Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d4c6a154 authored by Gleb Natapov's avatar Gleb Natapov Committed by Marcelo Tosatti
Browse files

KVM: x86 emulator: Fix popf emulation 



POPF behaves differently depending on current CPU mode. Emulate correct
logic to prevent guest from changing flags that it can't change otherwise.

Signed-off-by: default avatarGleb Natapov <gleb@redhat.com>
Cc: stable@kernel.org
Signed-off-by: default avatarAvi Kivity <avi@redhat.com>
parent f850e2e6

arch/x86/kvm/emulate.c

+54 −1
Original line number Diff line number Diff line
@@ -343,11 +343,18 @@ static u32 group2_table[] = { 
};



/* EFLAGS bit definitions. */

#define EFLG_ID (1<<21)

#define EFLG_VIP (1<<20)

#define EFLG_VIF (1<<19)

#define EFLG_AC (1<<18)

#define EFLG_VM (1<<17)

#define EFLG_RF (1<<16)

#define EFLG_IOPL (3<<12)

#define EFLG_NT (1<<14)

#define EFLG_OF (1<<11)

#define EFLG_DF (1<<10)

#define EFLG_IF (1<<9)

#define EFLG_TF (1<<8)

#define EFLG_SF (1<<7)

#define EFLG_ZF (1<<6)

#define EFLG_AF (1<<4)
@@ -1214,6 +1221,49 @@ static int emulate_pop(struct x86_emulate_ctxt *ctxt, 
	return rc;

}



static int emulate_popf(struct x86_emulate_ctxt *ctxt,

		       struct x86_emulate_ops *ops,

		       void *dest, int len)

{

	int rc;

	unsigned long val, change_mask;

	int iopl = (ctxt->eflags & X86_EFLAGS_IOPL) >> IOPL_SHIFT;

	int cpl = kvm_x86_ops->get_cpl(ctxt->vcpu);



	rc = emulate_pop(ctxt, ops, &val, len);

	if (rc != X86EMUL_CONTINUE)

		return rc;



	change_mask = EFLG_CF | EFLG_PF | EFLG_AF | EFLG_ZF | EFLG_SF | EFLG_OF

		| EFLG_TF | EFLG_DF | EFLG_NT | EFLG_RF | EFLG_AC | EFLG_ID;



	switch(ctxt->mode) {

	case X86EMUL_MODE_PROT64:

	case X86EMUL_MODE_PROT32:

	case X86EMUL_MODE_PROT16:

		if (cpl == 0)

			change_mask |= EFLG_IOPL;

		if (cpl <= iopl)

			change_mask |= EFLG_IF;

		break;

	case X86EMUL_MODE_VM86:

		if (iopl < 3) {

			kvm_inject_gp(ctxt->vcpu, 0);

			return X86EMUL_PROPAGATE_FAULT;

		}

		change_mask |= EFLG_IF;

		break;

	default: /* real mode */

		change_mask |= (EFLG_IOPL | EFLG_IF);

		break;

	}



	*(unsigned long *)dest =

		(ctxt->eflags & ~change_mask) | (val & change_mask);



	return rc;

}



static void emulate_push_sreg(struct x86_emulate_ctxt *ctxt, int seg)

{

	struct decode_cache *c = &ctxt->decode;
@@ -2099,7 +2149,10 @@ x86_emulate_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops) 
		c->dst.type = OP_REG;

		c->dst.ptr = (unsigned long *) &ctxt->eflags;

		c->dst.bytes = c->op_bytes;

		goto pop_instruction;

		rc = emulate_popf(ctxt, ops, &c->dst.val, c->op_bytes);

		if (rc != X86EMUL_CONTINUE)

			goto done;

		break;

	case 0xa0 ... 0xa1:	/* mov */

		c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];

		c->dst.val = c->src.val;