From d8cf50574bd307f5f8a82ab3ee8e0fdab14cd09f Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Fri, 7 Jan 2022 08:51:51 +0100 Subject: [PATCH] x86/HVM: fail virt-to-linear conversion for insn fetches from non-code segments Just like (in protected mode) reads may not go to exec-only segments and writes may not go to non-writable ones, insn fetches may not access data segments. Fixes: 623e83716791 ("hvm: Support hardware task switching") Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper master commit: 311297f4216a4387bdae6df6cfbb1f5edb06618a master date: 2021-12-06 14:15:05 +0100 --- xen/arch/x86/hvm/hvm.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index 5b7e494ca3..89926a5bf6 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -2530,6 +2530,9 @@ bool_t hvm_virtual_to_linear_addr( */ ASSERT(seg < x86_seg_none); + /* However, check that insn fetches only ever specify CS. */ + ASSERT(access_type != hvm_access_insn_fetch || seg == x86_seg_cs); + if ( !(curr->arch.hvm.guest_cr[0] & X86_CR0_PE) ) { /* @@ -2594,10 +2597,17 @@ bool_t hvm_virtual_to_linear_addr( if ( (reg->type & 0xa) == 0x8 ) goto out; /* execute-only code segment */ break; + case hvm_access_write: if ( (reg->type & 0xa) != 0x2 ) goto out; /* not a writable data segment */ break; + + case hvm_access_insn_fetch: + if ( !(reg->type & 0x8) ) + goto out; /* not a code segment */ + break; + default: break; }