From dba899de14989b3dff78009404ed891da7fefdc1 Mon Sep 17 00:00:00 2001 From: Andrew Cooper Date: Mon, 9 Apr 2018 09:39:32 +0000 Subject: [PATCH] x86/pv: Fix up erroneous segments for 32bit syscall entry The existing FLAT_KERNEL_SS expands to the correct value, 0xe02b, but is the wrong constant to use. Switch to FLAT_USER_SS32. For compat domains however, the reported values are entirely bogus. FLAT_USER_SS32 (value 0xe02b) is FLAT_RING3_CS in the 32bit ABI, while FLAT_USER_CS32 (value 0xe023) is FLAT_RING1_DS with an RPL of 3. The guests SYSCALL callback is invoked with a broken iret frame, and if left unmodified by the guest, will fail on the way back out when Xen's iret tries to load a code segment into %ss. In practice, this is only a problem for 32bit PV guests on AMD hardware, as Intel hardware doesn't permit the SYSCALL instruction outside of 64bit mode. This appears to have been broken ever since 64bit support was added to Xen, and has gone unnoticed because Linux doesn't use SYSCALL in 32bit builds. Signed-off-by: Andrew Cooper Reviewed-by: Wei Liu Reviewed-by: Jan Beulich Release-acked-by: Juergen Gross --- xen/arch/x86/x86_64/compat/entry.S | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/x86_64/compat/entry.S b/xen/arch/x86/x86_64/compat/entry.S index 6c7fcf95b3..ae2bb4bf1e 100644 --- a/xen/arch/x86/x86_64/compat/entry.S +++ b/xen/arch/x86/x86_64/compat/entry.S @@ -197,7 +197,7 @@ ENTRY(cstar_enter) /* sti could live here when we don't switch page tables below. */ CR4_PV32_RESTORE movq 8(%rsp),%rax /* Restore %rax. */ - movq $FLAT_KERNEL_SS,8(%rsp) + movq $FLAT_USER_SS32, 8(%rsp) /* Assume a 64bit domain. Compat handled lower. */ pushq %r11 pushq $FLAT_USER_CS32 pushq %rcx @@ -223,6 +223,11 @@ ENTRY(cstar_enter) movq VCPU_domain(%rbx),%rcx cmpb $0,DOMAIN_is_32bit_pv(%rcx) je switch_to_kernel + + /* Fix up reported %cs/%ss for compat domains. */ + movl $FLAT_COMPAT_USER_SS, UREGS_ss(%rsp) + movl $FLAT_COMPAT_USER_CS, UREGS_cs(%rsp) + cmpb $0,VCPU_syscall32_disables_events(%rbx) movzwl VCPU_syscall32_sel(%rbx),%esi movq VCPU_syscall32_addr(%rbx),%rax -- 2.39.5