This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


[Xen-changelog] [xen-unstable] hvm: Inject #UD for un-emulated instructi

To: xen-changelog@xxxxxxxxxxxxxxxxxxx
Subject: [Xen-changelog] [xen-unstable] hvm: Inject #UD for un-emulated instructions rather than crash guest
From: Xen patchbot-unstable <patchbot-unstable@xxxxxxxxxxxxxxxxxxx>
Date: Wed, 28 Nov 2007 17:20:10 -0800
Delivery-date: Wed, 28 Nov 2007 17:20:35 -0800
Envelope-to: www-data@xxxxxxxxxxxxxxxxxx
List-help: <mailto:xen-changelog-request@lists.xensource.com?subject=help>
List-id: BK change log <xen-changelog.lists.xensource.com>
List-post: <mailto:xen-changelog@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-changelog>, <mailto:xen-changelog-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-changelog>, <mailto:xen-changelog-request@lists.xensource.com?subject=unsubscribe>
Reply-to: xen-devel@xxxxxxxxxxxxxxxxxxx
Sender: xen-changelog-bounces@xxxxxxxxxxxxxxxxxxx
# HG changeset patch
# User Keir Fraser <keir.fraser@xxxxxxxxxx>
# Date 1196255087 0
# Node ID c76a9aa12d2e37ed5c6c2a3562c755ec3828af8a
# Parent  bb31c9325d5f86629de342a6515c6f28b92cf782
hvm: Inject #UD for un-emulated instructions rather than crash guest

The CrashMe stress test (a process repeatedly forks child processes, and
the child processes initialize a buffer with random numbers, then treat
the buffer as code, and execute it) can crash 32-bit HVM RHEL5.1 guest
easily; this is because we haven't emulated all the instructions in
handle_mmio() yet.

The CrashMe process runs with root rights, and can access MMIO space in
an unknown way ("strace -f" shows the random codes running at CPL=3D3
don't call mmap(), and don't open any special files in /dev/ "); the gpa
may look like 0xa**** or  0xb****, or 0xfee0****. =20

Signed-off-by: Dexuan Cui <dexuan.cui@xxxxxxxxx>
Signed-off-by: Keir Fraser <keir.fraser@xxxxxxxxxx>
 xen/arch/x86/hvm/platform.c |   13 +++++++++----
 1 files changed, 9 insertions(+), 4 deletions(-)

diff -r bb31c9325d5f -r c76a9aa12d2e xen/arch/x86/hvm/platform.c
--- a/xen/arch/x86/hvm/platform.c       Wed Nov 28 12:50:24 2007 +0000
+++ b/xen/arch/x86/hvm/platform.c       Wed Nov 28 13:04:47 2007 +0000
@@ -1051,13 +1051,18 @@ void handle_mmio(unsigned long gpa)
     if ( mmio_decode(address_bytes, inst, mmio_op, &ad_size,
-                     &op_size, &seg_sel) == DECODE_failure ) {
-        printk("handle_mmio: failed to decode instruction\n");
-        printk("mmio opcode: gpa 0x%lx, len %d:", gpa, inst_len);
+                     &op_size, &seg_sel) == DECODE_failure )
+    {
+        gdprintk(XENLOG_WARNING,
+                 "handle_mmio: failed to decode instruction\n");
+        gdprintk(XENLOG_WARNING,
+                 "mmio opcode: gpa 0x%lx, len %d:", gpa, inst_len);
         for ( i = 0; i < inst_len; i++ )
             printk(" %02x", inst[i] & 0xFF);
-        domain_crash_synchronous();
+        hvm_inject_exception(TRAP_invalid_op, HVM_DELIVER_NO_ERROR_CODE, 0);
+        return;
     regs->eip += inst_len; /* advance %eip */

Xen-changelog mailing list

<Prev in Thread] Current Thread [Next in Thread>
  • [Xen-changelog] [xen-unstable] hvm: Inject #UD for un-emulated instructions rather than crash guest, Xen patchbot-unstable <=