From: Andrew Cooper Date: Fri, 9 Dec 2016 18:40:11 +0000 (+0000) Subject: x86/emul: Correct the return value handling of VMFUNC X-Git-Tag: archive/raspbian/4.11.1-1+rpi1~1^2~66^2~3078 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=3ab1876504d409689824e161a8b04e57e1e5dd46;p=xen.git x86/emul: Correct the return value handling of VMFUNC The bracketing of x86_emulate() calling the ops->vmfunc() hook is wrong with respect to the assignment to rc, which can trip the new assertions in x86_emulate_wrapper(). The hvmemul_vmfunc() hook should only raise #UD if X86EMUL_EXCEPTION is returned. This is only a latent bug at the moment. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c index 24754d3a8e..aa1b7162df 100644 --- a/xen/arch/x86/hvm/emulate.c +++ b/xen/arch/x86/hvm/emulate.c @@ -1653,7 +1653,7 @@ static int hvmemul_vmfunc( if ( !hvm_funcs.altp2m_vcpu_emulate_vmfunc ) return X86EMUL_UNHANDLEABLE; rc = hvm_funcs.altp2m_vcpu_emulate_vmfunc(ctxt->regs); - if ( rc != X86EMUL_OKAY ) + if ( rc == X86EMUL_EXCEPTION ) x86_emul_hw_exception(TRAP_invalid_op, X86_EVENT_NO_EC, ctxt); return rc; diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c index b6d73588a0..3076c0c493 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -4463,7 +4463,7 @@ x86_emulate( generate_exception_if(lock_prefix | rep_prefix() | (vex.pfx == vex_66), EXC_UD); fail_if(!ops->vmfunc); - if ( (rc = ops->vmfunc(ctxt) != X86EMUL_OKAY) ) + if ( (rc = ops->vmfunc(ctxt)) != X86EMUL_OKAY ) goto done; goto no_writeback;