From: Jan Beulich <jbeulich@suse.com>
Date: Wed, 4 Dec 2013 12:23:27 +0000 (+0100)
Subject: nested VMX: fix I/O port exit emulation
X-Git-Tag: archive/raspbian/4.8.0-1+rpi1~1^2~5822^2~2
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=e1978480c76e36bc22ec12657121ac91d08aca6b;p=xen.git

nested VMX: fix I/O port exit emulation

For multi-byte operations all affected ports' bits in the bitmap need
to be checked, not just the first port's one.

Reported-by: Matthew Daley <mattd@bugfuzz.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
---

diff --git a/xen/arch/x86/hvm/vmx/vvmx.c b/xen/arch/x86/hvm/vmx/vvmx.c
index 7fa110e585..0cc32e169e 100644
--- a/xen/arch/x86/hvm/vmx/vvmx.c
+++ b/xen/arch/x86/hvm/vmx/vvmx.c
@@ -2134,7 +2134,6 @@ int nvmx_n2_vmexit_handler(struct cpu_user_regs *regs,
     struct nestedvcpu *nvcpu = &vcpu_nestedhvm(v);
     struct nestedvmx *nvmx = &vcpu_2_nvmx(v);
     u32 ctrl;
-    u8 *bitmap;
 
     nvcpu->nv_vmexit_pending = 0;
     nvmx->intr.intr_info = 0;
@@ -2220,15 +2219,23 @@ int nvmx_n2_vmexit_handler(struct cpu_user_regs *regs,
         if ( ctrl & CPU_BASED_ACTIVATE_IO_BITMAP )
         {
             unsigned long qual;
-            u16 port;
+            u16 port, size;
 
             __vmread(EXIT_QUALIFICATION, &qual);
             port = qual >> 16;
-            bitmap = nvmx->iobitmap[port >> 15];
-            if ( bitmap[(port & 0x7fff) >> 3] & (1 << (port & 0x7)) )
-                nvcpu->nv_vmexit_pending = 1;
+            size = (qual & 7) + 1;
+            do {
+                const u8 *bitmap = nvmx->iobitmap[port >> 15];
+
+                if ( bitmap[(port & 0x7fff) >> 3] & (1 << (port & 7)) )
+                    nvcpu->nv_vmexit_pending = 1;
+                if ( !--size )
+                    break;
+                if ( !++port )
+                    nvcpu->nv_vmexit_pending = 1;
+            } while ( !nvcpu->nv_vmexit_pending );
             if ( !nvcpu->nv_vmexit_pending )
-               gdprintk(XENLOG_WARNING, "L0 PIO %x.\n", port);
+                printk(XENLOG_G_WARNING "L0 PIO %04x\n", port);
         }
         else if ( ctrl & CPU_BASED_UNCOND_IO_EXITING )
             nvcpu->nv_vmexit_pending = 1;