From nobody Sun Oct 12 16:22:43 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=randomman.co.uk ARC-Seal: i=1; a=rsa-sha256; t=1749825379; cv=none; d=zohomail.com; s=zohoarc; b=E20xw1KF5+ykTKG4APSRL4kLQQxGbuCT4pqKJYVk6nv5wLZ0OF1jin4GvObexr/tUkWbEk2watSIrApBSQvUZOefVoRTEO8emTJBpBvOqP6o0lZHu2VkHBNfY3zDwAokBkXbHlRM4F8V0DforJB/73lp4ND9QtAKby6ZhGJCSHo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1749825379; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=d2UjKPTJ6QkXuN9bMGOpDBI0kuPGuKCsAuE0nCGskcU=; b=S8JR28N9LcwtQVr1+ly32pRyK+dNR5DmXdMGFJWNKMkI4RHXWkYMhyMUEE+PG28FeSvCO+Gei1vmffm/k6XSuWeYRq20H69FSsnjAERTciiBs1/0vGcP8KycfvSxnG7z1nmU8HKgAq9werd9ySwFTrbeFKiZx2eBgVx0l5N6vJA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1749825379638412.3287594947193; Fri, 13 Jun 2025 07:36:19 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uQ5V8-0002mi-Ad; Fri, 13 Jun 2025 10:35:26 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uQ5V5-0002m2-Ma for qemu-devel@nongnu.org; Fri, 13 Jun 2025 10:35:23 -0400 Received: from smtp-out-60.livemail.co.uk ([213.171.216.60] helo=dkim.livemail.co.uk) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uQ5V3-0005YL-IS for qemu-devel@nongnu.org; Fri, 13 Jun 2025 10:35:23 -0400 Received: from smtp.livemail.co.uk (unknown [10.44.132.84]) by dkim.livemail.co.uk (Postfix) with ESMTPS id 6B314401DA; Fri, 13 Jun 2025 15:35:18 +0100 (BST) Received: from localhost.localdomain (unknown [145.40.191.116]) (Authenticated sender: roy.hopkins@randomman.co.uk) by smtp.livemail.co.uk (Postfix) with ESMTPSA id E95F6A0158; Fri, 13 Jun 2025 15:35:13 +0100 (BST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=randomman.co.uk; s=livemail2; t=1749825318; bh=4wzFmIqJLDF3bsupyhMTUOQH5GKFecnztjCeomUpFbs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Hs4lDjfb5H2UeuH2oXUQlhDr4yXr6B5BiE7ut6tCdd1tYFGvGVaJTjKw0XKkQflzz ZDBdqG1sIGGVEA12NkR7YGzDRcxoEX7mlvz5MNmGmhzjsrBAP9eIVa/cGOvoKWPDBB guGMpHq9LNWC9UeZNpGgxSyZMZTnB77wAR6RMJaM= From: Roy Hopkins To: qemu-devel@nongnu.org Cc: Roy Hopkins , Paolo Bonzini , "Daniel P . Berrange" , Stefano Garzarella , Marcelo Tosatti , "Michael S . Tsirkin" , Cornelia Huck , Marcel Apfelbaum , Sergio Lopez , Eduardo Habkost , Alistair Francis , Peter Xu , David Hildenbrand , Igor Mammedov , Tom Lendacky , Michael Roth , Ani Sinha , Gerd Hoffman , Pankaj Gupta , Joerg Roedel Subject: [PATCH v8 07/16] target/i386: Allow setting of R_LDTR and R_TR with cpu_x86_load_seg_cache() Date: Fri, 13 Jun 2025 15:11:47 +0100 Message-ID: <78e48ebe9b96e9efcd0bb8dc43cf0757c993a98c.1749820158.git.roy.hopkins@randomman.co.uk> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=213.171.216.60; envelope-from=roy.hopkins@randomman.co.uk; helo=dkim.livemail.co.uk X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @randomman.co.uk) X-ZM-MESSAGEID: 1749825381553116600 Content-Type: text/plain; charset="utf-8" The x86 segment registers are identified by the X86Seg enumeration which includes LDTR and TR as well as the normal segment registers. The function 'cpu_x86_load_seg_cache()' uses the enum to determine which segment to set. However, specifying R_LDTR or R_TR results in an out-of-bounds access of the segment array. Possibly by coincidence, the function does correctly set LDTR or TR in this case as the structures for these registers immediately follow the array which is accessed out of bounds. This patch adds correct handling for R_LDTR and R_TR in the function. Signed-off-by: Roy Hopkins Acked-by: Gerd Hoffman Reviewed-by: Michael S. Tsirkin Reviewed-by: Stefano Garzarella --- target/i386/cpu.h | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/target/i386/cpu.h b/target/i386/cpu.h index 5910dcf74d..cc56f0e74f 100644 --- a/target/i386/cpu.h +++ b/target/i386/cpu.h @@ -2417,7 +2417,14 @@ static inline void cpu_x86_load_seg_cache(CPUX86Stat= e *env, SegmentCache *sc; unsigned int new_hflags; =20 - sc =3D &env->segs[seg_reg]; + if (seg_reg =3D=3D R_LDTR) { + sc =3D &env->ldt; + } else if (seg_reg =3D=3D R_TR) { + sc =3D &env->tr; + } else { + sc =3D &env->segs[seg_reg]; + } + sc->selector =3D selector; sc->base =3D base; sc->limit =3D limit; --=20 2.43.0