ia64/xen-unstable

changeset 4148:ce88c0b8cb9c

bitkeeper revision 1.1236.34.1 (4236a41axFD_nz4Avu26J6WLiOHu7w)

Fix descriptor checking that I broke. Allow conforming code segments -
they are harmless.
Signed-off-by: Keir Fraser <keir@xensource.com>
author kaf24@firebug.cl.cam.ac.uk
date Tue Mar 15 09:00:10 2005 +0000 (2005-03-15)
parents 288c77d96e81
children 5c5ca35a900a
files xen/arch/x86/x86_32/mm.c xen/arch/x86/x86_64/mm.c
line diff
     1.1 --- a/xen/arch/x86/x86_32/mm.c	Mon Mar 14 22:29:15 2005 +0000
     1.2 +++ b/xen/arch/x86/x86_32/mm.c	Tue Mar 15 09:00:10 2005 +0000
     1.3 @@ -274,10 +274,25 @@ int check_descriptor(struct desc_struct 
     1.4      if ( (b & _SEGMENT_G) )
     1.5          limit <<= 12;
     1.6  
     1.7 -    switch ( b & (_SEGMENT_CODE | _SEGMENT_EC) )
     1.8 +    if ( (b & (_SEGMENT_CODE | _SEGMENT_EC)) == _SEGMENT_EC )
     1.9      {
    1.10 -    case 0: /* Data segment, grows-up */
    1.11          /*
    1.12 +         * DATA, GROWS-DOWN.
    1.13 +         * Grows-down limit check. 
    1.14 +         * NB. limit == 0xFFFFF provides no access      (if G=1).
    1.15 +         *     limit == 0x00000 provides 4GB-4kB access (if G=1).
    1.16 +         */
    1.17 +        if ( (base + limit) > base )
    1.18 +        {
    1.19 +            limit = -(base & PAGE_MASK);
    1.20 +            goto truncate;
    1.21 +        }
    1.22 +    }
    1.23 +    else
    1.24 +    {
    1.25 +        /*
    1.26 +         * DATA, GROWS-UP. 
    1.27 +         * CODE (CONFORMING AND NON-CONFORMING).
    1.28           * Grows-up limit check.
    1.29           * NB. limit == 0xFFFFF provides 4GB access (if G=1).
    1.30           *     limit == 0x00000 provides 4kB access (if G=1).
    1.31 @@ -293,23 +308,6 @@ int check_descriptor(struct desc_struct 
    1.32              d->a &= ~0x0ffff; d->a |= limit & 0x0ffff;
    1.33              d->b &= ~0xf0000; d->b |= limit & 0xf0000;
    1.34          }
    1.35 -        goto good;
    1.36 -    case _SEGMENT_EC: /* Data segment, grows-down */
    1.37 -        /*
    1.38 -         * Grows-down limit check. 
    1.39 -         * NB. limit == 0xFFFFF provides no access      (if G=1).
    1.40 -         *     limit == 0x00000 provides 4GB-4kB access (if G=1).
    1.41 -         */
    1.42 -        if ( (base + limit) > base )
    1.43 -        {
    1.44 -            limit = -(base & PAGE_MASK);
    1.45 -            goto truncate;
    1.46 -        }
    1.47 -        goto good;
    1.48 -    case _SEGMENT_CODE: /* Code segment, non-conforming */
    1.49 -        goto good;
    1.50 -    case _SEGMENT_CODE|_SEGMENT_EC: /* Code segment, conforming */
    1.51 -        goto bad;
    1.52      }
    1.53  
    1.54   good:
     2.1 --- a/xen/arch/x86/x86_64/mm.c	Mon Mar 14 22:29:15 2005 +0000
     2.2 +++ b/xen/arch/x86/x86_64/mm.c	Tue Mar 15 09:00:10 2005 +0000
     2.3 @@ -287,14 +287,9 @@ int check_descriptor(struct desc_struct 
     2.4      if ( (b & _SEGMENT_DPL) != 3 )
     2.5          goto bad;
     2.6  
     2.7 -    /* Most code and data segments are okay. No base/limit checking. */
     2.8 +    /* All code and data segments are okay. No base/limit checking. */
     2.9      if ( (b & _SEGMENT_S) )
    2.10 -    {
    2.11 -        /* Disallow conforming code segments. I'm not sure they're safe. */
    2.12 -        if ( (b & (_SEGMENT_CODE|_SEGMENT_EC)) == (_SEGMENT_CODE|_SEGMENT_EC) )
    2.13 -            goto bad;
    2.14          goto good;
    2.15 -    }
    2.16  
    2.17      /* Invalid type 0 is harmless. It is used for 2nd half of a call gate. */
    2.18      if ( (b & _SEGMENT_TYPE) == 0x000 )