From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paolo Bonzini Subject: Re: [PATCH 3/5] KVM: nVMX: add limit check for expand-down segments Date: Mon, 7 Sep 2015 13:39:53 +0200 Message-ID: <55ED7789.3010700@redhat.com> References: <20150820193739.GA3555@unote> Mime-Version: 1.0 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit To: Eugene Korenevsky , kvm@vger.kernel.org Return-path: Received: from mx1.redhat.com ([209.132.183.28]:45132 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750969AbbIGLj4 (ORCPT ); Mon, 7 Sep 2015 07:39:56 -0400 In-Reply-To: <20150820193739.GA3555@unote> Sender: kvm-owner@vger.kernel.org List-ID: On 20/08/2015 21:37, Eugene Korenevsky wrote: > Add limit checking for expand-down data segments. For such segments, the > effective limit specifies the last address that is not allowed to be accessed > within the segment. I.e. offset <= limit means means limit exceeding. > > Signed-off-by: Eugene Korenevsky > --- > arch/x86/kvm/vmx.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c > index faa05a4..4a4d677 100644 > --- a/arch/x86/kvm/vmx.c > +++ b/arch/x86/kvm/vmx.c > @@ -6377,7 +6377,10 @@ static int vmx_protmode_seg_check(struct kvm_vcpu *vcpu, > /* #GP(0)/#SS(0) if the segment is unusable. */ > exn = (s->unusable != 0); > /* #GP(0)/#SS(0) if the memory operand is outside the segment limit. */ > - exn = exn || (off + mem_op_size - 1 > s->limit); > + if (!(s->type & 8) && (s->type & 4)) /* expand-down segment? */ > + exn = exn || (off <= s->limit); > + else > + exn = exn || (off + mem_op_size - 1 > s->limit); For expand-down segments you also have to check against the size of the segment (48 bits for 64-bit segments and positive addresses, 32 bits for 32-bit segments, 16 bits for 16-bit segments; see __linearize in emulate.c). Paolo