On 27.08.2026 17:21, Oleksii Kurochko wrote: > do_trap() consulted the exception table only for CAUSE_ILLEGAL_INSTRUCTION, > which covers csr_read_safe() but not the hlv/hlvx sequences reading guest > memory: those fault with load/store (guest) page fault causes and would > reach do_unexpected_trap() instead of their fixup. > > Move the lookup ahead of the cause switch, and gate it on the trap having > been taken in Xen context and not being an interrupt: > > - sepc of a trap taken from the guest is a guest VA/PA, which the > guest can point at an address listed in the exception table; Xen would > then act on that entry and, for EX_TYPE_TRAP_INFO, write through a > pointer fully under guest control. Entries are matched by exact address, > so this needs no more than a numerical collision. > > - an interrupt taken at an address listed in the table would otherwise be > "fixed up" as if the access itself had faulted, silently skipping it and > handing the caller the interrupt's scause as a fault cause. > > Returning early skips check_for_pcpu_work(), which is correct: that only > runs for traps taken from the guest. > > With that in place a G-stage fault reaching the switch can no longer have > been caused by an hlv/hlvx covered by an entry, so anything left must have > come from the guest; assert as much. > > Cache the "trap came from the guest" test in a local, it is now used four > times. > > Signed-off-by: Oleksii Kurochko <[email protected]>
Acked-by: Jan Beulich <[email protected]>
