits; but it is entirely possible to enable protected mode, set the CS to 32-bits, and then disable protected mode. (This is commonly called "unreal mode".) But the instruction decoder only checks for protected mode when addr_size == 16. So in unreal mode, hardware will throw a #UD for VEX prefixes, but our instruction decoder will decode them, triggering an ASSERT() further on in _get_fpu(). (With debug=n the emulator will incorrectly emulate the instruction rather than throwing a #UD, but this is only a bug, not a crash, so it's not a security issue.) Teach the instruction decoder to check that we're in protected mode, even if addr_size is 32. Signed-off-by: George Dunlap Split real mode and VM86 mode handling, as VM86 mode is strictly 16-bit at all times. Re-base. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper --- diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c index 6f81cc7904..21dd98cebc 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -2313,11 +2313,11 @@ x86_decode( default: BUG(); /* Shouldn't be possible. */ case 2: - if ( in_realmode(ctxt, ops) || (state->regs->_eflags & EFLG_VM) ) + if ( state->regs->_eflags & EFLG_VM ) break; /* fall through */ case 4: - if ( modrm_mod != 3 ) + if ( modrm_mod != 3 || in_realmode(ctxt, ops) ) break; /* fall through */ case 8: