From ff555d59e8a477b960ec248cdebe5ef97bef6888 Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Wed, 18 Jan 2017 10:08:55 +0100 Subject: [PATCH] x86emul: correct PUSHF/POPF Both need to raise #GP(0) when in VM86 mode with IOPL < 3. Additionally PUSHF is documented to clear VM and RF from the value placed onto the stack. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper master commit: e5c1b8145bccb7fc587ee5b0c95ace6c5e0c7ffd master date: 2016-12-07 13:55:42 +0100 --- xen/arch/x86/x86_emulate/x86_emulate.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c index 8a7a5ada01..fe3af25059 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -2563,13 +2563,20 @@ x86_emulate( } case 0x9c: /* pushf */ - src.val = _regs.eflags; + generate_exception_if((_regs.eflags & EFLG_VM) && + MASK_EXTR(_regs.eflags, EFLG_IOPL) != 3, + EXC_GP, 0); + src.val = _regs.eflags & ~(EFLG_VM | EFLG_RF); goto push; case 0x9d: /* popf */ { uint32_t mask = EFLG_VIP | EFLG_VIF | EFLG_VM; + if ( !mode_ring0() ) { + generate_exception_if((_regs.eflags & EFLG_VM) && + MASK_EXTR(_regs.eflags, EFLG_IOPL) != 3, + EXC_GP, 0); mask |= EFLG_IOPL; if ( !mode_iopl() ) mask |= EFLG_IF; -- 2.39.5