Commit 2eedcac8 authored by Nadav Amit's avatar Nadav Amit Committed by Paolo Bonzini

KVM: x86: Loading segments on 64-bit mode may be wrong

The current emulator implementation ignores the high 32 bits of the base in
long-mode.  During segment load from the LDT, the base of the LDT is calculated
incorrectly and may cause the wrong segment to be loaded.
Signed-off-by: default avatarNadav Amit <namit@cs.technion.ac.il>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent e37a75a1
...@@ -1358,17 +1358,19 @@ static void get_descriptor_table_ptr(struct x86_emulate_ctxt *ctxt, ...@@ -1358,17 +1358,19 @@ static void get_descriptor_table_ptr(struct x86_emulate_ctxt *ctxt,
u16 selector, struct desc_ptr *dt) u16 selector, struct desc_ptr *dt)
{ {
const struct x86_emulate_ops *ops = ctxt->ops; const struct x86_emulate_ops *ops = ctxt->ops;
u32 base3 = 0;
if (selector & 1 << 2) { if (selector & 1 << 2) {
struct desc_struct desc; struct desc_struct desc;
u16 sel; u16 sel;
memset (dt, 0, sizeof *dt); memset (dt, 0, sizeof *dt);
if (!ops->get_segment(ctxt, &sel, &desc, NULL, VCPU_SREG_LDTR)) if (!ops->get_segment(ctxt, &sel, &desc, &base3,
VCPU_SREG_LDTR))
return; return;
dt->size = desc_limit_scaled(&desc); /* what if limit > 65535? */ dt->size = desc_limit_scaled(&desc); /* what if limit > 65535? */
dt->address = get_desc_base(&desc); dt->address = get_desc_base(&desc) | ((u64)base3 << 32);
} else } else
ops->get_gdt(ctxt, dt); ops->get_gdt(ctxt, dt);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment