a4d1d9fe03
bnc#828623 - bnc#839596 - VUL-0: CVE-2013-1442: XSA-62: xen: Information leak on AVX and/or LWP capable CPUs 5242a1b5-x86-xsave-initialize-extended-register-state-when-guests-enable-it.patch - bnc#840592 - VUL-0: CVE-2013-4355: XSA-63: xen: Information leaks through I/O instruction emulation CVE-2013-4355-xsa63.patch - bnc#840593 - VUL-0: CVE-2013-4356: XSA-64: xen: Memory accessible by 64-bit PV guests under live migration CVE-2013-4356-xsa64.patch - bnc#841766 - VUL-1: CVE-2013-4361: XSA-66: xen: Information leak through fbld instruction emulation CVE-2013-4361-xsa66.patch - bnc#833796 - L3: Xen: migration broken from xsave-capable to xsave-incapable host 52205e27-x86-xsave-initialization-improvements.patch 522dc0e6-x86-xsave-fix-migration-from-xsave-capable-to-xsave-incapable-host.patch - bnc#839600 - [HP BCS SLES11 Bug]: In HP’s UEFI x86_64 platform and sles11sp3 with xen environment, xen hypervisor will panic on multiple blades nPar. 523172d5-x86-fix-memory-cut-off-when-using-PFN-compression.patch - bnc#833251 - [HP BCS SLES11 Bug]: In HP’s UEFI x86_64 platform and with xen environment, in booting stage ,xen hypervisor will panic. 522d896b-x86-EFI-properly-handle-run-time-memory-regions-outside-the-1-1-map.patch - bnc#834751 - [HP BCS SLES11 Bug]: In xen, “shutdown –y 0 –h” cannot power off system 522d896b-x86-EFI-properly-handle-run-time-memory-regions-outside-the-1-1-map.patch OBS-URL: https://build.opensuse.org/package/show/Virtualization/xen?expand=0&rev=274
66 lines
2.3 KiB
Diff
66 lines
2.3 KiB
Diff
# Commit 14fcce2fa883405bab26b60821a6cc5f2c770833
|
|
# Date 2013-09-23 09:55:14 +0200
|
|
# Author Jan Beulich <jbeulich@suse.com>
|
|
# Committer Jan Beulich <jbeulich@suse.com>
|
|
x86/HVM: refuse doing string operations in certain situations
|
|
|
|
We shouldn't do any acceleration for
|
|
- "rep movs" when either side is passed through MMIO or when both sides
|
|
are handled by qemu
|
|
- "rep ins" and "rep outs" when the memory operand is any kind of MMIO
|
|
|
|
Signed-off-by: Jan Beulich <jbeulich@suse.com>
|
|
Acked-by: Keir Fraser <keir@xen.org>
|
|
|
|
--- a/xen/arch/x86/hvm/emulate.c
|
|
+++ b/xen/arch/x86/hvm/emulate.c
|
|
@@ -686,6 +686,7 @@ static int hvmemul_rep_ins(
|
|
unsigned long addr;
|
|
uint32_t pfec = PFEC_page_present | PFEC_write_access;
|
|
paddr_t gpa;
|
|
+ p2m_type_t p2mt;
|
|
int rc;
|
|
|
|
rc = hvmemul_virtual_to_linear(
|
|
@@ -702,6 +703,10 @@ static int hvmemul_rep_ins(
|
|
if ( rc != X86EMUL_OKAY )
|
|
return rc;
|
|
|
|
+ (void) get_gfn_query_unlocked(current->domain, gpa >> PAGE_SHIFT, &p2mt);
|
|
+ if ( p2mt == p2m_mmio_direct || p2mt == p2m_mmio_dm )
|
|
+ return X86EMUL_UNHANDLEABLE;
|
|
+
|
|
return hvmemul_do_pio(src_port, reps, bytes_per_rep, gpa, IOREQ_READ,
|
|
!!(ctxt->regs->eflags & X86_EFLAGS_DF), NULL);
|
|
}
|
|
@@ -719,6 +724,7 @@ static int hvmemul_rep_outs(
|
|
unsigned long addr;
|
|
uint32_t pfec = PFEC_page_present;
|
|
paddr_t gpa;
|
|
+ p2m_type_t p2mt;
|
|
int rc;
|
|
|
|
rc = hvmemul_virtual_to_linear(
|
|
@@ -735,6 +741,10 @@ static int hvmemul_rep_outs(
|
|
if ( rc != X86EMUL_OKAY )
|
|
return rc;
|
|
|
|
+ (void) get_gfn_query_unlocked(current->domain, gpa >> PAGE_SHIFT, &p2mt);
|
|
+ if ( p2mt == p2m_mmio_direct || p2mt == p2m_mmio_dm )
|
|
+ return X86EMUL_UNHANDLEABLE;
|
|
+
|
|
return hvmemul_do_pio(dst_port, reps, bytes_per_rep, gpa, IOREQ_WRITE,
|
|
!!(ctxt->regs->eflags & X86_EFLAGS_DF), NULL);
|
|
}
|
|
@@ -787,6 +797,10 @@ static int hvmemul_rep_movs(
|
|
(void) get_gfn_query_unlocked(current->domain, sgpa >> PAGE_SHIFT, &sp2mt);
|
|
(void) get_gfn_query_unlocked(current->domain, dgpa >> PAGE_SHIFT, &dp2mt);
|
|
|
|
+ if ( sp2mt == p2m_mmio_direct || dp2mt == p2m_mmio_direct ||
|
|
+ (sp2mt == p2m_mmio_dm && dp2mt == p2m_mmio_dm) )
|
|
+ return X86EMUL_UNHANDLEABLE;
|
|
+
|
|
if ( sp2mt == p2m_mmio_dm )
|
|
return hvmemul_do_mmio(
|
|
sgpa, reps, bytes_per_rep, dgpa, IOREQ_READ, df, NULL);
|