[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [PATCH] 32on64 fixes (was Re: [Xen-devel] unmodified_drivers/linux-2.6/overrides.mk)
>>> Keir Fraser <keir@xxxxxxxxxxxxx> 24.01.07 16:58 >>> >A quick question: how do we ensure that pointers ('guest handles') passed in >a register to a hypercall have the high 32 bits cleared for a 32-bit-compat >guest? I don't think the architecture guarantees anything about the upper 32 >bits of any register when running with CS.L==0, and I don't see anything >that zaps those upper bits, or ignores them, for e.g., do_event_channel_op() >(which isn't compat-ified). Here is the promised patch, including two more fixes to the 32on64 additions. Signed-off-by: Jan Beulich <jbeulich@xxxxxxxxxx> Index: 2007-01-08/xen/arch/x86/traps.c =================================================================== --- 2007-01-08.orig/xen/arch/x86/traps.c 2007-01-25 10:37:39.000000000 +0100 +++ 2007-01-08/xen/arch/x86/traps.c 2007-01-25 10:39:11.000000000 +0100 @@ -1146,7 +1146,9 @@ static int emulate_privileged_op(struct goto fail; op_default = op_bytes = (ar & (_SEGMENT_L|_SEGMENT_DB)) ? 4 : 2; ad_default = ad_bytes = (ar & _SEGMENT_L) ? 8 : op_default; - if ( !(ar & (_SEGMENT_CODE|_SEGMENT_S|_SEGMENT_P)) ) + if ( !(ar & _SEGMENT_S) || + !(ar & _SEGMENT_P) || + !(ar & _SEGMENT_CODE) ) goto fail; /* emulating only opcodes not allowing SS to be default */ @@ -1234,7 +1236,8 @@ static int emulate_privileged_op(struct &data_base, &data_limit, &ar, _SEGMENT_WR|_SEGMENT_S|_SEGMENT_DPL|_SEGMENT_P) ) goto fail; - if ( !(ar & (_SEGMENT_S|_SEGMENT_P)) || + if ( !(ar & _SEGMENT_S) || + !(ar & _SEGMENT_P) || (opcode & 2 ? (ar & _SEGMENT_CODE) && !(ar & _SEGMENT_WR) : (ar & _SEGMENT_CODE) || !(ar & _SEGMENT_WR)) ) Index: 2007-01-08/xen/arch/x86/x86_64/compat/entry.S =================================================================== --- 2007-01-08.orig/xen/arch/x86/x86_64/compat/entry.S 2006-12-15 15:39:13.000000000 +0100 +++ 2007-01-08/xen/arch/x86/x86_64/compat/entry.S 2007-01-25 10:42:27.000000000 +0100 @@ -23,7 +23,9 @@ ENTRY(compat_hypercall) movq %rsp,%rdi movl $0xDEADBEEF,%eax rep stosq - popq %r9 ; popq %r8 ; popq %rcx; popq %rdx; popq %rsi; popq %rdi + popq %r8 ; popq %r9 ; xchgl %r8d,%r9d + popq %rdx; popq %rcx; xchgl %edx,%ecx + popq %rdi; popq %rsi; xchgl %edi,%esi movl UREGS_rax(%rsp),%eax pushq %rax pushq UREGS_rip+8(%rsp) @@ -31,8 +33,9 @@ ENTRY(compat_hypercall) movl %eax,%eax movl %ebp,%r9d movl %edi,%r8d - xchgl %ecx,%esi + xchgl %ecx,%esi movl UREGS_rbx(%rsp),%edi + movl %edx,%edx #endif leaq compat_hypercall_table(%rip),%r10 PERFC_INCR(PERFC_hypercalls, %rax) _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxxxxxxxx http://lists.xensource.com/xen-devel
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |