The only fields modified are EIP, EFLAGS, GPRs, and segment selectors.
CR3 in particular is not supposed to be updated.
Signed-off-by: Jan Beulich <jbeul...@suse.com>
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -2952,7 +2952,6 @@ void hvm_task_switch(
if ( taskswitch_reason == TSW_iret )
eflags &= ~X86_EFLAGS_NT;
- tss.cr3 = v->arch.hvm_vcpu.guest_cr[3];
tss.eip = regs->eip;
tss.eflags = eflags;
tss.eax = regs->eax;
@@ -2979,8 +2978,10 @@ void hvm_task_switch(
hvm_get_segment_register(v, x86_seg_ldtr, &segr);
tss.ldt = segr.sel;
- rc = hvm_copy_to_guest_virt(
- prev_tr.base, &tss, sizeof(tss), PFEC_page_present);
+ rc = hvm_copy_to_guest_virt(prev_tr.base + offsetof(typeof(tss), eip),
+ &tss.eip,
+ (void *)&tss.trace - (void *)&tss.eip,
+ PFEC_page_present);
if ( rc != HVMCOPY_okay )
goto out;
x86/HVM: limit writes to outgoing TSS during task switch
The only fields modified are EIP, EFLAGS, GPRs, and segment selectors.
CR3 in particular is not supposed to be updated.
Signed-off-by: Jan Beulich <jbeul...@suse.com>
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -2952,7 +2952,6 @@ void hvm_task_switch(
if ( taskswitch_reason == TSW_iret )
eflags &= ~X86_EFLAGS_NT;
- tss.cr3 = v->arch.hvm_vcpu.guest_cr[3];
tss.eip = regs->eip;
tss.eflags = eflags;
tss.eax = regs->eax;
@@ -2979,8 +2978,10 @@ void hvm_task_switch(
hvm_get_segment_register(v, x86_seg_ldtr, &segr);
tss.ldt = segr.sel;
- rc = hvm_copy_to_guest_virt(
- prev_tr.base, &tss, sizeof(tss), PFEC_page_present);
+ rc = hvm_copy_to_guest_virt(prev_tr.base + offsetof(typeof(tss), eip),
+ &tss.eip,
+ (void *)&tss.trace - (void *)&tss.eip,
+ PFEC_page_present);
if ( rc != HVMCOPY_okay )
goto out;
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
