diff options
author | Jan Beulich <jbeulich@suse.com> | 2013-09-27 11:59:14 +0200 |
---|---|---|
committer | Jan Beulich <jbeulich@suse.com> | 2013-09-27 11:59:14 +0200 |
commit | 6db5da83ecaebfb1a651178334a10e7d1fa13dcc (patch) | |
tree | d2df73a7e56b7ea8b23f9561a5f27495fade069f | |
parent | fb272e48312cf1ba377aa1415461a271a3e06986 (diff) | |
download | xen-6db5da83ecaebfb1a651178334a10e7d1fa13dcc.tar.gz xen-6db5da83ecaebfb1a651178334a10e7d1fa13dcc.tar.bz2 xen-6db5da83ecaebfb1a651178334a10e7d1fa13dcc.zip |
x86/HVM: linear address must be canonical for the whole accessed range
... rather than just for the first byte.
While at it, also
- make the real mode case at least dpo a wrap around check
- drop the mis-named "gpf" label (we're not generating faults here)
and use in-place returns instead
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
master commit: 7f12732670b31b2fea899a4160d455574658474f
master date: 2013-09-23 09:53:55 +0200
-rw-r--r-- | xen/arch/x86/hvm/hvm.c | 25 |
1 files changed, 13 insertions, 12 deletions
diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index a2fb715116..20ff58c7d3 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -1938,8 +1938,7 @@ int hvm_virtual_to_linear_addr( unsigned int addr_size, unsigned long *linear_addr) { - unsigned long addr = offset; - uint32_t last_byte; + unsigned long addr = offset, last_byte; if ( !(current->arch.hvm_vcpu.guest_cr[0] & X86_CR0_PE) ) { @@ -1948,6 +1947,9 @@ int hvm_virtual_to_linear_addr( * Certain of them are not done in native real mode anyway. */ addr = (uint32_t)(addr + reg->base); + last_byte = (uint32_t)addr + bytes - 1; + if ( last_byte < addr ) + return 0; } else if ( addr_size != 64 ) { @@ -1959,17 +1961,17 @@ int hvm_virtual_to_linear_addr( { case hvm_access_read: if ( (reg->attr.fields.type & 0xa) == 0x8 ) - goto gpf; /* execute-only code segment */ + return 0; /* execute-only code segment */ break; case hvm_access_write: if ( (reg->attr.fields.type & 0xa) != 0x2 ) - goto gpf; /* not a writable data segment */ + return 0; /* not a writable data segment */ break; default: break; } - last_byte = offset + bytes - 1; + last_byte = (uint32_t)offset + bytes - 1; /* Is this a grows-down data segment? Special limit check if so. */ if ( (reg->attr.fields.type & 0xc) == 0x4 ) @@ -1980,10 +1982,10 @@ int hvm_virtual_to_linear_addr( /* Check first byte and last byte against respective bounds. */ if ( (offset <= reg->limit) || (last_byte < offset) ) - goto gpf; + return 0; } else if ( (last_byte > reg->limit) || (last_byte < offset) ) - goto gpf; /* last byte is beyond limit or wraps 0xFFFFFFFF */ + return 0; /* last byte is beyond limit or wraps 0xFFFFFFFF */ /* * Hardware truncates to 32 bits in compatibility mode. @@ -2000,15 +2002,14 @@ int hvm_virtual_to_linear_addr( if ( (seg == x86_seg_fs) || (seg == x86_seg_gs) ) addr += reg->base; - if ( !is_canonical_address(addr) ) - goto gpf; + last_byte = addr + bytes - 1; + if ( !is_canonical_address(addr) || last_byte < addr || + !is_canonical_address(last_byte) ) + return 0; } *linear_addr = addr; return 1; - - gpf: - return 0; } /* On non-NULL return, we leave this function holding an additional |