xen-devel.lists.xenproject.org archive mirror
 help / color / mirror / Atom feed
From: "Jan Beulich" <JBeulich@suse.com>
To: Andrew Cooper <andrew.cooper3@citrix.com>
Cc: xen-devel <xen-devel@lists.xenproject.org>
Subject: Re: [PATCH 2/2] x86/HVM: re-order operations in hvm_ud_intercept()
Date: Fri, 17 Jun 2016 04:01:39 -0600	[thread overview]
Message-ID: <5763E6A302000078000F60E2@prv-mh.provo.novell.com> (raw)
In-Reply-To: <0eed9bd9-acb9-0bb7-ae70-34aff1df9b28@citrix.com>

>>> On 17.06.16 at 11:37, <andrew.cooper3@citrix.com> wrote:
> On 09/06/16 16:05, Jan Beulich wrote:
>>>>> On 09.06.16 at 16:27, <andrew.cooper3@citrix.com> wrote:
>>> On 09/06/16 15:13, Jan Beulich wrote:
>>>>>>> On 09.06.16 at 16:06, <andrew.cooper3@citrix.com> wrote:
>>>>> On 09/06/16 13:31, Jan Beulich wrote:
>>>>>>>>> On 09.06.16 at 13:34, <andrew.cooper3@citrix.com> wrote:
>>>>>>> On 08/06/16 14:43, Jan Beulich wrote:
>>>>>>>> Don't fetch CS explicitly, leverage the fact that hvm_emulate_prepare()
>>>>>>>> already does (and that hvm_virtual_to_linear_addr() doesn't alter it).
>>>>>>>> At once increase the length passed to hvm_virtual_to_linear_addr() by
>>>>>>>> one: There definitely needs to be at least one more opcode byte, and we
>>>>>>>> can avoid missing a wraparound case this way.
>>>>>>>> Signed-off-by: Jan Beulich <jbeulich@suse.com>
>>>>>>> I looked into this when you suggested it, but it latches the wrong eip
>>>>>>> in the emulation state, and you will end up re-emulating the ud2a
>>>>>>> instruction, rather than the following instruction.
>>>>>> Where is there any latching of eip? All hvm_emulate_prepare() does
>>>>>> is storing the regs pointer.
>>>>> Oh - so it does.  I clearly looked over it too quickly.
>>>>> What wraparound issue are you referring to?  Adding 1 will cause
>>>>> incorrect behaviour when the emulation prefix ends at the segment limit.
>>>> I don't think so: The prefix together with the actual instruction
>>>> encoding should be viewed as a single instruction, and it crossing
>>>> the segment limit should #GP. It wrapping at the prefix/encoding
>>>> boundary is the case that I'm specifically referring to (this case
>>>> should also #GP, but wouldn't without this adjustment).
>>> But the force emulation prefix specifically doesn't behave like other
>>> prefixes.
>>> It doesn't count towards the 15 byte instruction limit, and if the
>>> emulated instruction does fault, we want the fault pointing at the
>>> emulated instruction, not the force prefix.  We should avoid making any
>>> link.
>> Well, are you saying placing such a prefix right below the boundary
>> of a flat segment is _expected_ to get the instruction at address 0
>> emulated? I don't think I could buy that. The patch makes no other
>> connection between prefix and actual insn. And #GP because of
>> such a boundary condition should imo point at the prefix; only all
>> faults associated with the actual insn should point there.
> Ok.  That sounds reasonable.  Would it be possible to add a small
> comment to the code? Even with the commit message, I was confused as to
> the nature of the +1.

+        /*
+         * Note that in the call below we pass 1 more than the signature
+         * size, to guard against the overall code sequence wrapping between
+         * "prefix" and actual instruction. There's necessarily at least one
+         * actual instruction byte required, so this won't cause failure on
+         * legitimate uses.
+         */

> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>

Thanks, Jan

Xen-devel mailing list

      reply	other threads:[~2016-06-17 10:01 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-06-08 13:35 [PATCH] x86/HVM: mis adjustments Jan Beulich
2016-06-08 13:42 ` [PATCH 1/2] x86/HVM: constify hvm_virtual_to_linear_addr()'s segment register parameter Jan Beulich
2016-06-09 11:25   ` Andrew Cooper
2016-06-08 13:43 ` [PATCH 2/2] x86/HVM: re-order operations in hvm_ud_intercept() Jan Beulich
2016-06-09 11:34   ` Andrew Cooper
2016-06-09 12:31     ` Jan Beulich
2016-06-09 14:06       ` Andrew Cooper
2016-06-09 14:13         ` Jan Beulich
2016-06-09 14:27           ` Andrew Cooper
2016-06-09 15:05             ` Jan Beulich
2016-06-17  8:19               ` Ping: " Jan Beulich
2016-06-17  9:37               ` Andrew Cooper
2016-06-17 10:01                 ` Jan Beulich [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=5763E6A302000078000F60E2@prv-mh.provo.novell.com \
    --to=jbeulich@suse.com \
    --cc=andrew.cooper3@citrix.com \
    --cc=xen-devel@lists.xenproject.org \
    --subject='Re: [PATCH 2/2] x86/HVM: re-order operations in hvm_ud_intercept()' \


* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).