Both need to raise #GP(0) when in VM86 mode with IOPL < 3.
Additionally PUSHF is documented to clear VM and RF from the value
placed onto the stack.
Signed-off-by: Jan Beulich <jbeul...@suse.com>
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -3121,13 +3121,20 @@ x86_emulate(
}
case 0x9c: /* pushf */
- src.val = _regs.eflags;
+ generate_exception_if((_regs.eflags & EFLG_VM) &&
+ (_regs.eflags & EFLG_IOPL) != EFLG_IOPL,
+ EXC_GP, 0);
+ src.val = _regs.eflags & ~(EFLG_VM | EFLG_RF);
goto push;
case 0x9d: /* popf */ {
uint32_t mask = EFLG_VIP | EFLG_VIF | EFLG_VM;
+
if ( !mode_ring0() )
{
+ generate_exception_if((_regs.eflags & EFLG_VM) &&
+ (_regs.eflags & EFLG_IOPL) != EFLG_IOPL,
+ EXC_GP, 0);
mask |= EFLG_IOPL;
if ( !mode_iopl() )
mask |= EFLG_IF;
x86emul: correct PUSHF/POPF
Both need to raise #GP(0) when in VM86 mode with IOPL < 3.
Additionally PUSHF is documented to clear VM and RF from the value
placed onto the stack.
Signed-off-by: Jan Beulich <jbeul...@suse.com>
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -3121,13 +3121,20 @@ x86_emulate(
}
case 0x9c: /* pushf */
- src.val = _regs.eflags;
+ generate_exception_if((_regs.eflags & EFLG_VM) &&
+ (_regs.eflags & EFLG_IOPL) != EFLG_IOPL,
+ EXC_GP, 0);
+ src.val = _regs.eflags & ~(EFLG_VM | EFLG_RF);
goto push;
case 0x9d: /* popf */ {
uint32_t mask = EFLG_VIP | EFLG_VIF | EFLG_VM;
+
if ( !mode_ring0() )
{
+ generate_exception_if((_regs.eflags & EFLG_VM) &&
+ (_regs.eflags & EFLG_IOPL) != EFLG_IOPL,
+ EXC_GP, 0);
mask |= EFLG_IOPL;
if ( !mode_iopl() )
mask |= EFLG_IF;
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
