Skip to content

Commit

Permalink
KVM: VMX: Fix host GDT.LIMIT corruption
Browse files Browse the repository at this point in the history
vmx does not restore GDT.LIMIT to the host value, instead it sets it to 64KB.
This means host userspace can learn a few bits of host memory.

Fix by reloading GDTR when we load other host state.

Signed-off-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
  • Loading branch information
Avi Kivity committed Aug 2, 2010
1 parent 9a3aad7 commit 3444d7d
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions arch/x86/kvm/vmx.c
Original file line number Diff line number Diff line change
Expand Up @@ -185,6 +185,7 @@ static void kvm_cpu_vmxoff(void);
static DEFINE_PER_CPU(struct vmcs *, vmxarea);
static DEFINE_PER_CPU(struct vmcs *, current_vmcs);
static DEFINE_PER_CPU(struct list_head, vcpus_on_cpu);
static DEFINE_PER_CPU(struct desc_ptr, host_gdt);

static unsigned long *vmx_io_bitmap_a;
static unsigned long *vmx_io_bitmap_b;
Expand Down Expand Up @@ -871,6 +872,7 @@ static void __vmx_load_host_state(struct vcpu_vmx *vmx)
#endif
if (current_thread_info()->status & TS_USEDFPU)
clts();
load_gdt(&__get_cpu_var(host_gdt));
}

static void vmx_load_host_state(struct vcpu_vmx *vmx)
Expand Down Expand Up @@ -1379,6 +1381,8 @@ static int hardware_enable(void *garbage)
ept_sync_global();
}

store_gdt(&__get_cpu_var(host_gdt));

return 0;
}

Expand Down

0 comments on commit 3444d7d

Please sign in to comment.