From: "Jan Beulich" <JBeulich@suse.com>
To: xen-devel <xen-devel@lists.xenproject.org>
Cc: Andrew Cooper <andrew.cooper3@citrix.com>, Wei Liu <wei.liu2@citrix.com>
Subject: [PATCH 1/3] x86/HVM: limit writes to incoming TSS during task switch
Date: Tue, 22 Nov 2016 06:55:01 -0700 [thread overview]
Message-ID: <58345C450200007800120CD1@prv-mh.provo.novell.com> (raw)
In-Reply-To: <58345B6F0200007800120CC2@prv-mh.provo.novell.com>
[-- Attachment #1: Type: text/plain, Size: 2089 bytes --]
The only field modified (and even that conditionally) is the back link.
Write only that field, and only when it actually has been written to.
Take the opportunity and also ditch the pointless initializer from the
"tss" local variable.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -2890,7 +2890,7 @@ void hvm_task_switch(
u32 cr3, eip, eflags, eax, ecx, edx, ebx, esp, ebp, esi, edi;
u16 es, _3, cs, _4, ss, _5, ds, _6, fs, _7, gs, _8, ldt, _9;
u16 trace, iomap;
- } tss = { 0 };
+ } tss;
hvm_get_segment_register(v, x86_seg_gdtr, &gdt);
hvm_get_segment_register(v, x86_seg_tr, &prev_tr);
@@ -3010,12 +3010,6 @@ void hvm_task_switch(
regs->esi = tss.esi;
regs->edi = tss.edi;
- if ( (taskswitch_reason == TSW_call_or_int) )
- {
- regs->eflags |= X86_EFLAGS_NT;
- tss.back_link = prev_tr.sel;
- }
-
exn_raised = 0;
if ( hvm_load_segment_selector(x86_seg_es, tss.es, tss.eflags) ||
hvm_load_segment_selector(x86_seg_cs, tss.cs, tss.eflags) ||
@@ -3025,12 +3019,18 @@ void hvm_task_switch(
hvm_load_segment_selector(x86_seg_gs, tss.gs, tss.eflags) )
exn_raised = 1;
- rc = hvm_copy_to_guest_virt(
- tr.base, &tss, sizeof(tss), PFEC_page_present);
- if ( rc == HVMCOPY_bad_gva_to_gfn )
- exn_raised = 1;
- else if ( rc != HVMCOPY_okay )
- goto out;
+ if ( taskswitch_reason == TSW_call_or_int )
+ {
+ regs->eflags |= X86_EFLAGS_NT;
+ tss.back_link = prev_tr.sel;
+
+ rc = hvm_copy_to_guest_virt(tr.base + offsetof(typeof(tss), back_link),
+ &tss.back_link, sizeof(tss.back_link), 0);
+ if ( rc == HVMCOPY_bad_gva_to_gfn )
+ exn_raised = 1;
+ else if ( rc != HVMCOPY_okay )
+ goto out;
+ }
if ( (tss.trace & 1) && !exn_raised )
hvm_inject_hw_exception(TRAP_debug, HVM_DELIVER_NO_ERROR_CODE);
[-- Attachment #2: x86-HVM-task-switch-TSS-writeback.patch --]
[-- Type: text/plain, Size: 2143 bytes --]
x86/HVM: limit writes to incoming TSS during task switch
The only field modified (and even that conditionally) is the back link.
Write only that field, and only when it actually has been written to.
Take the opportunity and also ditch the pointless initializer from the
"tss" local variable.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -2890,7 +2890,7 @@ void hvm_task_switch(
u32 cr3, eip, eflags, eax, ecx, edx, ebx, esp, ebp, esi, edi;
u16 es, _3, cs, _4, ss, _5, ds, _6, fs, _7, gs, _8, ldt, _9;
u16 trace, iomap;
- } tss = { 0 };
+ } tss;
hvm_get_segment_register(v, x86_seg_gdtr, &gdt);
hvm_get_segment_register(v, x86_seg_tr, &prev_tr);
@@ -3010,12 +3010,6 @@ void hvm_task_switch(
regs->esi = tss.esi;
regs->edi = tss.edi;
- if ( (taskswitch_reason == TSW_call_or_int) )
- {
- regs->eflags |= X86_EFLAGS_NT;
- tss.back_link = prev_tr.sel;
- }
-
exn_raised = 0;
if ( hvm_load_segment_selector(x86_seg_es, tss.es, tss.eflags) ||
hvm_load_segment_selector(x86_seg_cs, tss.cs, tss.eflags) ||
@@ -3025,12 +3019,18 @@ void hvm_task_switch(
hvm_load_segment_selector(x86_seg_gs, tss.gs, tss.eflags) )
exn_raised = 1;
- rc = hvm_copy_to_guest_virt(
- tr.base, &tss, sizeof(tss), PFEC_page_present);
- if ( rc == HVMCOPY_bad_gva_to_gfn )
- exn_raised = 1;
- else if ( rc != HVMCOPY_okay )
- goto out;
+ if ( taskswitch_reason == TSW_call_or_int )
+ {
+ regs->eflags |= X86_EFLAGS_NT;
+ tss.back_link = prev_tr.sel;
+
+ rc = hvm_copy_to_guest_virt(tr.base + offsetof(typeof(tss), back_link),
+ &tss.back_link, sizeof(tss.back_link), 0);
+ if ( rc == HVMCOPY_bad_gva_to_gfn )
+ exn_raised = 1;
+ else if ( rc != HVMCOPY_okay )
+ goto out;
+ }
if ( (tss.trace & 1) && !exn_raised )
hvm_inject_hw_exception(TRAP_debug, HVM_DELIVER_NO_ERROR_CODE);
[-- Attachment #3: Type: text/plain, Size: 127 bytes --]
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
next prev parent reply other threads:[~2016-11-22 13:55 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-22 13:51 [PATCH 0/3] x86/HVM: XSA-192 follow-ups Jan Beulich
2016-11-22 13:55 ` Jan Beulich [this message]
2016-11-22 16:32 ` [PATCH 1/3] x86/HVM: limit writes to incoming TSS during task switch Andrew Cooper
2016-11-23 8:27 ` Jan Beulich
2016-11-23 10:59 ` Andrew Cooper
2016-11-22 13:55 ` [PATCH 2/3] x86/HVM: limit writes to outgoing " Jan Beulich
2016-11-22 16:46 ` Andrew Cooper
2016-11-23 8:30 ` Jan Beulich
2016-11-22 13:56 ` [PATCH 3/3] x86/HVM: correct error code writing " Jan Beulich
2016-11-22 16:58 ` Andrew Cooper
2016-11-23 8:33 ` Jan Beulich
2016-11-23 14:14 ` [PATCH 0/3] x86/HVM: XSA-192 follow-ups Wei Liu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=58345C450200007800120CD1@prv-mh.provo.novell.com \
--to=jbeulich@suse.com \
--cc=andrew.cooper3@citrix.com \
--cc=wei.liu2@citrix.com \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.