# HG changeset patch
# User Keir Fraser <keir.fraser@xxxxxxxxxx>
# Date 1196959781 0
# Node ID 1a3035f3d5279ef99517ff904f0d66029acc638f
# Parent 111302f69b35468f1a463b93b591401e9375fb25
svm: Fix __update_guest_eip() to clear interrupt shadow.
Get rid of assertions about return value of get_instruction_length()
-- instead test in __update_guest_eip() and crash the domain.
Cache value of 'current' in svm_do_hlt().
The mismanagement of the interrupt shadow was found by Christoph
Egger of AMD.
Signed-off-by: Keir Fraser <keir@xxxxxxxxxxxxx>
xen-unstable changeset: 16398:bc6aaa44e296c0d905daf57ebe268b32faa58376
xen-unstable date: Tue Nov 20 15:05:36 2007 +0000
---
xen/arch/x86/hvm/svm/svm.c | 46 ++++++++++++++++++++++++----------
xen/include/asm-x86/hvm/svm/emulate.h | 10 -------
2 files changed, 33 insertions(+), 23 deletions(-)
diff -r 111302f69b35 -r 1a3035f3d527 xen/arch/x86/hvm/svm/svm.c
--- a/xen/arch/x86/hvm/svm/svm.c Thu Dec 06 16:36:45 2007 +0000
+++ b/xen/arch/x86/hvm/svm/svm.c Thu Dec 06 16:49:41 2007 +0000
@@ -69,6 +69,22 @@ static void *root_vmcb[NR_CPUS] __read_m
/* hardware assisted paging bits */
extern int opt_hap_enabled;
+static void inline __update_guest_eip(
+ struct vmcb_struct *vmcb, unsigned int inst_len)
+{
+ if ( unlikely((inst_len == 0) || (inst_len > 15)) )
+ {
+ gdprintk(XENLOG_ERR, "Bad instruction length %u\n", inst_len);
+ domain_crash(current->domain);
+ return;
+ }
+
+ vmcb->rip += inst_len;
+ vmcb->rflags &= ~X86_EFLAGS_RF;
+
+ current->arch.hvm_svm.vmcb->interrupt_shadow = 0;
+}
+
static void svm_inject_exception(struct vcpu *v, int trap,
int ev, int error_code)
{
@@ -1171,7 +1187,6 @@ static void svm_vmexit_do_cpuid(struct v
((uint64_t)eax << 32) | ebx, ((uint64_t)ecx << 32) | edx);
inst_len = __get_instruction_length(v, INSTR_CPUID, NULL);
- ASSERT(inst_len > 0);
__update_guest_eip(vmcb, inst_len);
}
@@ -2000,8 +2015,6 @@ static int svm_cr_access(struct vcpu *v,
inst_len = __get_instruction_length_from_list(
v, list_b, ARR_SIZE(list_b), &buffer[index], &match);
}
-
- ASSERT(inst_len > 0);
inst_len += index;
@@ -2100,8 +2113,6 @@ static int svm_cr_access(struct vcpu *v,
BUG();
}
- ASSERT(inst_len);
-
__update_guest_eip(vmcb, inst_len);
return result;
@@ -2224,7 +2235,11 @@ static void svm_do_msr_access(
static void svm_vmexit_do_hlt(struct vmcb_struct *vmcb)
{
- __update_guest_eip(vmcb, 1);
+ struct vcpu *curr = current;
+ unsigned int inst_len;
+
+ inst_len = __get_instruction_length(curr, INSTR_HLT, NULL);
+ __update_guest_eip(vmcb, inst_len);
/* Check for interrupt not handled or new interrupt. */
if ( (vmcb->rflags & X86_EFLAGS_IF) &&
@@ -2233,7 +2248,7 @@ static void svm_vmexit_do_hlt(struct vmc
return;
}
- HVMTRACE_1D(HLT, current, /*int pending=*/ 0);
+ HVMTRACE_1D(HLT, curr, /*int pending=*/ 0);
hvm_hlt(vmcb->rflags);
}
@@ -2261,17 +2276,15 @@ void svm_handle_invlpg(const short invlp
* Unknown how many bytes the invlpg instruction will take. Use the
* maximum instruction length here
*/
- if (inst_copy_from_guest(opcode, svm_rip2pointer(v), length) < length)
+ if ( inst_copy_from_guest(opcode, svm_rip2pointer(v), length) < length )
{
gdprintk(XENLOG_ERR, "Error reading memory %d bytes\n", length);
- domain_crash(v->domain);
- return;
+ goto crash;
}
if (invlpga)
{
inst_len = __get_instruction_length(v, INSTR_INVLPGA, opcode);
- ASSERT(inst_len > 0);
__update_guest_eip(vmcb, inst_len);
/*
@@ -2285,7 +2298,11 @@ void svm_handle_invlpg(const short invlp
/* What about multiple prefix codes? */
prefix = (is_prefix(opcode[0])?opcode[0]:0);
inst_len = __get_instruction_length(v, INSTR_INVLPG, opcode);
- ASSERT(inst_len > 0);
+ if ( inst_len <= 0 )
+ {
+ gdprintk(XENLOG_ERR, "Error getting invlpg instr len\n");
+ goto crash;
+ }
inst_len--;
length -= inst_len;
@@ -2307,6 +2324,10 @@ void svm_handle_invlpg(const short invlp
paging_invlpg(v, g_vaddr);
/* signal invplg to ASID handler */
svm_asid_g_invlpg (v, g_vaddr);
+ return;
+
+ crash:
+ domain_crash(v->domain);
}
@@ -2518,7 +2539,6 @@ asmlinkage void svm_vmexit_handler(struc
case VMEXIT_VMMCALL:
inst_len = __get_instruction_length(v, INSTR_VMCALL, NULL);
- ASSERT(inst_len > 0);
HVMTRACE_1D(VMMCALL, v, regs->eax);
rc = hvm_do_hypercall(regs);
if ( rc != HVM_HCALL_preempted )
diff -r 111302f69b35 -r 1a3035f3d527 xen/include/asm-x86/hvm/svm/emulate.h
--- a/xen/include/asm-x86/hvm/svm/emulate.h Thu Dec 06 16:36:45 2007 +0000
+++ b/xen/include/asm-x86/hvm/svm/emulate.h Thu Dec 06 16:49:41 2007 +0000
@@ -132,16 +132,6 @@ static inline int skip_prefix_bytes(u8 *
return index;
}
-
-
-static void inline __update_guest_eip(
- struct vmcb_struct *vmcb, int inst_len)
-{
- ASSERT(inst_len > 0);
- vmcb->rip += inst_len;
- vmcb->rflags &= ~X86_EFLAGS_RF;
-}
-
#endif /* __ASM_X86_HVM_SVM_EMULATE_H__ */
/*
_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog
|
Home