Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3444d7da authored by Avi Kivity's avatar Avi Kivity
Browse files

KVM: VMX: Fix host GDT.LIMIT corruption 



vmx does not restore GDT.LIMIT to the host value, instead it sets it to 64KB.
This means host userspace can learn a few bits of host memory.

Fix by reloading GDTR when we load other host state.

Signed-off-by: default avatarAvi Kivity <avi@redhat.com>
Signed-off-by: default avatarMarcelo Tosatti <mtosatti@redhat.com>
parent 9a3aad70

arch/x86/kvm/vmx.c

+4 −0
Original line number Diff line number Diff line
@@ -185,6 +185,7 @@ static void kvm_cpu_vmxoff(void); 
static DEFINE_PER_CPU(struct vmcs *, vmxarea);

static DEFINE_PER_CPU(struct vmcs *, current_vmcs);

static DEFINE_PER_CPU(struct list_head, vcpus_on_cpu);

static DEFINE_PER_CPU(struct desc_ptr, host_gdt);



static unsigned long *vmx_io_bitmap_a;

static unsigned long *vmx_io_bitmap_b;
@@ -871,6 +872,7 @@ static void __vmx_load_host_state(struct vcpu_vmx *vmx) 
#endif

	if (current_thread_info()->status & TS_USEDFPU)

		clts();

	load_gdt(&__get_cpu_var(host_gdt));

}



static void vmx_load_host_state(struct vcpu_vmx *vmx)
@@ -1379,6 +1381,8 @@ static int hardware_enable(void *garbage) 
		ept_sync_global();

	}



	store_gdt(&__get_cpu_var(host_gdt));



	return 0;

}