[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Xen-changelog] [xen stable-4.8] x86/pv: Fix up erroneous segments for 32bit syscall entry

commit 95befc64f106c8b5648f1f5b192112bd9c35b90e
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Wed Apr 18 16:49:46 2018 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Wed Apr 18 16:49:46 2018 +0200

    x86/pv: Fix up erroneous segments for 32bit syscall entry
    The existing FLAT_KERNEL_SS expands to the correct value, 0xe02b, but is the
    wrong constant to use.  Switch to FLAT_USER_SS32.
    For compat domains however, the reported values are entirely bogus.
    FLAT_USER_SS32 (value 0xe02b) is FLAT_RING3_CS in the 32bit ABI, while
    FLAT_USER_CS32 (value 0xe023) is FLAT_RING1_DS with an RPL of 3.
    The guests SYSCALL callback is invoked with a broken iret frame, and if left
    unmodified by the guest, will fail on the way back out when Xen's iret tries
    to load a code segment into %ss.
    In practice, this is only a problem for 32bit PV guests on AMD hardware, as
    Intel hardware doesn't permit the SYSCALL instruction outside of 64bit mode.
    This appears to have been broken ever since 64bit support was added to Xen,
    and has gone unnoticed because Linux doesn't use SYSCALL in 32bit builds.
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Wei Liu <wei.liu2@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    master commit: dba899de14989b3dff78009404ed891da7fefdc1
    master date: 2018-04-09 13:12:18 +0100
 xen/arch/x86/x86_64/compat/entry.S | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/xen/arch/x86/x86_64/compat/entry.S 
index 6828f40f48..9ef90cbda5 100644
--- a/xen/arch/x86/x86_64/compat/entry.S
+++ b/xen/arch/x86/x86_64/compat/entry.S
@@ -210,7 +210,7 @@ ENTRY(cstar_enter)
         /* sti could live here when we don't switch page tables below. */
         movq  8(%rsp),%rax /* Restore %rax. */
-        movq  $FLAT_KERNEL_SS,8(%rsp)
+        movq  $FLAT_USER_SS32, 8(%rsp) /* Assume a 64bit domain.  Compat 
handled lower. */
         pushq %r11
         pushq $FLAT_USER_CS32
         pushq %rcx
@@ -236,6 +236,11 @@ ENTRY(cstar_enter)
         movq  VCPU_domain(%rbx),%rcx
         cmpb  $0,DOMAIN_is_32bit_pv(%rcx)
         je    switch_to_kernel
+        /* Fix up reported %cs/%ss for compat domains. */
+        movl  $FLAT_COMPAT_USER_SS, UREGS_ss(%rsp)
+        movl  $FLAT_COMPAT_USER_CS, UREGS_cs(%rsp)
         cmpb  $0,VCPU_syscall32_disables_events(%rbx)
         movzwl VCPU_syscall32_sel(%rbx),%esi
         movq  VCPU_syscall32_addr(%rbx),%rax
generated by git-patchbot for /home/xen/git/xen.git#stable-4.8

Xen-changelog mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.