ia64/xen-unstable

changeset 9514:ae6af19f47d3

Some fixes to IRET hypercall and failsafe callback handlers:
1. IRET hypercall must restore the event callback mask. This
was missing on x86/64, and both subarchitectures now restore
from EFLAGS.IF.
2. Failsafe callbacks are fixed to detect whether fault is due to
bad segment or due to IRET. In the latter case we now
immediatiately kill the process. This avoids infinite looping
between IRET hypercall and failsafe callback handler in the guest.

Signed-off-by: Keir Fraser <keir@xensource.com>
author kaf24@firebug.cl.cam.ac.uk
date Wed Mar 29 12:02:45 2006 +0100 (2006-03-29)
parents e84b1185013f
children 48abab2ab719
files linux-2.6-xen-sparse/arch/i386/kernel/entry-xen.S linux-2.6-xen-sparse/arch/x86_64/kernel/entry-xen.S linux-2.6-xen-sparse/arch/x86_64/kernel/xen_entry.S xen/arch/x86/x86_32/asm-offsets.c xen/arch/x86/x86_32/traps.c xen/arch/x86/x86_64/asm-offsets.c xen/arch/x86/x86_64/traps.c
line diff
     1.1 --- a/linux-2.6-xen-sparse/arch/i386/kernel/entry-xen.S	Wed Mar 29 10:46:36 2006 +0100
     1.2 +++ b/linux-2.6-xen-sparse/arch/i386/kernel/entry-xen.S	Wed Mar 29 12:02:45 2006 +0100
     1.3 @@ -65,7 +65,6 @@ ES		= 0x20
     1.4  ORIG_EAX	= 0x24
     1.5  EIP		= 0x28
     1.6  CS		= 0x2C
     1.7 -EVENT_MASK	= 0x2E
     1.8  EFLAGS		= 0x30
     1.9  OLDESP		= 0x34
    1.10  OLDSS		= 0x38
    1.11 @@ -290,14 +289,14 @@ restore_all:
    1.12  restore_nocheck:
    1.13  #else
    1.14  restore_nocheck:
    1.15 -	testl $(VM_MASK|NMI_MASK), EFLAGS(%esp)
    1.16 +	movl EFLAGS(%esp), %eax
    1.17 +	testl $(VM_MASK|NMI_MASK), %eax
    1.18  	jnz hypervisor_iret
    1.19 -	movb EVENT_MASK(%esp), %al
    1.20 -	notb %al			# %al == ~saved_mask
    1.21 +	shr $9, %eax			# EAX[0] == IRET_EFLAGS.IF
    1.22  	GET_VCPU_INFO
    1.23  	andb evtchn_upcall_mask(%esi),%al
    1.24 -	andb $1,%al			# %al == mask & ~saved_mask
    1.25 -	jnz restore_all_enable_events	#     != 0 => reenable event delivery
    1.26 +	andb $1,%al			# EAX[0] == IRET_EFLAGS.IF & event_mask
    1.27 +	jnz restore_all_enable_events	#        != 0 => enable event delivery
    1.28  #endif
    1.29  	RESTORE_REGS
    1.30  	addl $4, %esp
    1.31 @@ -555,14 +554,9 @@ scrit:	/**** START OF CRITICAL REGION **
    1.32  	RESTORE_REGS
    1.33  	addl $4, %esp
    1.34  1:	iret
    1.35 -.section .fixup,"ax"
    1.36 -2:	pushl $0
    1.37 -	pushl $do_iret_error
    1.38 -	jmp error_code
    1.39 -.previous
    1.40  .section __ex_table,"a"
    1.41  	.align 4
    1.42 -	.long 1b,2b
    1.43 +	.long 1b,iret_exc
    1.44  .previous
    1.45  14:	__DISABLE_INTERRUPTS
    1.46  	jmp  11b
    1.47 @@ -614,30 +608,51 @@ critical_fixup_table:
    1.48  	.byte 0x00,0x00			# jmp  11b
    1.49  
    1.50  # Hypervisor uses this for application faults while it executes.
    1.51 +# We get here for two reasons:
    1.52 +#  1. Fault while reloading DS, ES, FS or GS
    1.53 +#  2. Fault while executing IRET
    1.54 +# Category 1 we fix up by reattempting the load, and zeroing the segment
    1.55 +# register if the load fails.
    1.56 +# Category 2 we fix up by jumping to do_iret_error. We cannot use the
    1.57 +# normal Linux return path in this case because if we use the IRET hypercall
    1.58 +# to pop the stack frame we end up in an infinite loop of failsafe callbacks.
    1.59 +# We distinguish between categories by maintaining a status value in EAX.
    1.60  ENTRY(failsafe_callback)
    1.61 -1:	popl %ds
    1.62 -2:	popl %es
    1.63 -3:	popl %fs
    1.64 -4:	popl %gs
    1.65 -	subl $4,%esp
    1.66 +	pushl %eax
    1.67 +	movl $1,%eax
    1.68 +1:	mov 4(%esp),%ds
    1.69 +2:	mov 8(%esp),%es
    1.70 +3:	mov 12(%esp),%fs
    1.71 +4:	mov 16(%esp),%gs
    1.72 +	testl %eax,%eax
    1.73 +	popl %eax
    1.74 +	jz 5f
    1.75 +	addl $16,%esp		# EAX != 0 => Category 2 (Bad IRET)
    1.76 +	jmp iret_exc
    1.77 +5:	addl $16,%esp		# EAX == 0 => Category 1 (Bad segment)
    1.78 +	pushl $0
    1.79  	SAVE_ALL
    1.80 -	jmp  ret_from_exception
    1.81 -.section .fixup,"ax";	\
    1.82 -6:	movl $0,(%esp);	\
    1.83 -	jmp 1b;		\
    1.84 -7:	movl $0,(%esp);	\
    1.85 -	jmp 2b;		\
    1.86 -8:	movl $0,(%esp);	\
    1.87 -	jmp 3b;		\
    1.88 -9:	movl $0,(%esp);	\
    1.89 -	jmp 4b;		\
    1.90 -.previous;		\
    1.91 -.section __ex_table,"a";\
    1.92 -	.align 4;	\
    1.93 -	.long 1b,6b;	\
    1.94 -	.long 2b,7b;	\
    1.95 -	.long 3b,8b;	\
    1.96 -	.long 4b,9b;	\
    1.97 +	jmp ret_from_exception
    1.98 +.section .fixup,"ax";		\
    1.99 +6:	xorl %eax,%eax;		\
   1.100 +	movl %eax,4(%esp);	\
   1.101 +	jmp 1b;			\
   1.102 +7:	xorl %eax,%eax;		\
   1.103 +	movl %eax,8(%esp);	\
   1.104 +	jmp 2b;			\
   1.105 +8:	xorl %eax,%eax;		\
   1.106 +	movl %eax,12(%esp);	\
   1.107 +	jmp 3b;			\
   1.108 +9:	xorl %eax,%eax;		\
   1.109 +	movl %eax,16(%esp);	\
   1.110 +	jmp 4b;			\
   1.111 +.previous;			\
   1.112 +.section __ex_table,"a";	\
   1.113 +	.align 4;		\
   1.114 +	.long 1b,6b;		\
   1.115 +	.long 2b,7b;		\
   1.116 +	.long 3b,8b;		\
   1.117 +	.long 4b,9b;		\
   1.118  .previous
   1.119  #endif
   1.120  
     2.1 --- a/linux-2.6-xen-sparse/arch/x86_64/kernel/entry-xen.S	Wed Mar 29 10:46:36 2006 +0100
     2.2 +++ b/linux-2.6-xen-sparse/arch/x86_64/kernel/entry-xen.S	Wed Mar 29 12:02:45 2006 +0100
     2.3 @@ -520,13 +520,13 @@ retint_check:
     2.4  	CFI_REMEMBER_STATE
     2.5  	jnz  retint_careful
     2.6  retint_restore_args:
     2.7 -        movb EVENT_MASK-REST_SKIP(%rsp), %al
     2.8 -        notb %al			# %al == ~saved_mask
     2.9 -        XEN_GET_VCPU_INFO(%rsi)
    2.10 -        andb evtchn_upcall_mask(%rsi),%al
    2.11 -	andb $1,%al			# %al == mask & ~saved_mask
    2.12 -	jnz restore_all_enable_events	# != 0 => reenable event delivery      
    2.13 -        XEN_PUT_VCPU_INFO(%rsi)
    2.14 +	movl EFLAGS-REST_SKIP(%rsp), %eax
    2.15 +	shr $9, %eax			# EAX[0] == IRET_EFLAGS.IF
    2.16 +	XEN_GET_VCPU_INFO(%rsi)
    2.17 +	andb evtchn_upcall_mask(%rsi),%al
    2.18 +	andb $1,%al			# EAX[0] == IRET_EFLAGS.IF & event_mask
    2.19 +	jnz restore_all_enable_events	#        != 0 => enable event delivery
    2.20 +	XEN_PUT_VCPU_INFO(%rsi)
    2.21  		
    2.22  	RESTORE_ARGS 0,8,0
    2.23  	HYPERVISOR_IRET 0
    2.24 @@ -803,12 +803,11 @@ ENTRY(hypervisor_callback)
    2.25  # So, on entry to the handler we detect whether we interrupted an
    2.26  # existing activation in its critical region -- if so, we pop the current
    2.27  # activation and restart the handler using the previous one.
    2.28 -ENTRY(do_hypervisor_callback)   # do_hyperviosr_callback(struct *pt_regs)
    2.29 +ENTRY(do_hypervisor_callback)   # do_hypervisor_callback(struct *pt_regs)
    2.30  # Since we don't modify %rdi, evtchn_do_upall(struct *pt_regs) will
    2.31  # see the correct pointer to the pt_regs
    2.32  	movq %rdi, %rsp            # we don't return, adjust the stack frame
    2.33 -11:	movb $0, EVENT_MASK(%rdi)
    2.34 -	movq %gs:pda_irqstackptr,%rax
    2.35 +11:	movq %gs:pda_irqstackptr,%rax
    2.36  	incl %gs:pda_irqcount
    2.37  	cmovzq %rax,%rsp
    2.38  	pushq %rdi
    2.39 @@ -853,15 +852,44 @@ ecrit:  /**** END OF CRITICAL REGION ***
    2.40  # When the kernel is interrupted in the critical section, the kernel 
    2.41  # will do IRET in that case, and everything will be restored at that point, 
    2.42  # i.e. it just resumes from the next instruction interrupted with the same context. 
    2.43 -	
    2.44 +
    2.45  # Hypervisor uses this for application faults while it executes.
    2.46 -# Unlike i386 there is no need to reload the saved segment selectors:
    2.47 -# Xen already reloaded all valid ones and zeroed the others.
    2.48 +# We get here for two reasons:
    2.49 +#  1. Fault while reloading DS, ES, FS or GS
    2.50 +#  2. Fault while executing IRET
    2.51 +# Category 1 we do not need to fix up as Xen has already reloaded all segment
    2.52 +# registers that could be reloaded and zeroed the others.
    2.53 +# Category 2 we fix up by killing the current process. We cannot use the
    2.54 +# normal Linux return path in this case because if we use the IRET hypercall
    2.55 +# to pop the stack frame we end up in an infinite loop of failsafe callbacks.
    2.56 +# We distinguish between categories by comparing each saved segment register
    2.57 +# with its current contents: any discrepancy means we in category 1.
    2.58  ENTRY(failsafe_callback)
    2.59 -	addq $0x30,%rsp /* skip %rcx,%r11,%ds,%es,%fs,%gs */
    2.60 +	movw %ds,%cx
    2.61 +	cmpw %cx,0x10(%rsp)
    2.62 +	jne 1f
    2.63 +	movw %es,%cx
    2.64 +	cmpw %cx,0x18(%rsp)
    2.65 +	jne 1f
    2.66 +	movw %fs,%cx
    2.67 +	cmpw %cx,0x20(%rsp)
    2.68 +	jne 1f
    2.69 +	movw %gs,%cx
    2.70 +	cmpw %cx,0x28(%rsp)
    2.71 +	jne 1f
    2.72 +	/* All segments match their saved values => Category 2 (Bad IRET). */
    2.73 +	movq (%rsp),%rcx
    2.74 +	movq 8(%rsp),%r11
    2.75 +	addq $0x30,%rsp
    2.76 +	movq $-9999,%rdi	/* better code? */
    2.77 +	jmp do_exit			
    2.78 +1:	/* Segment mismatch => Category 1 (Bad segment). Retry the IRET. */
    2.79 +	movq (%rsp),%rcx
    2.80 +	movq 8(%rsp),%r11
    2.81 +	addq $0x30,%rsp
    2.82 +	pushq $0
    2.83  	SAVE_ALL
    2.84 -	jmp  error_exit
    2.85 - 
    2.86 +	jmp error_exit
    2.87  #if 0	      
    2.88          .section __ex_table,"a"
    2.89          .align 8
     3.1 --- a/linux-2.6-xen-sparse/arch/x86_64/kernel/xen_entry.S	Wed Mar 29 10:46:36 2006 +0100
     3.2 +++ b/linux-2.6-xen-sparse/arch/x86_64/kernel/xen_entry.S	Wed Mar 29 12:02:45 2006 +0100
     3.3 @@ -2,7 +2,7 @@
     3.4   * Copied from arch/xen/i386/kernel/entry.S
     3.5   */                        
     3.6  /* Offsets into shared_info_t. */                
     3.7 -#define evtchn_upcall_pending		0
     3.8 +#define evtchn_upcall_pending		/* 0 */
     3.9  #define evtchn_upcall_mask		1
    3.10  
    3.11  #define sizeof_vcpu_shift		6
    3.12 @@ -35,7 +35,6 @@
    3.13      				XEN_PUT_VCPU_INFO(reg)
    3.14  #define XEN_TEST_PENDING(reg)	testb $0xFF,evtchn_upcall_pending(reg)
    3.15  
    3.16 -EVENT_MASK      = (CS+4)
    3.17  VGCF_IN_SYSCALL = (1<<8)
    3.18          
    3.19  	
     4.1 --- a/xen/arch/x86/x86_32/asm-offsets.c	Wed Mar 29 10:46:36 2006 +0100
     4.2 +++ b/xen/arch/x86/x86_32/asm-offsets.c	Wed Mar 29 12:02:45 2006 +0100
     4.3 @@ -44,7 +44,6 @@ void __dummy__(void)
     4.4      OFFSET(UREGS_eflags, struct cpu_user_regs, eflags);
     4.5      OFFSET(UREGS_error_code, struct cpu_user_regs, error_code);
     4.6      OFFSET(UREGS_entry_vector, struct cpu_user_regs, entry_vector);
     4.7 -    OFFSET(UREGS_saved_upcall_mask, struct cpu_user_regs, saved_upcall_mask);
     4.8      OFFSET(UREGS_kernel_sizeof, struct cpu_user_regs, esp);
     4.9      DEFINE(UREGS_user_sizeof, sizeof(struct cpu_user_regs));
    4.10      BLANK();
     5.1 --- a/xen/arch/x86/x86_32/traps.c	Wed Mar 29 10:46:36 2006 +0100
     5.2 +++ b/xen/arch/x86/x86_32/traps.c	Wed Mar 29 12:02:45 2006 +0100
     5.3 @@ -230,8 +230,8 @@ unsigned long do_iret(void)
     5.4      /* No longer in NMI context. */
     5.5      clear_bit(_VCPUF_nmi_masked, &current->vcpu_flags);
     5.6  
     5.7 -    /* Restore upcall mask from saved value. */
     5.8 -    current->vcpu_info->evtchn_upcall_mask = regs->saved_upcall_mask;
     5.9 +    /* Restore upcall mask from supplied EFLAGS.IF. */
    5.10 +    current->vcpu_info->evtchn_upcall_mask = !(eflags & X86_EFLAGS_IF);
    5.11  
    5.12      /*
    5.13       * The hypercall exit path will overwrite EAX with this return
     6.1 --- a/xen/arch/x86/x86_64/asm-offsets.c	Wed Mar 29 10:46:36 2006 +0100
     6.2 +++ b/xen/arch/x86/x86_64/asm-offsets.c	Wed Mar 29 12:02:45 2006 +0100
     6.3 @@ -48,7 +48,6 @@ void __dummy__(void)
     6.4      OFFSET(UREGS_eflags, struct cpu_user_regs, eflags);
     6.5      OFFSET(UREGS_rsp, struct cpu_user_regs, rsp);
     6.6      OFFSET(UREGS_ss, struct cpu_user_regs, ss);
     6.7 -    OFFSET(UREGS_saved_upcall_mask, struct cpu_user_regs, saved_upcall_mask);
     6.8      OFFSET(UREGS_kernel_sizeof, struct cpu_user_regs, es);
     6.9      DEFINE(UREGS_user_sizeof, sizeof(struct cpu_user_regs));
    6.10      BLANK();
     7.1 --- a/xen/arch/x86/x86_64/traps.c	Wed Mar 29 10:46:36 2006 +0100
     7.2 +++ b/xen/arch/x86/x86_64/traps.c	Wed Mar 29 12:02:45 2006 +0100
     7.3 @@ -210,6 +210,9 @@ unsigned long do_iret(void)
     7.4      /* No longer in NMI context. */
     7.5      clear_bit(_VCPUF_nmi_masked, &current->vcpu_flags);
     7.6  
     7.7 +    /* Restore upcall mask from supplied EFLAGS.IF. */
     7.8 +    current->vcpu_info->evtchn_upcall_mask = !(iret_saved.rflags & EF_IE);
     7.9 +
    7.10      /* Saved %rax gets written back to regs->rax in entry.S. */
    7.11      return iret_saved.rax;
    7.12  }