[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH] xen/x86/svm: Apply the virtual-8086 IOPL check to INT n only
- To: <xen-devel@xxxxxxxxxxxxxxxxxxxx>
- From: Stefano Stabellini <stefano.stabellini@xxxxxxx>
- Date: Tue, 20 Oct 2026 15:41:23 -0700
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=lists.xenproject.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0)
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=i2TMl5q79/075XExQN9cH1tRrO3ZhgLtFiJ/Z47MAdw=; b=NFH25YIBgWKVbnq0irFVROvVqcVJXg7O0b5mUJkfM42CVsEqKovqjKJrMl0mCSrNjftYSLx7BvztWd43AdcFzHD4vwNM+WOCBx8sUwggN0c7mRXMFO4It+63mXt4WbH+huQJoq86zAXVqJKvRrQhbtHCUx8Y8DZf/EROgbKL7x3ltb3dpPkbc2+qYXX1b4CRJJ0XAxwhEXyMfZWSCQRBGF26PRLZRyUZnEQm+AdZHZ3LhsgpsJrrI5zrKXjmjAd7E5YyuD2OVzuoO5rjkf6a6f6/GGg8rvmX7rkyPSYWVYT175pp4I48poaaZq4GiE365nvUd71Ny+AHhToDPZNnHA==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=BFGxgmwh2hyjetUuGhUKShmPvabBtd5BG7ODJoUplY7Jq/yx9xzpspBAxCcaE5eMO+uTP2qAW6b+ongi6Ma9T3dBfwwrFVopb52DgdyzQDd2aZTRHzw+nFvXPwFbjM+pV5ftepk5CKuDOMfeVRSWS8leZjnFW956atptwSZSmf/YODGHr4k/Fhtpqd0mbZ547IIe5IRUOxEnzzm4w7Wtu7pEG2csCcx3459uNo5GyoFpI06LFnpUggvfibIRDsTMjMe3W864brYS2wlRO36MxEKBLlFcZazPf7Gg/Jb5ssgo7YjHFb8AC6XMjNYgx/Bv5TZNz1CSaCMGbS2h8rz4XA==
- Authentication-results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=amd.com header.i="@amd.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck"
- Cc: <jbeulich@xxxxxxxx>, <andrew.cooper3@xxxxxxxxxx>, <roger@xxxxxxxxxxxxxx>, <jason.andryuk@xxxxxxx>, <teddy.astie@xxxxxxxxxx>, <stefano.stabellini@xxxxxxx>
- Delivery-date: Tue, 20 Oct 2026 22:41:41 +0000
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
In virtual-8086 mode with IOPL < 3, INT n raises #GP(0). INT1, INT3
and INTO are not affected. They are delivered normally.
svm_emul_swint_injection() applies the check to all of them, so an ICEBP
raises #GP instead of #DB. It also reports the IDT entry in the #GP
error code instead of 0.
Limit the check to INT n and use error code 0.
Signed-off-by: Stefano Stabellini <stefano.stabellini@xxxxxxx>
---
xen/arch/x86/hvm/svm/svm.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/xen/arch/x86/hvm/svm/svm.c b/xen/arch/x86/hvm/svm/svm.c
index 71e48351f2..df74531d1a 100644
--- a/xen/arch/x86/hvm/svm/svm.c
+++ b/xen/arch/x86/hvm/svm/svm.c
@@ -1153,9 +1153,12 @@ static void svm_emul_swint_injection(struct x86_event
*event)
* 32bit OS. Someone with many TUITs can see about reading the TSS
* Software Interrupt Redirection bitmap.
*/
- if ( (regs->eflags & X86_EFLAGS_VM) &&
+ if ( type == X86_ET_SW_INT && (regs->eflags & X86_EFLAGS_VM) &&
MASK_EXTR(regs->eflags, X86_EFLAGS_IOPL) != 3 )
+ {
+ ec = 0;
goto raise_exception;
+ }
/*
* Read all 8/16 bytes so the idtr limit check is applied properly to
--
2.43.0
|
