1. Patchew
  2. QEMU
  3. View series

[PATCH] target/i386: Added consistency checks for CR3

Lara Lazier posted 1 patch 2 years, 9 months ago
Test checkpatch passed
Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20210723112740.45962-1-laramglazier@gmail.com
Maintainers: Eduardo Habkost <ehabkost@redhat.com>, Paolo Bonzini <pbonzini@redhat.com>, Richard Henderson <richard.henderson@linaro.org>
target/i386/tcg/sysemu/misc_helper.c |  7 +++++++
target/i386/tcg/sysemu/svm_helper.c  | 10 +++++++---
2 files changed, 14 insertions(+), 3 deletions(-)
[PATCH] target/i386: Added consistency checks for CR3
Posted by Lara Lazier 2 years, 9 months ago 
All MBZ in CR3 must be zero (APM2 15.5)
Added checks in both helper_vmrun and helper_write_crN.
When EFER.LMA is zero the upper 32 bits needs to be zeroed.

Signed-off-by: Lara Lazier <laramglazier@gmail.com>
---
 target/i386/tcg/sysemu/misc_helper.c |  7 +++++++
 target/i386/tcg/sysemu/svm_helper.c  | 10 +++++++---
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/target/i386/tcg/sysemu/misc_helper.c b/target/i386/tcg/sysemu/misc_helper.c
index a2af2c9bba..d347af2a99 100644
--- a/target/i386/tcg/sysemu/misc_helper.c
+++ b/target/i386/tcg/sysemu/misc_helper.c
@@ -96,6 +96,13 @@ void helper_write_crN(CPUX86State *env, int reg, target_ulong t0)
         cpu_x86_update_cr0(env, t0);
         break;
     case 3:
+        if ((env->efer & MSR_EFER_LMA) &&
+                (t0 & ((~0UL) << env_archcpu(env)->phys_bits))) {
+            cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
+        }
+        if (!(env->efer & MSR_EFER_LMA)) {
+            t0 &= 0xffffffffUL;
+        }
         cpu_x86_update_cr3(env, t0);
         break;
     case 4:
diff --git a/target/i386/tcg/sysemu/svm_helper.c b/target/i386/tcg/sysemu/svm_helper.c
index 37dbe8e434..8b1ba53c64 100644
--- a/target/i386/tcg/sysemu/svm_helper.c
+++ b/target/i386/tcg/sysemu/svm_helper.c
@@ -111,6 +111,7 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
     uint32_t int_ctl;
     uint32_t asid;
     uint64_t new_cr0;
+    uint64_t new_cr3;
     uint64_t new_cr4;
 
     cpu_svm_check_intercept_param(env, SVM_EXIT_VMRUN, 0, GETPC());
@@ -252,6 +253,11 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
     if ((new_cr0 & CR0_NW_MASK) && !(new_cr0 & CR0_CD_MASK)) {
         cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
     }
+    new_cr3 = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.cr3));
+    if ((env->efer & MSR_EFER_LMA) &&
+            (new_cr3 & ((~0UL) << cpu->phys_bits))) {
+        cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
+    }
     new_cr4 = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.cr4));
     if (new_cr4 & cr4_reserved_bits(env)) {
         cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
@@ -262,9 +268,7 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
 
     cpu_x86_update_cr0(env, new_cr0);
     cpu_x86_update_cr4(env, new_cr4);
-    cpu_x86_update_cr3(env, x86_ldq_phys(cs,
-                                     env->vm_vmcb + offsetof(struct vmcb,
-                                                             save.cr3)));
+    cpu_x86_update_cr3(env, new_cr3);
     env->cr[2] = x86_ldq_phys(cs,
                           env->vm_vmcb + offsetof(struct vmcb, save.cr2));
     int_ctl = x86_ldl_phys(cs,
-- 
2.25.1
Re: [PATCH] target/i386: Added consistency checks for CR3
Posted by Paolo Bonzini 2 years, 9 months ago 
On 23/07/21 13:27, Lara Lazier wrote:
> All MBZ in CR3 must be zero (APM2 15.5)
> Added checks in both helper_vmrun and helper_write_crN.
> When EFER.LMA is zero the upper 32 bits needs to be zeroed.
> 
> Signed-off-by: Lara Lazier <laramglazier@gmail.com>
> ---
>   target/i386/tcg/sysemu/misc_helper.c |  7 +++++++
>   target/i386/tcg/sysemu/svm_helper.c  | 10 +++++++---
>   2 files changed, 14 insertions(+), 3 deletions(-)
> 
> diff --git a/target/i386/tcg/sysemu/misc_helper.c b/target/i386/tcg/sysemu/misc_helper.c
> index a2af2c9bba..d347af2a99 100644
> --- a/target/i386/tcg/sysemu/misc_helper.c
> +++ b/target/i386/tcg/sysemu/misc_helper.c
> @@ -96,6 +96,13 @@ void helper_write_crN(CPUX86State *env, int reg, target_ulong t0)
>           cpu_x86_update_cr0(env, t0);
>           break;
>       case 3:
> +        if ((env->efer & MSR_EFER_LMA) &&
> +                (t0 & ((~0UL) << env_archcpu(env)->phys_bits))) {
> +            cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
> +        }
> +        if (!(env->efer & MSR_EFER_LMA)) {
> +            t0 &= 0xffffffffUL;
> +        }
>           cpu_x86_update_cr3(env, t0);
>           break;
>       case 4:
> diff --git a/target/i386/tcg/sysemu/svm_helper.c b/target/i386/tcg/sysemu/svm_helper.c
> index 37dbe8e434..8b1ba53c64 100644
> --- a/target/i386/tcg/sysemu/svm_helper.c
> +++ b/target/i386/tcg/sysemu/svm_helper.c
> @@ -111,6 +111,7 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
>       uint32_t int_ctl;
>       uint32_t asid;
>       uint64_t new_cr0;
> +    uint64_t new_cr3;
>       uint64_t new_cr4;
>   
>       cpu_svm_check_intercept_param(env, SVM_EXIT_VMRUN, 0, GETPC());
> @@ -252,6 +253,11 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
>       if ((new_cr0 & CR0_NW_MASK) && !(new_cr0 & CR0_CD_MASK)) {
>           cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
>       }
> +    new_cr3 = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.cr3));
> +    if ((env->efer & MSR_EFER_LMA) &&
> +            (new_cr3 & ((~0UL) << cpu->phys_bits))) {
> +        cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
> +    }
>       new_cr4 = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.cr4));
>       if (new_cr4 & cr4_reserved_bits(env)) {
>           cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
> @@ -262,9 +268,7 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
>   
>       cpu_x86_update_cr0(env, new_cr0);
>       cpu_x86_update_cr4(env, new_cr4);
> -    cpu_x86_update_cr3(env, x86_ldq_phys(cs,
> -                                     env->vm_vmcb + offsetof(struct vmcb,
> -                                                             save.cr3)));
> +    cpu_x86_update_cr3(env, new_cr3);
>       env->cr[2] = x86_ldq_phys(cs,
>                             env->vm_vmcb + offsetof(struct vmcb, save.cr2));
>       int_ctl = x86_ldl_phys(cs,
> 

Queued, thanks.

Paolo

Patchew 2.1-devel-0870f84

© 2016 - 2024 Red Hat, Inc.