[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH] xen/x86/svm: Apply the virtual-8086 IOPL check to INT n only
- To: Stefano Stabellini <stefano.stabellini@xxxxxxx>, xen-devel@xxxxxxxxxxxxxxxxxxxx
- From: Ross Lagerwall <ross.lagerwall@xxxxxxxxxx>
- Date: Thu, 22 Oct 2026 14:55:32 +0100
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=citrix.com; dmarc=pass action=none header.from=citrix.com; dkim=pass header.d=citrix.com; arc=none
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Uv8rEWvSEwpvuZ2NCj5R5cblN2Dybczq/xXjhR3rDAs=; b=KJI2vpRKt3spDHX7iC3429nY+DRjCalwvbp/YLqi/wSTQzZCYi3b1F0aQQ3SYdAyWKdu3av4xvcNfwLXAhIDXzBnv7+PG4s0bM5ZgGr42NA8Z13YGPO3l0Dt7C32ayXg8epDd1OBNi/YJVw37USYdE8aGBjRLAXtT6tA1Suf0CrU0SquLhFggcv5CcwDevCon5r0U8T6V1L/FKNqWactGFQQp4Zbpva2TzF6PPQ64DP/DX80cxiDMKHKOLvGCvJFeOSrpBXU3TMP6o66lJTsURoewoFRRBlmlXBg0reoE+XiscDqMi/8BUjfJ5TIB7GCweY7E6tOVEZJNeMsMcEsXg==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=sern73/HzA0QW9TWGB0kWPWuIVNs2sdlbf1IcMPY3L6MEVyNHmxaOKV2a6pJGKkb3P97Tqoex2Ja9pVKk0+3gwvpA1me2lcYnWWScUOhtFsV8iRgF4bA/nfmtJScEEBBiArzIHAr753ZNy2OuGzYt+yc+a2g9ct2wPVEZJ1iRmAwj7MZpcSYe2r3o1PXmiQePgvKL/hDUZ4W++YzXhMkM83Gg5p4ERselhEiBS+1rYlK0bcccyvRBjMtJ6p/rdan83qpopUcRuFBKw/UMLqE3GNtK4nb8yAZKQkT78VkyUayxoFfg8zbrm14tYNv5cj095z8h/KZXxJK77G76wSKvQ==
- Authentication-results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=citrix.com header.i="@citrix.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck"
- Authentication-results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=citrix.com;
- Cc: jbeulich@xxxxxxxx, andrew.cooper3@xxxxxxxxxx, roger@xxxxxxxxxxxxxx, jason.andryuk@xxxxxxx, teddy.astie@xxxxxxxxxx
- Delivery-date: Thu, 22 Oct 2026 13:55:49 +0000
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
On 10/20/26 11:41 PM, Stefano Stabellini wrote:
In virtual-8086 mode with IOPL < 3, INT n raises #GP(0). INT1, INT3
and INTO are not affected. They are delivered normally.
svm_emul_swint_injection() applies the check to all of them, so an ICEBP
raises #GP instead of #DB. It also reports the IDT entry in the #GP
error code instead of 0.
Limit the check to INT n and use error code 0.
Signed-off-by: Stefano Stabellini <stefano.stabellini@xxxxxxx>
---
xen/arch/x86/hvm/svm/svm.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/xen/arch/x86/hvm/svm/svm.c b/xen/arch/x86/hvm/svm/svm.c
index 71e48351f2..df74531d1a 100644
--- a/xen/arch/x86/hvm/svm/svm.c
+++ b/xen/arch/x86/hvm/svm/svm.c
@@ -1153,9 +1153,12 @@ static void svm_emul_swint_injection(struct x86_event
*event)
* 32bit OS. Someone with many TUITs can see about reading the TSS
* Software Interrupt Redirection bitmap.
*/
- if ( (regs->eflags & X86_EFLAGS_VM) &&
+ if ( type == X86_ET_SW_INT && (regs->eflags & X86_EFLAGS_VM) &&
MASK_EXTR(regs->eflags, X86_EFLAGS_IOPL) != 3 )
+ {
+ ec = 0;
goto raise_exception;
+ }
/*
* Read all 8/16 bytes so the idtr limit check is applied properly to
I think this is correct. The check could perhaps move earlier to avoid needing
to reset ec to 0.
I do wonder though if there are other cases in the function where ec needs to
be reset to 0? The pseudocode in the APM seems to have at least one other case.
Ross
|
