redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

xen: don't use privcmd_call() from xen_mc_flush() 

Using privcmd_call() for a singleton multicall seems to be wrong, as
privcmd_call() is using stac()/clac() to enable hypervisor access to
Linux user space.

Even if currently not a problem (pv domains can't use SMAP while HVM
and PVH domains can't use multicalls) things might change when
PVH dom0 support is added to the kernel.

Reported-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
hifive-unleashed-5.1
Juergen Gross 2018-06-13 11:58:06 +02:00 committed by Boris Ostrovsky
parent 405c018a25
commit cd9139220b
2 changed files with 22 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
arch/x86/include/asm/xen/hypercall.h
View File

@ -209,24 +209,37 @@ extern struct { char _entry[32]; } hypercall_page[];
})
static inline long
privcmd_call(unsigned call,
unsigned long a1, unsigned long a2,
unsigned long a3, unsigned long a4,
unsigned long a5)
xen_single_call(unsigned int call,
unsigned long a1, unsigned long a2,
unsigned long a3, unsigned long a4,
unsigned long a5)
{
__HYPERCALL_DECLS;
__HYPERCALL_5ARG(a1, a2, a3, a4, a5);
stac();
asm volatile(CALL_NOSPEC
: __HYPERCALL_5PARAM
: [thunk_target] "a" (&hypercall_page[call])
: __HYPERCALL_CLOBBER5);
clac();
return (long)__res;
}
static inline long
privcmd_call(unsigned int call,
unsigned long a1, unsigned long a2,
unsigned long a3, unsigned long a4,
unsigned long a5)
{
long res;
stac();
res = xen_single_call(call, a1, a2, a3, a4, a5);
clac();
return res;
}
static inline int
HYPERVISOR_set_trap_table(struct trap_info *table)
{

6
arch/x86/xen/multicalls.c
View File

@ -80,9 +80,9 @@ void xen_mc_flush(void)
and just do the call directly. */
mc = &b->entries[0];
mc->result = privcmd_call(mc->op,
mc->args[0], mc->args[1], mc->args[2],
mc->args[3], mc->args[4]);
mc->result = xen_single_call(mc->op, mc->args[0], mc->args[1],
mc->args[2], mc->args[3],
mc->args[4]);
ret = mc->result < 0;
break;