Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9a9abf6b authored by Nadav Amit's avatar Nadav Amit Committed by Paolo Bonzini
Browse files

KVM: x86: Inject #GP when loading system segments with non-canonical base 



When emulating LTR/LDTR/LGDT/LIDT, #GP should be injected if the base is
non-canonical. Otherwise, VM-entry will fail.

Signed-off-by: default avatarNadav Amit <namit@cs.technion.ac.il>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent 5b7f6a1e

arch/x86/kvm/emulate.c

+6 −0
Original line number Original line Diff line number Diff line
@@ -1620,6 +1620,9 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt, 
				sizeof(base3), &ctxt->exception);

				sizeof(base3), &ctxt->exception);

		if (ret != X86EMUL_CONTINUE)

		if (ret != X86EMUL_CONTINUE)

			return ret;

			return ret;

		if (is_noncanonical_address(get_desc_base(&seg_desc) |

					     ((u64)base3 << 32)))

			return emulate_gp(ctxt, 0);

	}

	}

load:

load:

	ctxt->ops->set_segment(ctxt, selector, &seg_desc, base3, seg);

	ctxt->ops->set_segment(ctxt, selector, &seg_desc, base3, seg);
@@ -3339,6 +3342,9 @@ static int em_lgdt_lidt(struct x86_emulate_ctxt *ctxt, bool lgdt) 
			     ctxt->op_bytes);

			     ctxt->op_bytes);

	if (rc != X86EMUL_CONTINUE)

	if (rc != X86EMUL_CONTINUE)

		return rc;

		return rc;

	if (ctxt->mode == X86EMUL_MODE_PROT64 &&

	    is_noncanonical_address(desc_ptr.address))

		return emulate_gp(ctxt, 0);

	if (lgdt)

	if (lgdt)

		ctxt->ops->set_gdt(ctxt, &desc_ptr);

		ctxt->ops->set_gdt(ctxt, &desc_ptr);

	else

	else