]> git.ipfire.org Git - thirdparty/qemu.git/commit
i386/tcg/svm: fix incorrect canonicalization
authorZero Tang <zero.tangptr@gmail.com>
Mon, 18 Aug 2025 10:16:47 +0000 (12:16 +0200)
committerMichael Tokarev <mjt@tls.msk.ru>
Fri, 29 Aug 2025 07:23:02 +0000 (10:23 +0300)
commit579a0cc0e6dcf9f6bf06a33bef44cee90c989ccf
tree36912c264d0ae7e2dcfddfc0e363d6722fe61d49
parente2d0c64a0f5ee60d96330034019f4223d503b4f0
i386/tcg/svm: fix incorrect canonicalization

For all 32-bit systems and 64-bit Windows systems, "long" is 4 bytes long.
Due to using "long" for a linear address, svm_canonicalization would
set all high bits to 1 when (assuming 48-bit linear address) the segment
base is bigger than 0x7FFF.

This fixes booting guests under TCG when the guest IDT and GDT bases are
above 0x7FFF, thereby resulting in incorrect bases. When an interrupt
arrives, it would trigger a #PF exception; the #PF would trigger again,
resulting in a #DF exception; the #PF would trigger for the third time,
resulting in triple-fault, and eventually causes a shutdown VM-Exit to
the hypervisor right after guest boot.

Cc: qemu-stable@nongnu.org
Signed-off-by: Zero Tang <zero.tangptr@gmail.com>
(cherry picked from commit c12cbaa007c9da97a11e74119ea3aed9fcc3ac4c)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
target/i386/tcg/system/svm_helper.c