| Message ID | 1450435810-726-1-git-send-email-huaitong.han@intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On 18/12/15 10:50, Huaitong Han wrote: > The check needs to be against the xsave header in the area, rather than > Xen's maximum xfeature_mask. A guest might easily have a smaller xcr0 > than the maximum Xen is willing to allow, causing the pointer below to > be bogus. > > Signed-off-by: Huaitong Han <huaitong.han@intel.com> > --- > xen/arch/x86/xstate.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > > diff --git a/xen/arch/x86/xstate.c b/xen/arch/x86/xstate.c > index b65da38..d87ab40 100644 > --- a/xen/arch/x86/xstate.c > +++ b/xen/arch/x86/xstate.c > @@ -146,12 +146,13 @@ static void __init setup_xstate_comp(void) > } > } > > -static void *get_xsave_addr(void *xsave, unsigned int xfeature_idx) > +static void *get_xsave_addr(struct xsave_struct *xsave, > + unsigned int xfeature_idx) > { > - if ( !((1ul << xfeature_idx) & xfeature_mask) ) > + if ( !((1ul << xfeature_idx) & xsave->xsave_hdr.xstate_bv) ) > return NULL; > > - return xsave + xstate_comp_offsets[xfeature_idx]; > + return (void *)xsave + xstate_comp_offsets[xfeature_idx]; This indeed fixes one of the issues. However, you must also check xcomb_bv & XSTATE_COMPACTION_ENABLED before using xstate_comp_offsets. I think you should end up with something like: if ( xsave->xsave_hdr.xcomb_bv & XSTATE_COMPACTION_ENABLED ) return (void *)xsave + xstate_comp_offsets[xfeature_idx]; else return (void *)xsave + xstate_offsets[xfeature_idx]; which allows get_xsave_addr() to work on both compressed and uncompressed xstate areas. ~Andrew
diff --git a/xen/arch/x86/xstate.c b/xen/arch/x86/xstate.c index b65da38..d87ab40 100644 --- a/xen/arch/x86/xstate.c +++ b/xen/arch/x86/xstate.c @@ -146,12 +146,13 @@ static void __init setup_xstate_comp(void) } } -static void *get_xsave_addr(void *xsave, unsigned int xfeature_idx) +static void *get_xsave_addr(struct xsave_struct *xsave, + unsigned int xfeature_idx) { - if ( !((1ul << xfeature_idx) & xfeature_mask) ) + if ( !((1ul << xfeature_idx) & xsave->xsave_hdr.xstate_bv) ) return NULL; - return xsave + xstate_comp_offsets[xfeature_idx]; + return (void *)xsave + xstate_comp_offsets[xfeature_idx]; } void expand_xsave_states(struct vcpu *v, void *dest, unsigned int size)
The check needs to be against the xsave header in the area, rather than Xen's maximum xfeature_mask. A guest might easily have a smaller xcr0 than the maximum Xen is willing to allow, causing the pointer below to be bogus. Signed-off-by: Huaitong Han <huaitong.han@intel.com> --- xen/arch/x86/xstate.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)