Message ID | 20210723112740.45962-1-laramglazier@gmail.com (mailing list archive) |
---|---|
State | New, archived |
Headers | show |
Series | target/i386: Added consistency checks for CR3 | expand |
On 23/07/21 13:27, Lara Lazier wrote: > All MBZ in CR3 must be zero (APM2 15.5) > Added checks in both helper_vmrun and helper_write_crN. > When EFER.LMA is zero the upper 32 bits needs to be zeroed. > > Signed-off-by: Lara Lazier <laramglazier@gmail.com> > --- > target/i386/tcg/sysemu/misc_helper.c | 7 +++++++ > target/i386/tcg/sysemu/svm_helper.c | 10 +++++++--- > 2 files changed, 14 insertions(+), 3 deletions(-) > > diff --git a/target/i386/tcg/sysemu/misc_helper.c b/target/i386/tcg/sysemu/misc_helper.c > index a2af2c9bba..d347af2a99 100644 > --- a/target/i386/tcg/sysemu/misc_helper.c > +++ b/target/i386/tcg/sysemu/misc_helper.c > @@ -96,6 +96,13 @@ void helper_write_crN(CPUX86State *env, int reg, target_ulong t0) > cpu_x86_update_cr0(env, t0); > break; > case 3: > + if ((env->efer & MSR_EFER_LMA) && > + (t0 & ((~0UL) << env_archcpu(env)->phys_bits))) { > + cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC()); > + } > + if (!(env->efer & MSR_EFER_LMA)) { > + t0 &= 0xffffffffUL; > + } > cpu_x86_update_cr3(env, t0); > break; > case 4: > diff --git a/target/i386/tcg/sysemu/svm_helper.c b/target/i386/tcg/sysemu/svm_helper.c > index 37dbe8e434..8b1ba53c64 100644 > --- a/target/i386/tcg/sysemu/svm_helper.c > +++ b/target/i386/tcg/sysemu/svm_helper.c > @@ -111,6 +111,7 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend) > uint32_t int_ctl; > uint32_t asid; > uint64_t new_cr0; > + uint64_t new_cr3; > uint64_t new_cr4; > > cpu_svm_check_intercept_param(env, SVM_EXIT_VMRUN, 0, GETPC()); > @@ -252,6 +253,11 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend) > if ((new_cr0 & CR0_NW_MASK) && !(new_cr0 & CR0_CD_MASK)) { > cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC()); > } > + new_cr3 = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.cr3)); > + if ((env->efer & MSR_EFER_LMA) && > + (new_cr3 & ((~0UL) << cpu->phys_bits))) { > + cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC()); > + } > new_cr4 = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.cr4)); > if (new_cr4 & cr4_reserved_bits(env)) { > cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC()); > @@ -262,9 +268,7 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend) > > cpu_x86_update_cr0(env, new_cr0); > cpu_x86_update_cr4(env, new_cr4); > - cpu_x86_update_cr3(env, x86_ldq_phys(cs, > - env->vm_vmcb + offsetof(struct vmcb, > - save.cr3))); > + cpu_x86_update_cr3(env, new_cr3); > env->cr[2] = x86_ldq_phys(cs, > env->vm_vmcb + offsetof(struct vmcb, save.cr2)); > int_ctl = x86_ldl_phys(cs, > Queued, thanks. Paolo
diff --git a/target/i386/tcg/sysemu/misc_helper.c b/target/i386/tcg/sysemu/misc_helper.c index a2af2c9bba..d347af2a99 100644 --- a/target/i386/tcg/sysemu/misc_helper.c +++ b/target/i386/tcg/sysemu/misc_helper.c @@ -96,6 +96,13 @@ void helper_write_crN(CPUX86State *env, int reg, target_ulong t0) cpu_x86_update_cr0(env, t0); break; case 3: + if ((env->efer & MSR_EFER_LMA) && + (t0 & ((~0UL) << env_archcpu(env)->phys_bits))) { + cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC()); + } + if (!(env->efer & MSR_EFER_LMA)) { + t0 &= 0xffffffffUL; + } cpu_x86_update_cr3(env, t0); break; case 4: diff --git a/target/i386/tcg/sysemu/svm_helper.c b/target/i386/tcg/sysemu/svm_helper.c index 37dbe8e434..8b1ba53c64 100644 --- a/target/i386/tcg/sysemu/svm_helper.c +++ b/target/i386/tcg/sysemu/svm_helper.c @@ -111,6 +111,7 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend) uint32_t int_ctl; uint32_t asid; uint64_t new_cr0; + uint64_t new_cr3; uint64_t new_cr4; cpu_svm_check_intercept_param(env, SVM_EXIT_VMRUN, 0, GETPC()); @@ -252,6 +253,11 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend) if ((new_cr0 & CR0_NW_MASK) && !(new_cr0 & CR0_CD_MASK)) { cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC()); } + new_cr3 = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.cr3)); + if ((env->efer & MSR_EFER_LMA) && + (new_cr3 & ((~0UL) << cpu->phys_bits))) { + cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC()); + } new_cr4 = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.cr4)); if (new_cr4 & cr4_reserved_bits(env)) { cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC()); @@ -262,9 +268,7 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend) cpu_x86_update_cr0(env, new_cr0); cpu_x86_update_cr4(env, new_cr4); - cpu_x86_update_cr3(env, x86_ldq_phys(cs, - env->vm_vmcb + offsetof(struct vmcb, - save.cr3))); + cpu_x86_update_cr3(env, new_cr3); env->cr[2] = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.cr2)); int_ctl = x86_ldl_phys(cs,
All MBZ in CR3 must be zero (APM2 15.5) Added checks in both helper_vmrun and helper_write_crN. When EFER.LMA is zero the upper 32 bits needs to be zeroed. Signed-off-by: Lara Lazier <laramglazier@gmail.com> --- target/i386/tcg/sysemu/misc_helper.c | 7 +++++++ target/i386/tcg/sysemu/svm_helper.c | 10 +++++++--- 2 files changed, 14 insertions(+), 3 deletions(-)