From 64afca0c191eb940eefa80c814b5b4d18d648d78 Mon Sep 17 00:00:00 2001 From: Andrew Cooper Date: Thu, 12 Sep 2013 10:58:40 +0200 Subject: x86: Special case __HYPERVISOR_iret rather more when writing hypercall pages In all cases when a hypercall page is written, __HYPERVISOR_iret is first written as a regular hypercall, then subsequently rewritten in its special case. For VMX and SVM, this means that following the ud2a instruction is 3 bytes of an imm32 parameter. For a ring3 kernel, this means that following the syscall instruction is the second half of 'pop %r11'. For a ring1 kernel, the iret case ends up as the same number of bytes as the rest of the hypercalls, but it is pointless writing it twice, and is changed for consistency. Therefore, skip the loop iteration which would write the incorrect __HYPERVISOR_iret hypercall. This removes junk machine code from the tail and makes disassemblers rather more happy when looking at the hypercall page. Also, a miscellaneous whitespace fix in the comment for ring3 kernel. Signed-off-by: Andrew Cooper master commit: fca11da0ec956b17d7450d7776c3ffa22a8f538a master date: 2013-07-16 11:10:45 +0200 --- xen/arch/x86/hvm/svm/svm.c | 3 +++ xen/arch/x86/hvm/vmx/vmx.c | 3 +++ xen/arch/x86/x86_64/compat/traps.c | 3 +++ xen/arch/x86/x86_64/traps.c | 7 +++++-- 4 files changed, 14 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/hvm/svm/svm.c b/xen/arch/x86/hvm/svm/svm.c index e74984e9c5..48a3f0184f 100644 --- a/xen/arch/x86/hvm/svm/svm.c +++ b/xen/arch/x86/hvm/svm/svm.c @@ -763,6 +763,9 @@ static void svm_init_hypercall_page(struct domain *d, void *hypercall_page) for ( i = 0; i < (PAGE_SIZE / 32); i++ ) { + if ( i == __HYPERVISOR_iret ) + continue; + p = (char *)(hypercall_page + (i * 32)); *(u8 *)(p + 0) = 0xb8; /* mov imm32, %eax */ *(u32 *)(p + 1) = i; diff --git a/xen/arch/x86/hvm/vmx/vmx.c b/xen/arch/x86/hvm/vmx/vmx.c index fa43971167..5a3a152ccb 100644 --- a/xen/arch/x86/hvm/vmx/vmx.c +++ b/xen/arch/x86/hvm/vmx/vmx.c @@ -1008,6 +1008,9 @@ static void vmx_init_hypercall_page(struct domain *d, void *hypercall_page) for ( i = 0; i < (PAGE_SIZE / 32); i++ ) { + if ( i == __HYPERVISOR_iret ) + continue; + p = (char *)(hypercall_page + (i * 32)); *(u8 *)(p + 0) = 0xb8; /* mov imm32, %eax */ *(u32 *)(p + 1) = i; diff --git a/xen/arch/x86/x86_64/compat/traps.c b/xen/arch/x86/x86_64/compat/traps.c index 03b90b2126..6e0ff11073 100644 --- a/xen/arch/x86/x86_64/compat/traps.c +++ b/xen/arch/x86/x86_64/compat/traps.c @@ -362,6 +362,9 @@ static void hypercall_page_initialise_ring1_kernel(void *hypercall_page) for ( i = 0; i < (PAGE_SIZE / 32); i++ ) { + if ( i == __HYPERVISOR_iret ) + continue; + p = (char *)(hypercall_page + (i * 32)); *(u8 *)(p+ 0) = 0xb8; /* mov $,%eax */ *(u32 *)(p+ 1) = i; diff --git a/xen/arch/x86/x86_64/traps.c b/xen/arch/x86/x86_64/traps.c index 806cf2ea37..00bee9b2cb 100644 --- a/xen/arch/x86/x86_64/traps.c +++ b/xen/arch/x86/x86_64/traps.c @@ -588,6 +588,9 @@ static void hypercall_page_initialise_ring3_kernel(void *hypercall_page) /* Fill in all the transfer points with template machine code. */ for ( i = 0; i < (PAGE_SIZE / 32); i++ ) { + if ( i == __HYPERVISOR_iret ) + continue; + p = (char *)(hypercall_page + (i * 32)); *(u8 *)(p+ 0) = 0x51; /* push %rcx */ *(u16 *)(p+ 1) = 0x5341; /* push %r11 */ @@ -600,8 +603,8 @@ static void hypercall_page_initialise_ring3_kernel(void *hypercall_page) } /* - * HYPERVISOR_iret is special because it doesn't return and expects a - * special stack frame. Guests jump at this transfer point instead of + * HYPERVISOR_iret is special because it doesn't return and expects a + * special stack frame. Guests jump at this transfer point instead of * calling it. */ p = (char *)(hypercall_page + (__HYPERVISOR_iret * 32)); -- cgit v1.2.3