mirror of
https://github.com/xen-project/xen.git
synced 2026-10-29 18:50:05 +01:00
x86/pv: Move exception injection into {,compat_}test_all_events()
This allows paths to jump straight to {,compat_}test_all_events() and have
injection of pending exceptions happen automatically, rather than requiring
all calling paths to handle exceptions themselves.
The normal exception path is simplified as a result, and
compat_post_handle_exception() is removed entirely.
This is part of XSA-260 / CVE-2018-8897.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
This commit is contained in:
Andrew Cooper committed
1 parent
90676b7df3
commit
40c4ab8a20
2 files changed
+31
-16
No files matched your search
@@ -45,6 +45,12 @@ ENTRY(compat_test_all_events)
|
||||
leaq irq_stat+IRQSTAT_softirq_pending(%rip),%rcx
|
||||
cmpl $0,(%rcx,%rax,1)
|
||||
jne compat_process_softirqs
|
||||
|
||||
/* Inject exception if pending. */
|
||||
lea VCPU_trap_bounce(%rbx), %rdx
|
||||
testb $TBF_EXCEPTION, TRAPBOUNCE_flags(%rdx)
|
||||
jnz .Lcompat_process_trapbounce
|
||||
|
||||
testb $1,VCPU_mce_pending(%rbx)
|
||||
jnz compat_process_mce
|
||||
.Lcompat_test_guest_nmi:
|
||||
@@ -74,6 +80,15 @@ compat_process_softirqs:
|
||||
call do_softirq
|
||||
jmp compat_test_all_events
|
||||
|
||||
ALIGN
|
||||
/* %rbx: struct vcpu, %rdx: struct trap_bounce */
|
||||
.Lcompat_process_trapbounce:
|
||||
sti
|
||||
.Lcompat_bounce_exception:
|
||||
call compat_create_bounce_frame
|
||||
movb $0, TRAPBOUNCE_flags(%rdx)
|
||||
jmp compat_test_all_events
|
||||
|
||||
ALIGN
|
||||
/* %rbx: struct vcpu */
|
||||
compat_process_mce:
|
||||
@@ -194,15 +209,6 @@ ENTRY(cr4_pv32_restore)
|
||||
xor %eax, %eax
|
||||
ret
|
||||
|
||||
/* %rdx: trap_bounce, %rbx: struct vcpu */
|
||||
ENTRY(compat_post_handle_exception)
|
||||
testb $TBF_EXCEPTION,TRAPBOUNCE_flags(%rdx)
|
||||
jz compat_test_all_events
|
||||
.Lcompat_bounce_exception:
|
||||
call compat_create_bounce_frame
|
||||
movb $0,TRAPBOUNCE_flags(%rdx)
|
||||
jmp compat_test_all_events
|
||||
|
||||
.section .text.entry, "ax", @progbits
|
||||
|
||||
/* See lstar_enter for entry register state. */
|
||||
|
||||
@@ -41,6 +41,12 @@ test_all_events:
|
||||
leaq irq_stat+IRQSTAT_softirq_pending(%rip), %rcx
|
||||
cmpl $0, (%rcx, %rax, 1)
|
||||
jne process_softirqs
|
||||
|
||||
/* Inject exception if pending. */
|
||||
lea VCPU_trap_bounce(%rbx), %rdx
|
||||
testb $TBF_EXCEPTION, TRAPBOUNCE_flags(%rdx)
|
||||
jnz .Lprocess_trapbounce
|
||||
|
||||
cmpb $0, VCPU_mce_pending(%rbx)
|
||||
jne process_mce
|
||||
.Ltest_guest_nmi:
|
||||
@@ -68,6 +74,15 @@ process_softirqs:
|
||||
call do_softirq
|
||||
jmp test_all_events
|
||||
|
||||
ALIGN
|
||||
/* %rbx: struct vcpu, %rdx struct trap_bounce */
|
||||
.Lprocess_trapbounce:
|
||||
sti
|
||||
.Lbounce_exception:
|
||||
call create_bounce_frame
|
||||
movb $0, TRAPBOUNCE_flags(%rdx)
|
||||
jmp test_all_events
|
||||
|
||||
ALIGN
|
||||
/* %rbx: struct vcpu */
|
||||
process_mce:
|
||||
@@ -659,15 +674,9 @@ handle_exception_saved:
|
||||
mov %r15, STACK_CPUINFO_FIELD(xen_cr3)(%r14)
|
||||
testb $3,UREGS_cs(%rsp)
|
||||
jz restore_all_xen
|
||||
leaq VCPU_trap_bounce(%rbx),%rdx
|
||||
movq VCPU_domain(%rbx),%rax
|
||||
testb $1,DOMAIN_is_32bit_pv(%rax)
|
||||
jnz compat_post_handle_exception
|
||||
testb $TBF_EXCEPTION,TRAPBOUNCE_flags(%rdx)
|
||||
jz test_all_events
|
||||
.Lbounce_exception:
|
||||
call create_bounce_frame
|
||||
movb $0,TRAPBOUNCE_flags(%rdx)
|
||||
jnz compat_test_all_events
|
||||
jmp test_all_events
|
||||
|
||||
/* No special register assumptions. */
|
||||
|
||||