mirrors/qemu
0
0
Fork 0
mirror of https://github.com/qemu/qemu.git synced 2024-11-27 13:53:45 +08:00
Code Issues Packages Projects Releases Wiki Activity

target/i386: Fix tss access size in switch_tss_ra

Browse Source 
The two limit_max variables represent size - 1, just like the
encoding in the GDT, thus the 'old' access was off by one.
Access the minimal size of the new tss: the complete tss contains
the iopb, which may be a larger block than the access api expects,
and irrelevant because the iopb is not accessed during the
switch itself.

Fixes: 8b13106508 ("target/i386/tcg: use X86Access for TSS access")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2511
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20240819074052.207783-1-richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
This commit is contained in:
Richard Henderson 2024-08-19 17:39:55 +10:00
parent 83a3a20e59
commit ded1db48c9
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
target/i386/tcg/seg_helper.c
View File

@ -378,7 +378,7 @@ static int switch_tss_ra(CPUX86State *env, int tss_selector,
/* X86Access avoids memory exceptions during the task switch */
mmu_index = cpu_mmu_index_kernel(env);
access_prepare_mmu(&old, env, env->tr.base, old_tss_limit_max,
access_prepare_mmu(&old, env, env->tr.base, old_tss_limit_max + 1,
MMU_DATA_STORE, mmu_index, retaddr);
if (source == SWITCH_TSS_CALL) {
@ -386,7 +386,8 @@ static int switch_tss_ra(CPUX86State *env, int tss_selector,
probe_access(env, tss_base, 2, MMU_DATA_STORE,
mmu_index, retaddr);
}
access_prepare_mmu(&new, env, tss_base, tss_limit,
/* While true tss_limit may be larger, we don't access the iopb here. */
access_prepare_mmu(&new, env, tss_base, tss_limit_max + 1,
MMU_DATA_LOAD, mmu_index, retaddr);
/* save the current state in the old TSS */