x86/pv: Fix guest crashes following f75b1a5247b "x86/pv: Drop int80_bounce from struc...
authorAndrew Cooper <andrew.cooper3@citrix.com>
Wed, 14 Mar 2018 10:48:36 +0000 (10:48 +0000)
committerAndrew Cooper <andrew.cooper3@citrix.com>
Wed, 14 Mar 2018 14:59:50 +0000 (14:59 +0000)
commitdedbdcde95ce0dc3f1a51ad9c685a71570630a7d
treefccfdcc86c560eceaa9a805a7a2f423242cd3380
parentdb0c7dde021c29c2ae0d847d70fb7b59e02ea522
x86/pv: Fix guest crashes following f75b1a5247b "x86/pv: Drop int80_bounce from struct pv_vcpu"

The original init_int80_direct_trap() was in fact buggy; `int $0x80` is not an
exception.  This went unnoticed for years because int80_bounce and trap_bounce
were separate structures, but were combined by this change.

Exception handling is different to interrupt handling for PV guests.  By
reusing trap_bounce, the following corner case can occur:

 * Handle a guest `int $0x80` instruction.  Latches TBF_EXCEPTION into
   trap_bounce.
 * Handle an exception, which emulates to success (such as ptwr support),
   which leaves trap_bounce unmodified.
 * The exception exit path sees TBF_EXCEPTION set and re-injects the `int
   $0x80` a second time.

Drop the TBF_EXCEPTION from the int80 invocation, which matches the equivalent
logic from the syscall/sysenter paths.

Reported-by: Sander Eikelenboom <linux@eikelenboom.it>
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
xen/arch/x86/x86_64/entry.S