[Xen-devel] [PATCH 1/2] x86/emul: Correct the return value handling of VMFUNC

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

The bracketing of x86_emulate() calling the ops->vmfunc() hook is wrong with
respect to the assignment to rc, which can trip the new assertions in
x86_emulate_wrapper().

The hvmemul_vmfunc() hook should only raise #UD if X86EMUL_EXCEPTION is
returned.  This is only a latent bug at the moment.

Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
---
CC: Jan Beulich <JBeulich@xxxxxxxx>
CC: Paul Durrant <paul.durrant@xxxxxxxxxx>
---
 xen/arch/x86/hvm/emulate.c             | 2 +-
 xen/arch/x86/x86_emulate/x86_emulate.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c
index 24754d3..aa1b716 100644
--- a/xen/arch/x86/hvm/emulate.c
+++ b/xen/arch/x86/hvm/emulate.c
@@ -1653,7 +1653,7 @@ static int hvmemul_vmfunc(
     if ( !hvm_funcs.altp2m_vcpu_emulate_vmfunc )
         return X86EMUL_UNHANDLEABLE;
     rc = hvm_funcs.altp2m_vcpu_emulate_vmfunc(ctxt->regs);
-    if ( rc != X86EMUL_OKAY )
+    if ( rc == X86EMUL_EXCEPTION )
         x86_emul_hw_exception(TRAP_invalid_op, X86_EVENT_NO_EC, ctxt);
 
     return rc;
diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c 
b/xen/arch/x86/x86_emulate/x86_emulate.c
index b6d7358..3076c0c 100644
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -4463,7 +4463,7 @@ x86_emulate(
             generate_exception_if(lock_prefix | rep_prefix() | (vex.pfx == 
vex_66),
                                   EXC_UD);
             fail_if(!ops->vmfunc);
-            if ( (rc = ops->vmfunc(ctxt) != X86EMUL_OKAY) )
+            if ( (rc = ops->vmfunc(ctxt)) != X86EMUL_OKAY )
                 goto done;
             goto no_writeback;
 
-- 
1.9.1


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel