From 40d66baa46ca8a9ffa6df3e063a967d08ec92bcf Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Fri, 11 Oct 2013 09:28:26 +0200 Subject: x86: correct LDT checks - MMUEXT_SET_LDT should behave as similarly to the LLDT instruction as possible: fail only if the base address is non-canonical - instead LDT descriptor accesses should fault if the descriptor address ends up being non-canonical (by ensuring this we at once avoid reading an entry from the mach-to-phys table and consider it a page table entry) - fault propagation on using LDT selectors must distinguish #PF and #GP (the latter must be raised for a non-canonical descriptor address, which also applies to several other uses of propagate_page_fault(), and hence the problem is being fixed there) - map_ldt_shadow_page() should properly wrap addresses for 32-bit VMs At once remove the odd invokation of map_ldt_shadow_page() from the MMUEXT_SET_LDT handler: There's nothing really telling us that the first LDT page is going to be preferred over others. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-by: Keir Fraser --- xen/arch/x86/mm.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) (limited to 'xen/arch/x86/mm.c') diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c index 7d4215dacc..43aacebe61 100644 --- a/xen/arch/x86/mm.c +++ b/xen/arch/x86/mm.c @@ -582,6 +582,8 @@ int map_ldt_shadow_page(unsigned int off) BUG_ON(unlikely(in_irq())); + if ( is_pv_32bit_domain(d) ) + gva = (u32)gva; guest_get_eff_kern_l1e(v, gva, &l1e); if ( unlikely(!(l1e_get_flags(l1e) & _PAGE_PRESENT)) ) return 0; @@ -3229,9 +3231,8 @@ long do_mmuext_op( MEM_LOG("ignoring SET_LDT hypercall from external domain"); okay = 0; } - else if ( ((ptr & (PAGE_SIZE-1)) != 0) || - (ents > 8192) || - !array_access_ok(ptr, ents, LDT_ENTRY_SIZE) ) + else if ( ((ptr & (PAGE_SIZE - 1)) != 0) || !__addr_ok(ptr) || + (ents > 8192) ) { okay = 0; MEM_LOG("Bad args to SET_LDT: ptr=%lx, ents=%lx", ptr, ents); @@ -3244,8 +3245,6 @@ long do_mmuext_op( curr->arch.pv_vcpu.ldt_base = ptr; curr->arch.pv_vcpu.ldt_ents = ents; load_LDT(curr); - if ( ents != 0 ) - (void)map_ldt_shadow_page(0); } break; } -- cgit v1.2.3