Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit da38f438 authored by Avi Kivity's avatar Avi Kivity
Browse files

KVM: VMX: Fix host MSR_KERNEL_GS_BASE corruption 



enter_lmode() and exit_lmode() modify the guest's EFER.LMA before calling
vmx_set_efer().  However, the latter function depends on the value of EFER.LMA
to determine whether MSR_KERNEL_GS_BASE needs reloading, via
vmx_load_host_state().  With EFER.LMA changing under its feet, it took the
wrong choice and corrupted userspace's %gs.

This causes 32-on-64 host userspace to fault.

Fix not touching EFER.LMA; instead ask vmx_set_efer() to change it.

Signed-off-by: default avatarAvi Kivity <avi@redhat.com>
parent 815c4163

arch/x86/kvm/vmx.c

+2 −5
Original line number Diff line number Diff line
@@ -1744,18 +1744,15 @@ static void enter_lmode(struct kvm_vcpu *vcpu) 
			     (guest_tr_ar & ~AR_TYPE_MASK)

			     | AR_TYPE_BUSY_64_TSS);

	}

	vcpu->arch.efer |= EFER_LMA;

	vmx_set_efer(vcpu, vcpu->arch.efer);

	vmx_set_efer(vcpu, vcpu->arch.efer | EFER_LMA);

}



static void exit_lmode(struct kvm_vcpu *vcpu)

{

	vcpu->arch.efer &= ~EFER_LMA;



	vmcs_write32(VM_ENTRY_CONTROLS,

		     vmcs_read32(VM_ENTRY_CONTROLS)

		     & ~VM_ENTRY_IA32E_MODE);

	vmx_set_efer(vcpu, vcpu->arch.efer);

	vmx_set_efer(vcpu, vcpu->arch.efer & ~EFER_LMA);

}



#endif