[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [xen stable-4.18] x86emul: avoid triggering event related assertions
commit 18f900b77b3a85acadc2fe152ea354a02569acab Author: Jan Beulich <jbeulich@xxxxxxxx> AuthorDate: Wed Dec 6 10:40:19 2023 +0100 Commit: Jan Beulich <jbeulich@xxxxxxxx> CommitDate: Wed Dec 6 10:40:19 2023 +0100 x86emul: avoid triggering event related assertions The assertion at the end of x86_emulate_wrapper() as well as the ones in x86_emul_{hw_exception,pagefault}() can trigger if we ignore X86EMUL_EXCEPTION coming back from certain hook functions. Squash exceptions when merely probing MSRs, plus on SWAPGS'es "best effort" error handling path. In adjust_bnd() add another assertion after the read_xcr(0, ...) invocation, paralleling the one in x86emul_get_fpu() - XCR0 reads should never fault when XSAVE is (implicitly) known to be available. Also update the respective comment in x86_emulate_wrapper(). Fixes: 14a6be89ec04 ("x86emul: correct EFLAGS.TF handling") Fixes: cb2626c75813 ("x86emul: conditionally clear BNDn for branches") Fixes: 6eb43fcf8a0b ("x86emul: support SWAPGS") Reported-by: AFL Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx> Acked-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx> master commit: 787d11c5aaf4d3411d4658cff137cd49b0bd951b master date: 2023-12-05 09:57:05 +0100 --- xen/arch/x86/x86_emulate/0f01.c | 6 ++++-- xen/arch/x86/x86_emulate/0fae.c | 3 +++ xen/arch/x86/x86_emulate/x86_emulate.c | 28 +++++++++++++++++++++++----- 3 files changed, 30 insertions(+), 7 deletions(-) diff --git a/xen/arch/x86/x86_emulate/0f01.c b/xen/arch/x86/x86_emulate/0f01.c index ba43fc394b..1ba99609d6 100644 --- a/xen/arch/x86/x86_emulate/0f01.c +++ b/xen/arch/x86/x86_emulate/0f01.c @@ -200,8 +200,10 @@ int x86emul_0f01(struct x86_emulate_state *s, if ( (rc = ops->write_segment(x86_seg_gs, &sreg, ctxt)) != X86EMUL_OKAY ) { - /* Best effort unwind (i.e. no error checking). */ - ops->write_msr(MSR_SHADOW_GS_BASE, msr_val, ctxt); + /* Best effort unwind (i.e. no real error checking). */ + if ( ops->write_msr(MSR_SHADOW_GS_BASE, msr_val, + ctxt) == X86EMUL_EXCEPTION ) + x86_emul_reset_event(ctxt); goto done; } break; diff --git a/xen/arch/x86/x86_emulate/0fae.c b/xen/arch/x86/x86_emulate/0fae.c index 00840b1d07..ba77af58f2 100644 --- a/xen/arch/x86/x86_emulate/0fae.c +++ b/xen/arch/x86/x86_emulate/0fae.c @@ -55,7 +55,10 @@ int x86emul_0fae(struct x86_emulate_state *s, cr4 = X86_CR4_OSFXSR; if ( !ops->read_msr || ops->read_msr(MSR_EFER, &msr_val, ctxt) != X86EMUL_OKAY ) + { + x86_emul_reset_event(ctxt); msr_val = 0; + } if ( !(cr4 & X86_CR4_OSFXSR) || (mode_64bit() && mode_ring0() && (msr_val & EFER_FFXSE)) ) s->op_bytes = offsetof(struct x86_fxsr, xmm[0]); diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c index 94caec1d14..cf780da501 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -1143,10 +1143,18 @@ static bool is_branch_step(struct x86_emulate_ctxt *ctxt, const struct x86_emulate_ops *ops) { uint64_t debugctl; + int rc = X86EMUL_UNHANDLEABLE; - return ops->read_msr && - ops->read_msr(MSR_IA32_DEBUGCTLMSR, &debugctl, ctxt) == X86EMUL_OKAY && - (debugctl & IA32_DEBUGCTLMSR_BTF); + if ( !ops->read_msr || + (rc = ops->read_msr(MSR_IA32_DEBUGCTLMSR, &debugctl, + ctxt)) != X86EMUL_OKAY ) + { + if ( rc == X86EMUL_EXCEPTION ) + x86_emul_reset_event(ctxt); + debugctl = 0; + } + + return debugctl & IA32_DEBUGCTLMSR_BTF; } static void adjust_bnd(struct x86_emulate_ctxt *ctxt, @@ -1160,13 +1168,21 @@ static void adjust_bnd(struct x86_emulate_ctxt *ctxt, if ( !ops->read_xcr || ops->read_xcr(0, &xcr0, ctxt) != X86EMUL_OKAY || !(xcr0 & X86_XCR0_BNDREGS) || !(xcr0 & X86_XCR0_BNDCSR) ) + { + ASSERT(!ctxt->event_pending); return; + } if ( !mode_ring0() ) bndcfg = read_bndcfgu(); else if ( !ops->read_msr || - ops->read_msr(MSR_IA32_BNDCFGS, &bndcfg, ctxt) != X86EMUL_OKAY ) + (rc = ops->read_msr(MSR_IA32_BNDCFGS, &bndcfg, + ctxt)) != X86EMUL_OKAY ) + { + if ( rc == X86EMUL_EXCEPTION ) + x86_emul_reset_event(ctxt); return; + } if ( (bndcfg & IA32_BNDCFGS_ENABLE) && !(bndcfg & IA32_BNDCFGS_PRESERVE) ) { /* @@ -8677,7 +8693,9 @@ int x86_emulate_wrapper( * An event being pending should exactly match returning * X86EMUL_EXCEPTION. (If this trips, the chances are a codepath has * called hvm_inject_hw_exception() rather than using - * x86_emul_hw_exception().) + * x86_emul_hw_exception(), or the invocation of a hook has caused an + * exception to be raised, while the caller was only checking for + * success/failure.) */ ASSERT(ctxt->event_pending == (rc == X86EMUL_EXCEPTION)); -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.18
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |