fix potential overflow condition in VMX assist

[palacios.git] / palacios / src / palacios / vmx_assist.c

diff --git a/palacios/src/palacios/vmx_assist.c b/palacios/src/palacios/vmx_assist.c
index 058f503..777a312 100644 (file)
--- a/palacios/src/palacios/vmx_assist.c
+++ b/palacios/src/palacios/vmx_assist.c
@@ -248,10 +248,10 @@ int v3_vmxassist_init(struct guest_info * core, struct vmx_data * vmx_state) {
     core->vm_regs.rsp = 0x80000;
     ((struct rflags *)&(core->ctrl_regs.rflags))->rsvd1 = 1;
 
-#define GUEST_CR0 0x80010031
-#define GUEST_CR4 0x00002010
-    core->ctrl_regs.cr0 = GUEST_CR0;
-    core->ctrl_regs.cr4 = GUEST_CR4;
+#define GUEST_CR0_MASK 0x80010031
+#define GUEST_CR4_MASK 0x00002010
+    core->ctrl_regs.cr0 |= GUEST_CR0_MASK;
+    core->ctrl_regs.cr4 |= GUEST_CR4_MASK;
 
     ((struct cr0_32 *)&(core->shdw_pg_state.guest_cr0))->pe = 1;
     ((struct cr0_32 *)&(core->shdw_pg_state.guest_cr0))->wp = 1;
@@ -304,14 +304,10 @@ int v3_vmxassist_init(struct guest_info * core, struct vmx_data * vmx_state) {
        };
 
 
-       addr_t vmxassist_gdt = 0;
-
-       if (v3_gpa_to_hva(core, VMXASSIST_GDT, &vmxassist_gdt) == -1) {
-           PrintError(core->vm_info, core, "Could not find VMXASSIST GDT destination\n");
+       if (v3_write_gpa_memory(core, VMXASSIST_GDT, sizeof(uint64_t)*5, (void*)gdt)!=sizeof(uint64_t)*5) { 
+           PrintError(core->vm_info, core, "Could not write VMXASSIST GDT\n");
            return -1;
        }
-
-       memcpy((void *)vmxassist_gdt, gdt, sizeof(uint64_t) * 5);
         
        core->segments.gdtr.base = VMXASSIST_GDT;
 
@@ -335,10 +331,10 @@ int v3_vmxassist_init(struct guest_info * core, struct vmx_data * vmx_state) {
  
     if (core->shdw_pg_mode == NESTED_PAGING) {
        // setup 1to1 page table internally.
-       int i = 0;
+       unsigned long i = 0;
        pde32_4MB_t * pde = NULL;
 
-       PrintError(core->vm_info, core, "Setting up internal VMXASSIST page tables\n");
+       V3_Print(core->vm_info, core, "Setting up internal VMXASSIST page tables\n");
 
        if (v3_gpa_to_hva(core, VMXASSIST_1to1_PT, (addr_t *)(&pde)) == -1) {
            PrintError(core->vm_info, core, "Could not find VMXASSIST 1to1 PT destination\n");
@@ -366,15 +362,12 @@ int v3_vmxassist_init(struct guest_info * core, struct vmx_data * vmx_state) {
 
        extern uint8_t v3_vmxassist_start[];
        extern uint8_t v3_vmxassist_end[];
-       addr_t vmxassist_dst = 0;
 
-       if (v3_gpa_to_hva(core, VMXASSIST_START, &vmxassist_dst) == -1) {
-           PrintError(core->vm_info, core, "Could not find VMXASSIST destination\n");
+       if (v3_write_gpa_memory(core, VMXASSIST_START, v3_vmxassist_end-v3_vmxassist_start,v3_vmxassist_start)!=v3_vmxassist_end-v3_vmxassist_start) { 
+           PrintError(core->vm_info, core, "Could not write VMXASSIST\n");
            return -1;
        }
 
-       memcpy((void *)vmxassist_dst, v3_vmxassist_start, v3_vmxassist_end - v3_vmxassist_start);
-
 
        vmx_state->assist_state = VMXASSIST_OFF;
     }