[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [PATCH 1/3] x86: Reject bad %dr6/%dr7 values when loading guest state
Right now, bad PV state is silently dropped and zeroed, while bad HVM state is passed directly to hardware and can trigger VMEntry/VMRUN failures. e.g. (XEN) d12v0 vmentry failure (reason 0x80000021): Invalid guest state (0) ... (XEN) RFLAGS=0x00000002 (0x00000002) DR7 = 0x4000000000000001 Furthermore, prior to c/s 30f43f4aa81e ("x86: Reorganise and rename debug register fields in struct vcpu") in Xen 4.11 where v->arch.dr6 was reduced in width, the toolstack can cause a host crash by loading a bad %dr6 value on VT-x hardware. Reject any %dr6/7 values with upper bits set. For PV guests, also audit %dr0..3 so they aren't silently zeroed later in the function. Leave a comment behind explaing how %dr4/5 handling changed, and why they're ignored now. Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx> --- CC: Jan Beulich <JBeulich@xxxxxxxx> CC: Roger Pau Monné <roger.pau@xxxxxxxxxx> CC: Wei Liu <wl@xxxxxxx> CC: Jinoh Kang <jinoh.kang.kr@xxxxxxxxx> --- xen/arch/x86/domain.c | 19 +++++++++++++++++++ xen/arch/x86/hvm/hvm.c | 8 ++++++++ 2 files changed, 27 insertions(+) diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c index fe86a7f8530f..0698e6d486fe 100644 --- a/xen/arch/x86/domain.c +++ b/xen/arch/x86/domain.c @@ -1074,8 +1074,27 @@ int arch_set_info_guest( #endif flags = c(flags); + if ( !compat ) + { + if ( c(debugreg[6]) != (uint32_t)c(debugreg[6]) || + c(debugreg[7]) != (uint32_t)c(debugreg[7]) ) + return -EINVAL; + } + if ( is_pv_domain(d) ) { + /* + * Prior to Xen 4.11, dr5 was used to hold the emulated-only + * subset of dr7, and dr4 was unused. + * + * In Xen 4.11 and later, dr4/5 are written as zero, ignored for + * backwards compatibility, and dr7 emulation is handled + * internally. + */ + for ( i = 0; i < ARRAY_SIZE(v->arch.dr); i++ ) + if ( !access_ok(c(debugreg[i]), sizeof(long)) ) + return -EINVAL; + if ( !compat ) { if ( !is_canonical_address(c.nat->user_regs.rip) || diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index 3a99c0ff20be..3dc2019eca67 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -1032,6 +1032,14 @@ static int cf_check hvm_load_cpu_ctxt(struct domain *d, hvm_domain_context_t *h) return -EINVAL; } + if ( ctxt.dr6 != (uint32_t)ctxt.dr6 || + ctxt.dr7 != (uint32_t)ctxt.dr7 ) + { + printk(XENLOG_G_ERR "%pv: HVM restore: bad DR6 %#"PRIx64" or DR7 %#"PRIx64"\n", + v, ctxt.dr6, ctxt.dr7); + return -EINVAL; + } + if ( ctxt.cr3 >> d->arch.cpuid->extd.maxphysaddr ) { printk(XENLOG_G_ERR "HVM%d restore: bad CR3 %#" PRIx64 "\n", -- 2.30.2
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |