diff options
| author |   Eduardo Habkost <ehabkost@redhat.com> | 2009-10-14 15:02:27 -0300 |
|---|---|---|
| committer |   Marcelo Tosatti <mtosatti@redhat.com> | 2009-10-16 11:08:32 -0300 |
| commit | fafd46eff229834a15496051acb8880848fcd8eb (patch) | |
| tree | 6915fe732714cf3b87e29b6bff08e1476c51119e | |
| parent | b6fffd0208b8aa80ce271e5ab7efc50f7236ba40 (diff) | |
fix MSR_COUNT for kvm_arch_save_regs()
A new register was added to the load/save list on commit
d283d5a65a2bdcc570065267be21848bd6fe3d78, but MSR_COUNT was not updated, leading
to potential stack corruption on kvm_arch_save_regs().
The following registers are saved by kvm_arch_save_regs():
1) MSR_IA32_SYSENTER_CS
2) MSR_IA32_SYSENTER_ESP
3) MSR_IA32_SYSENTER_EIP
4) MSR_STAR
5) MSR_IA32_TSC
6) MSR_VM_HSAVE_PA
7) MSR_CSTAR (x86_64 only)
8) MSR_KERNELGSBASE (x86_64 only)
9) MSR_FMASK (x86_64 only)
10) MSR_LSTAR (x86_64 only)
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
| -rw-r--r-- | qemu-kvm-x86.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/qemu-kvm-x86.c b/qemu-kvm-x86.c index 492dbc543..d5436b6a7 100644 --- a/qemu-kvm-x86.c +++ b/qemu-kvm-x86.c @@ -847,9 +847,9 @@ static int get_msr_entry(struct kvm_msr_entry *entry, CPUState *env) } #ifdef TARGET_X86_64 -#define MSR_COUNT 9 +#define MSR_COUNT 10 #else -#define MSR_COUNT 5 +#define MSR_COUNT 6 #endif static void set_v8086_seg(struct kvm_segment *lhs, const SegmentCache *rhs) @@ -991,6 +991,7 @@ void kvm_arch_load_regs(CPUState *env) /* msrs */ n = 0; + /* Remember to increase MSR_COUNT if you add new registers below */ set_msr_entry(&msrs[n++], MSR_IA32_SYSENTER_CS, env->sysenter_cs); set_msr_entry(&msrs[n++], MSR_IA32_SYSENTER_ESP, env->sysenter_esp); set_msr_entry(&msrs[n++], MSR_IA32_SYSENTER_EIP, env->sysenter_eip); @@ -1166,6 +1167,7 @@ void kvm_arch_save_regs(CPUState *env) /* msrs */ n = 0; + /* Remember to increase MSR_COUNT if you add new registers below */ msrs[n++].index = MSR_IA32_SYSENTER_CS; msrs[n++].index = MSR_IA32_SYSENTER_ESP; msrs[n++].index = MSR_IA32_SYSENTER_EIP; |