[Xen-changelog] [xen stable-4.8] x86: segment attribute handling adjustments

[patchbot@xxxxxxx]

commit b843de7f541037e8ff5779a017b837c71e7804af
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Thu Feb 9 10:22:55 2017 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Thu Feb 9 10:22:55 2017 +0100

    x86: segment attribute handling adjustments
    
    Null selector loads into SS (possible in 64-bit mode only, and only in
    rings other than ring 3) must not alter SS.DPL. (This was found to be
    an issue on KVM, and fixed in Linux commit 33ab91103b.)
    
    Further arch_set_info_hvm_guest() didn't make sure that the ASSERT()s
    in hvm_set_segment_register() wouldn't trigger: Add further checks, but
    tolerate (adjust) clear accessed (CS, SS, DS, ES) and busy (TR) bits.
    
    Finally the setting of the accessed bits for user segments was lost by
    commit dd5c85e312 ("x86/hvm: Reposition the modification of raw segment
    data from the VMCB/VMCS"), yet VMX requires them to be set for usable
    segments. Add respective ASSERT()s (the only path not properly setting
    them was arch_set_info_hvm_guest()).
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    master commit: 366ff5f1b3252f9069d5aedb2ffc2567bb0a37c9
    master date: 2017-01-20 14:39:12 +0100
---
 xen/arch/x86/domain.c                  | 25 +++++++++++++++++--------
 xen/arch/x86/x86_emulate/x86_emulate.c |  5 +++++
 2 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c
index eae643f..093856a 100644
--- a/xen/arch/x86/domain.c
+++ b/xen/arch/x86/domain.c
@@ -1315,16 +1315,24 @@ static inline int check_segment(struct segment_register 
*reg,
         return 0;
     }
 
-    if ( seg != x86_seg_tr && !reg->attr.fields.s )
+    if ( seg == x86_seg_tr )
     {
-        gprintk(XENLOG_ERR,
-                "System segment provided for a code or data segment\n");
-        return -EINVAL;
-    }
+        if ( reg->attr.fields.s )
+        {
+            gprintk(XENLOG_ERR, "Code or data segment provided for TR\n");
+            return -EINVAL;
+        }
 
-    if ( seg == x86_seg_tr && reg->attr.fields.s )
+        if ( reg->attr.fields.type != SYS_DESC_tss_busy )
+        {
+            gprintk(XENLOG_ERR, "Non-32-bit-TSS segment provided for TR\n");
+            return -EINVAL;
+        }
+    }
+    else if ( !reg->attr.fields.s )
     {
-        gprintk(XENLOG_ERR, "Code or data segment provided for TR\n");
+        gprintk(XENLOG_ERR,
+                "System segment provided for a code or data segment\n");
         return -EINVAL;
     }
 
@@ -1387,7 +1395,8 @@ int arch_set_info_hvm_guest(struct vcpu *v, const 
vcpu_hvm_context_t *ctx)
 #define SEG(s, r) ({                                                        \
     s = (struct segment_register){ .base = (r)->s ## _base,                 \
                                    .limit = (r)->s ## _limit,               \
-                                   .attr.bytes = (r)->s ## _ar };           \
+                                   .attr.bytes = (r)->s ## _ar |            \
+                                       (x86_seg_##s != x86_seg_tr ? 1 : 2) }; \
     check_segment(&s, x86_seg_ ## s); })
 
         rc = SEG(cs, regs);
diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c 
b/xen/arch/x86/x86_emulate/x86_emulate.c
index 8e9d36c..b234205 100644
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -1360,6 +1360,11 @@ protmode_load_seg(
         }
         memset(sreg, 0, sizeof(*sreg));
         sreg->sel = sel;
+
+        /* Since CPL == SS.DPL, we need to put back DPL. */
+        if ( seg == x86_seg_ss )
+            sreg->attr.fields.dpl = sel;
+
         return X86EMUL_OKAY;
     }
 
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.8

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog