From: Greg KH on
2.6.34-stable review patch. If anyone has any objections, please let me know.

------------------

From: Joerg Roedel <joerg.roedel(a)amd.com>

The nested_svm_exit_handled_msr() function maps only one
page of the guests msr permission bitmap. This patch changes
the code to use kvm_read_guest to fix the bug.

Cc: stable(a)kernel.org
Signed-off-by: Joerg Roedel <joerg.roedel(a)amd.com>
Signed-off-by: Avi Kivity <avi(a)redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)suse.de>

(Cherry-picked from commit 4c7da8cb43c09e71a405b5aeaa58a1dbac3c39e9)
---
arch/x86/kvm/svm.c | 13 +++----------
1 file changed, 3 insertions(+), 10 deletions(-)

--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1459,19 +1459,13 @@ static bool nested_svm_exit_handled_msr(
{
u32 param = svm->vmcb->control.exit_info_1 & 1;
u32 msr = svm->vcpu.arch.regs[VCPU_REGS_RCX];
- struct page *page;
bool ret = false;
u32 t0, t1;
- u8 *msrpm;
+ u8 val;

if (!(svm->nested.intercept & (1ULL << INTERCEPT_MSR_PROT)))
return false;

- msrpm = nested_svm_map(svm, svm->nested.vmcb_msrpm, &page);
-
- if (!msrpm)
- goto out;
-
switch (msr) {
case 0 ... 0x1fff:
t0 = (msr * 2) % 8;
@@ -1492,11 +1486,10 @@ static bool nested_svm_exit_handled_msr(
goto out;
}

- ret = msrpm[t1] & ((1 << param) << t0);
+ if (!kvm_read_guest(svm->vcpu.kvm, svm->nested.vmcb_msrpm + t1, &val, 1))
+ ret = val & ((1 << param) << t0);

out:
- nested_svm_unmap(page);
-
return ret;
}



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/