GP and SS exceptions deliver as error-code the segment selector if the
exception occurred when the segment is loaded. However, if the exception
occurs during the memory access itself, due to limit violations, the error-code
should be zero. Fix it.
Signed-off-by: Nadav Amit <namit@xxxxxxxxxxxxxxxxx>
---
arch/x86/kvm/emulate.c | 20 +++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index a46207a..13a1c76 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -621,7 +621,7 @@ static int __linearize(struct x86_emulate_ctxt *ctxt,
bool usable;
ulong la;
u32 lim;
- u16 sel;
+ u16 sel, error_code = 0;
unsigned cpl;
la = seg_base(ctxt, addr.seg) + addr.ea;
@@ -634,14 +634,14 @@ static int __linearize(struct x86_emulate_ctxt *ctxt,
usable = ctxt->ops->get_segment(ctxt, &sel, &desc, NULL,
addr.seg);
if (!usable)
- goto bad;
+ goto bad_sel;
/* code segment in protected mode or read-only data segment */
if ((((ctxt->mode != X86EMUL_MODE_REAL) && (desc.type & 8))
|| !(desc.type & 2)) && write)
- goto bad;
+ goto bad_sel;
/* unreadable code segment */
if (!fetch && (desc.type & 8) && !(desc.type & 2))
- goto bad;
+ goto bad_sel;
lim = desc_limit_scaled(&desc);
if ((ctxt->mode == X86EMUL_MODE_REAL) && !fetch &&
(ctxt->d & NoBigReal)) {
@@ -664,15 +664,15 @@ static int __linearize(struct x86_emulate_ctxt *ctxt,
if (!(desc.type & 8)) {
/* data segment */
if (cpl > desc.dpl)
- goto bad;
+ goto bad_sel;
} else if ((desc.type & 8) && !(desc.type & 4)) {
/* nonconforming code segment */
if (cpl != desc.dpl)
- goto bad;
+ goto bad_sel;
} else if ((desc.type & 8) && (desc.type & 4)) {
/* conforming code segment */
if (cpl < desc.dpl)
- goto bad;
+ goto bad_sel;
}
break;
}
@@ -682,11 +682,13 @@ static int __linearize(struct x86_emulate_ctxt *ctxt,
return emulate_gp(ctxt, 0);
*linear = la;
return X86EMUL_CONTINUE;
+bad_sel:
+ error_code = sel;
bad:
if (addr.seg == VCPU_SREG_SS)
- return emulate_ss(ctxt, sel);
+ return emulate_ss(ctxt, error_code);
else
- return emulate_gp(ctxt, sel);
+ return emulate_gp(ctxt, error_code);
}
static int linearize(struct x86_emulate_ctxt *ctxt,
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
