KVM: VMX: Fix ds/es corruption on i386 with preemption
authorAvi Kivity <avi@redhat.com>
Wed, 1 Aug 2012 13:48:03 +0000 (16:48 +0300)
committerMarcelo Tosatti <mtosatti@redhat.com>
Wed, 1 Aug 2012 23:23:57 +0000 (20:23 -0300)
commitaa67f6096c19bcdb1951ef88be3cf3d2118809dc
tree61a806e065b9db4eabfd85753333e580d8b0a465
parent4b6486659a7defef82ea51b276024b3aa357fefc
KVM: VMX: Fix ds/es corruption on i386 with preemption

Commit b2da15ac26a0c ("KVM: VMX: Optimize %ds, %es reload") broke i386
in the following scenario:

  vcpu_load
  ...
  vmx_save_host_state
  vmx_vcpu_run
  (ds.rpl, es.rpl cleared by hardware)

  interrupt
    push ds, es  # pushes bad ds, es
    schedule
      vmx_vcpu_put
        vmx_load_host_state
          reload ds, es (with __USER_DS)
    pop ds, es  # of other thread's stack
    iret
  # other thread runs
  interrupt
    push ds, es
    schedule  # back in vcpu thread
    pop ds, es  # now with rpl=0
    iret
  ...
  vcpu_put
  resume_userspace
  iret  # clears ds, es due to mismatched rpl

(instead of resume_userspace, we might return with SYSEXIT and then
take an exception; when the exception IRETs we end up with cleared
ds, es)

Fix by avoiding the optimization on i386 and reloading ds, es on the
lightweight exit path.

Reported-by: Chris Clayron <chris2553@googlemail.com>
Signed-off-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
arch/x86/kvm/vmx.c