diff options
author | Jan Beulich <jbeulich@suse.com> | 2013-10-11 09:28:26 +0200 |
---|---|---|
committer | Jan Beulich <jbeulich@suse.com> | 2013-10-11 09:28:26 +0200 |
commit | 40d66baa46ca8a9ffa6df3e063a967d08ec92bcf (patch) | |
tree | 551daf93c5e8b6a8bd50cf58f5a30eb1da8ec1dc /xen/arch/x86/mm.c | |
parent | 4c37ed562224295c0f8b00211287d57cae629782 (diff) | |
download | xen-40d66baa46ca8a9ffa6df3e063a967d08ec92bcf.tar.gz xen-40d66baa46ca8a9ffa6df3e063a967d08ec92bcf.tar.bz2 xen-40d66baa46ca8a9ffa6df3e063a967d08ec92bcf.zip |
x86: correct LDT checks
- MMUEXT_SET_LDT should behave as similarly to the LLDT instruction as
possible: fail only if the base address is non-canonical
- instead LDT descriptor accesses should fault if the descriptor
address ends up being non-canonical (by ensuring this we at once
avoid reading an entry from the mach-to-phys table and consider it a
page table entry)
- fault propagation on using LDT selectors must distinguish #PF and #GP
(the latter must be raised for a non-canonical descriptor address,
which also applies to several other uses of propagate_page_fault(),
and hence the problem is being fixed there)
- map_ldt_shadow_page() should properly wrap addresses for 32-bit VMs
At once remove the odd invokation of map_ldt_shadow_page() from the
MMUEXT_SET_LDT handler: There's nothing really telling us that the
first LDT page is going to be preferred over others.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Keir Fraser <keir@xen.org>
Diffstat (limited to 'xen/arch/x86/mm.c')
-rw-r--r-- | xen/arch/x86/mm.c | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c index 7d4215dacc..43aacebe61 100644 --- a/xen/arch/x86/mm.c +++ b/xen/arch/x86/mm.c @@ -582,6 +582,8 @@ int map_ldt_shadow_page(unsigned int off) BUG_ON(unlikely(in_irq())); + if ( is_pv_32bit_domain(d) ) + gva = (u32)gva; guest_get_eff_kern_l1e(v, gva, &l1e); if ( unlikely(!(l1e_get_flags(l1e) & _PAGE_PRESENT)) ) return 0; @@ -3229,9 +3231,8 @@ long do_mmuext_op( MEM_LOG("ignoring SET_LDT hypercall from external domain"); okay = 0; } - else if ( ((ptr & (PAGE_SIZE-1)) != 0) || - (ents > 8192) || - !array_access_ok(ptr, ents, LDT_ENTRY_SIZE) ) + else if ( ((ptr & (PAGE_SIZE - 1)) != 0) || !__addr_ok(ptr) || + (ents > 8192) ) { okay = 0; MEM_LOG("Bad args to SET_LDT: ptr=%lx, ents=%lx", ptr, ents); @@ -3244,8 +3245,6 @@ long do_mmuext_op( curr->arch.pv_vcpu.ldt_base = ptr; curr->arch.pv_vcpu.ldt_ents = ents; load_LDT(curr); - if ( ents != 0 ) - (void)map_ldt_shadow_page(0); } break; } |