From patchwork Mon Jul 5 08:17:59 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lara Lazier X-Patchwork-Id: 12358387 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 93573C07E9B for ; Mon, 5 Jul 2021 08:20:13 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 53627613F1 for ; Mon, 5 Jul 2021 08:20:13 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 53627613F1 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Received: from localhost ([::1]:37810 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1m0Jps-0008Jq-CU for qemu-devel@archiver.kernel.org; Mon, 05 Jul 2021 04:20:12 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:42088) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1m0Jo2-0006LZ-7t for qemu-devel@nongnu.org; Mon, 05 Jul 2021 04:18:18 -0400 Received: from mail-wr1-x42b.google.com ([2a00:1450:4864:20::42b]:44951) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1m0Jnx-0005a2-7n for qemu-devel@nongnu.org; Mon, 05 Jul 2021 04:18:17 -0400 Received: by mail-wr1-x42b.google.com with SMTP id t15so17618829wry.11 for ; Mon, 05 Jul 2021 01:18:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=Jc5fRlM98XeH9zkOM8OwG3gCInHFoUKjTnZ/ZTtg08s=; b=CY2TFHGaKIYuvky/Hjo+BhsWWoLUBXjHW5LHoNBOSTINEEF3HzjywrRZzSQ8BPZgFM HQrtphK2rPff8YyzH4iH3m2rj9TuL0Pd1mIToAm1BOS9iCmPzzyzawsenfwlN3SDIlzq RZgKL7tVxzYUOwmRei4+vKtanW1H6svh4YeGwJj4IH4q74S1o3DvX18d6AwXGqKD5/o2 lhLJBgZkIvFl2T0GfkeM0PMzDRwqQoXAiNgmaS6W01zXDKKuUEOomhGfub3Q7HIQN+E9 8rKBfuk4yr/LK8PEXP82MBgV51+fipHrWdwLD70v3AnpE0z7tFydGZ2ulq3rE+FTmDCa x64g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=Jc5fRlM98XeH9zkOM8OwG3gCInHFoUKjTnZ/ZTtg08s=; b=l+VqBmxh2sU4eZTLNKu47pYlJlbtUQKpDYS8TaSN58RPx8DTEx9MqMJKDuMGa84F2f m67mZxC84/O58DxaxHYKXJ99PBQDKScTr0q6y+ir/H33S0Fphj99FYVzYOiOvqhvRJgQ dIbDF5sn3yBvXzNetvT29t2FQNLENlcN7zGfgWjZuW6anoprDIFhShgpMl1lsp+aro8f xXNxOJOHUrxGhZVEh3jyg059dVG5qq4pGWt5DsewOpXLNcqzC+u6CNdpDxMbGDHx752t BRvrpgYCa/Dvs75FkcCo+279Y9dgachcoVkvSeW2uyVLiayvmMbOrU5bqz+tDVBaNGmV EIXg== X-Gm-Message-State: AOAM5320+eyVV2i5vEPZHvD3WoqO863Ya3xJArK6UTfDYFez1TuCOa6R QAkyHUpGRmPDhBjqxbEl/YjEjhB+g6mrGg== X-Google-Smtp-Source: ABdhPJzgNSw7BFxzDNVwAlGSY8B94KxkaSwZ6hKteD2ENThmw9dalU5G3aJGrvmF3WFIGz9wXGRzFw== X-Received: by 2002:adf:d212:: with SMTP id j18mr14363300wrh.150.1625473091558; Mon, 05 Jul 2021 01:18:11 -0700 (PDT) Received: from localhost.localdomain ([37.160.151.142]) by smtp.gmail.com with ESMTPSA id n5sm3662014wri.31.2021.07.05.01.18.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 05 Jul 2021 01:18:11 -0700 (PDT) From: Lara Lazier To: qemu-devel@nongnu.org Subject: [PATCH 1/4] target/i386: Added MSRPM and IOPM size check Date: Mon, 5 Jul 2021 10:17:59 +0200 Message-Id: <20210705081802.18960-2-laramglazier@gmail.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210705081802.18960-1-laramglazier@gmail.com> References: <20210705081802.18960-1-laramglazier@gmail.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::42b; envelope-from=laramglazier@gmail.com; helo=mail-wr1-x42b.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Lara Lazier Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: "Qemu-devel" The address of the last entry in the MSRPM and in the IOPM must be smaller than the largest physical address. (APM2 15.10-15.11) Signed-off-by: Lara Lazier --- target/i386/svm.h | 3 +++ target/i386/tcg/sysemu/svm_helper.c | 15 +++++++++++++++ 2 files changed, 18 insertions(+) diff --git a/target/i386/svm.h b/target/i386/svm.h index 5098733053..adc058dc76 100644 --- a/target/i386/svm.h +++ b/target/i386/svm.h @@ -137,6 +137,9 @@ #define SVM_CR0_RESERVED_MASK 0xffffffff00000000U +#define SVM_MSRPM_SIZE (1ULL << 13) +#define SVM_IOPM_SIZE ((1ULL << 13) + 1) + struct QEMU_PACKED vmcb_control_area { uint16_t intercept_cr_read; uint16_t intercept_cr_write; diff --git a/target/i386/tcg/sysemu/svm_helper.c b/target/i386/tcg/sysemu/svm_helper.c index 1c2dbc1862..fa701829e5 100644 --- a/target/i386/tcg/sysemu/svm_helper.c +++ b/target/i386/tcg/sysemu/svm_helper.c @@ -68,6 +68,7 @@ static inline void svm_load_seg_cache(CPUX86State *env, hwaddr addr, void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend) { CPUState *cs = env_cpu(env); + X86CPU *cpu = env_archcpu(env); target_ulong addr; uint64_t nested_ctl; uint32_t event_inj; @@ -159,6 +160,20 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend) asid = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, control.asid)); + uint64_t msrpm_base_pa = x86_ldq_phys(cs, env->vm_vmcb + + offsetof(struct vmcb, + control.msrpm_base_pa)); + uint64_t iopm_base_pa = x86_ldq_phys(cs, env->vm_vmcb + + offsetof(struct vmcb, control.iopm_base_pa)); + + if ((msrpm_base_pa & ~0xfff) >= (1ull << cpu->phys_bits) - SVM_MSRPM_SIZE) { + cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC()); + } + + if ((iopm_base_pa & ~0xfff) >= (1ull << cpu->phys_bits) - SVM_IOPM_SIZE) { + cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC()); + } + env->nested_pg_mode = 0; if (!cpu_svm_has_intercept(env, SVM_EXIT_VMRUN)) { From patchwork Mon Jul 5 08:18:00 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lara Lazier X-Patchwork-Id: 12358393 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E052CC07E99 for ; Mon, 5 Jul 2021 08:21:53 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 7F6926128B for ; Mon, 5 Jul 2021 08:21:53 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 7F6926128B Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Received: from localhost ([::1]:44496 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1m0JrU-0004N6-NP for qemu-devel@archiver.kernel.org; Mon, 05 Jul 2021 04:21:52 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:42132) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1m0Jo3-0006MB-Gg for qemu-devel@nongnu.org; Mon, 05 Jul 2021 04:18:19 -0400 Received: from mail-wr1-x431.google.com ([2a00:1450:4864:20::431]:35649) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1m0Jnx-0005aD-L9 for qemu-devel@nongnu.org; Mon, 05 Jul 2021 04:18:19 -0400 Received: by mail-wr1-x431.google.com with SMTP id q17so581971wrv.2 for ; Mon, 05 Jul 2021 01:18:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=9rX6VYMglzE9aU5pqhCydIFjlto7XWPVqNewVGr+9vs=; b=j0oRCrm8kgkwA3ux68uvEDgfthW0hNyyMSYb90ubDWvn5w05F5Nus+Gze8ZAFwE1B+ SdQ9MseI3LH7wfcSYbm/1VBUbIKC6Xz+8MrjZkV2mI+QMjoX3SJqBamq9GMzZW/IPTGy ZRhYnjsJ8SqdhQ0oDlkKL4syfmDH4KxSyK1eLcC85fhivu8vkLkYHWkPMS+IlQ854p96 4bvduKpLzrFf7M2ezWAfcYvEqR7KBc2UD4THT9z+3fPk4yvF+sVjifyYElEMk24dPMLm OPASZ6YK00RHdoTKN2Fl1cP0FdR95TdfQVPw1WocBJBRVoPQJADTVHjrvh+9NfUTXODu Z/JA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=9rX6VYMglzE9aU5pqhCydIFjlto7XWPVqNewVGr+9vs=; b=qIWyY1PLtoNFJDBHiJ5zcHNGHWq3Ibuv2MwN/3re4tyO8bJKUl1x5V9+h/V46TM77C YG68EzHzwOPOwSfHCHj5rNZ0Au9p92+4QLxVTS5A5SPs1IIoR5GizcT/sU95r3QcWN36 gpHL1Ue38kg68JFTlrSBkFJtYegy0SlxdG8vf+sIy6lBeAgyUHKGJxlJJIw/LVlFnQEN kkB0ZeVRRtsvwfjFmxc6o7f+GMwH6cOtr0DNYGtl3X0sPm5usVBNJAF/AkTaIiM9Vkqg GZD9cH/RIsm439dBmzlujskdZoqQ0pLdAo0oL1sEVnjC09fw7KystHlMQGV6+pYM3eC+ kI1w== X-Gm-Message-State: AOAM5309nnumwuHCBu7oDbj3UcN/IcToCMzAPfkSiq2eEaFpfffEENDI QleXJiRoZgAsIWM3R+5VZPxhzvrfInSkHQ== X-Google-Smtp-Source: ABdhPJwQW1IXt8okYkRVlw2/FMYZvYFpwHVft3BBPAanTbqpu7NR1yAQxrUsHHzzUnTew5BIQKRpVg== X-Received: by 2002:a5d:64a1:: with SMTP id m1mr8735884wrp.210.1625473092475; Mon, 05 Jul 2021 01:18:12 -0700 (PDT) Received: from localhost.localdomain ([37.160.151.142]) by smtp.gmail.com with ESMTPSA id n5sm3662014wri.31.2021.07.05.01.18.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 05 Jul 2021 01:18:12 -0700 (PDT) From: Lara Lazier To: qemu-devel@nongnu.org Subject: [PATCH 2/4] target/i386: Added DR6 and DR7 consistency checks Date: Mon, 5 Jul 2021 10:18:00 +0200 Message-Id: <20210705081802.18960-3-laramglazier@gmail.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210705081802.18960-1-laramglazier@gmail.com> References: <20210705081802.18960-1-laramglazier@gmail.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::431; envelope-from=laramglazier@gmail.com; helo=mail-wr1-x431.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Lara Lazier Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: "Qemu-devel" DR6[63:32] and DR7[63:32] are reserved and need to be zero. (AMD64 Architecture Programmer's Manual, V2, 15.5) Signed-off-by: Lara Lazier --- target/i386/svm.h | 2 ++ target/i386/tcg/sysemu/svm_helper.c | 8 +++++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/target/i386/svm.h b/target/i386/svm.h index adc058dc76..e54670ef12 100644 --- a/target/i386/svm.h +++ b/target/i386/svm.h @@ -140,6 +140,8 @@ #define SVM_MSRPM_SIZE (1ULL << 13) #define SVM_IOPM_SIZE ((1ULL << 13) + 1) +#define SVM_DR_RESERVED_MASK 0xffffffff00000000U + struct QEMU_PACKED vmcb_control_area { uint16_t intercept_cr_read; uint16_t intercept_cr_write; diff --git a/target/i386/tcg/sysemu/svm_helper.c b/target/i386/tcg/sysemu/svm_helper.c index fa701829e5..276c240f70 100644 --- a/target/i386/tcg/sysemu/svm_helper.c +++ b/target/i386/tcg/sysemu/svm_helper.c @@ -269,7 +269,13 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend) env->dr[6] = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.dr6)); - /* FIXME: guest state consistency checks */ + if (env->dr[6] & SVM_DR_RESERVED_MASK) { + cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC()); + } + + if (env->dr[7] & SVM_DR_RESERVED_MASK) { + cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC()); + } switch (x86_ldub_phys(cs, env->vm_vmcb + offsetof(struct vmcb, control.tlb_ctl))) { From patchwork Mon Jul 5 08:18:01 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lara Lazier X-Patchwork-Id: 12358457 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 85AD1C07E98 for ; Mon, 5 Jul 2021 08:23:47 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 4D73F613C8 for ; Mon, 5 Jul 2021 08:23:47 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 4D73F613C8 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Received: from localhost ([::1]:48842 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1m0JtK-0007Gi-Hb for qemu-devel@archiver.kernel.org; Mon, 05 Jul 2021 04:23:46 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:42140) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1m0Jo5-0006Pm-N9 for qemu-devel@nongnu.org; Mon, 05 Jul 2021 04:18:21 -0400 Received: from mail-wr1-x42c.google.com ([2a00:1450:4864:20::42c]:33607) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1m0Jo1-0005aU-KX for qemu-devel@nongnu.org; Mon, 05 Jul 2021 04:18:21 -0400 Received: by mail-wr1-x42c.google.com with SMTP id i8so21047940wrc.0 for ; Mon, 05 Jul 2021 01:18:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=r9h3lRGJRSnBCO7X87sinEBUmp1Vgja7lYk6khReouQ=; b=m7DEWrFTKlh//REaf6leq3ohfQgcRo+1LGmhazN3WXcizNcIO1a8ZGeLdUjkGlQoQT hPpGekZt2XXDB/kfAd3Pqw/4iSr8YPE94Ch2pCB1CZ0x8DheLfT1wTNpdMNpYio8XOGA emT9g/Rp3rjfLJSSrovBGkJOELKYYfGBn7uJNFDRmjTXXCClhzxbAxWNMEspNaK48JOV fTIKu4SEP1xsE2VJKNUN+Q27Nh25BqDQykXCAY1VcO0/2X1UzYMJP7RcgHSCmfOTiX6V xHyxWUwPwxORRUwP+c3z3TwORX7gEU0cfNymNBBBR1dLafeypNpKQ07TxSGgjnHUihDB G2AA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=r9h3lRGJRSnBCO7X87sinEBUmp1Vgja7lYk6khReouQ=; b=V0AFsvfd3cRcIL8zqx/uABQVwvDHrIOSThJAEQHQUuFXGbqTCxICkQIdYWS4kfesmz 7m/k0z1ZZZTk5+piPSMYLBFfPHq7R/PYujmA8TpjIl8W56+Ijv9GMutbhs1phce28w05 y+WpqEeOXaBP9SY8qFUblIvN4fo81ikwUQnfHLUw8dthd+53yF0P2ANyqWhYAHtQLwHf 1Jwdsjiav5HM3HrRSaiIRKUM5zoS2nX+V2aAOvm9jWmMYX4BeCMcdHuNqWNjOhpX2puv owRspmdbQlp25Q7Ujm/ed0LOp3ws/sMDJpTrAWNhmv8n3ZiyxiayS4X/gGlqDcQc+vAt AXdQ== X-Gm-Message-State: AOAM533N3hOwgVZ+Q6AP8t2e3Z93x+lA0nbIIM1Epryx9s8e3P0GTcJC GBEhAzX2d2EZEqMR3y61O6pTDpVKnKqJtw== X-Google-Smtp-Source: ABdhPJwZbtjM6H8ftbjFyfJrLG8aU4bYktPsd8TTRMOnnZD7Djr8NysuwFWhnznEQhEyTMEU0r/Rmw== X-Received: by 2002:adf:d232:: with SMTP id k18mr3378317wrh.35.1625473093187; Mon, 05 Jul 2021 01:18:13 -0700 (PDT) Received: from localhost.localdomain ([37.160.151.142]) by smtp.gmail.com with ESMTPSA id n5sm3662014wri.31.2021.07.05.01.18.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 05 Jul 2021 01:18:12 -0700 (PDT) From: Lara Lazier To: qemu-devel@nongnu.org Subject: [PATCH 3/4] target/i386: Added consistency checks for EFER Date: Mon, 5 Jul 2021 10:18:01 +0200 Message-Id: <20210705081802.18960-4-laramglazier@gmail.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210705081802.18960-1-laramglazier@gmail.com> References: <20210705081802.18960-1-laramglazier@gmail.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::42c; envelope-from=laramglazier@gmail.com; helo=mail-wr1-x42c.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Lara Lazier Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: "Qemu-devel" EFER.SVME has to be set, and EFER[63:16], EFER[9], EFER[7:5] are reserved and must be zero. In Addition the combinations * EFER.LMA or EFER.LME is non-zero and the processor does not support LM * non-zero EFER.LME and CR0.PG and zero CR4.PAE * non-zero EFER.LME and CR0.PG and zero CR0.PE * non-zero EFER.LME, CR0.PG, CR4.PAE, CS.L and CS.D are all invalid. (AMD64 Architecture Programmer's Manual, V2, 15.5) Signed-off-by: Lara Lazier --- target/i386/cpu.h | 2 ++ target/i386/tcg/sysemu/svm_helper.c | 39 +++++++++++++++++++++++++++++ 2 files changed, 41 insertions(+) diff --git a/target/i386/cpu.h b/target/i386/cpu.h index f7fa5870b1..f5280b2951 100644 --- a/target/i386/cpu.h +++ b/target/i386/cpu.h @@ -464,6 +464,8 @@ typedef enum X86Seg { #define MSR_EFER_SVME (1 << 12) #define MSR_EFER_FFXSR (1 << 14) +#define MSR_EFER_RESERVED 0xffffffffffff02e0 + #define MSR_STAR 0xc0000081 #define MSR_LSTAR 0xc0000082 #define MSR_CSTAR 0xc0000083 diff --git a/target/i386/tcg/sysemu/svm_helper.c b/target/i386/tcg/sysemu/svm_helper.c index 276c240f70..d652d6f9da 100644 --- a/target/i386/tcg/sysemu/svm_helper.c +++ b/target/i386/tcg/sysemu/svm_helper.c @@ -65,6 +65,41 @@ static inline void svm_load_seg_cache(CPUX86State *env, hwaddr addr, sc->base, sc->limit, sc->flags); } +static inline bool is_efer_invalid_state (CPUX86State *env) +{ + if (!(env->efer & MSR_EFER_SVME)) { + return true; + } + + if (env->efer & MSR_EFER_RESERVED) { + return true; + } + + if ((env->efer & (MSR_EFER_LMA | MSR_EFER_LME)) && + !(env->features[FEAT_8000_0001_EDX] & CPUID_EXT2_LM)) { + return true; + } + + if ((env->efer & MSR_EFER_LME) && (env->cr[0] & CR0_PG_MASK) + && !(env->cr[4] & CR4_PAE_MASK)) { + return true; + } + + if ((env->efer & MSR_EFER_LME) && (env->cr[0] & CR0_PG_MASK) + && !(env->cr[0] & CR0_PE_MASK)) { + return true; + } + + if ((env->efer & MSR_EFER_LME) && (env->cr[0] & CR0_PG_MASK) + && (env->cr[4] & CR4_PAE_MASK) + && (env->segs[R_CS].flags & DESC_L_MASK) + && (env->segs[R_CS].flags & DESC_B_MASK)) { + return true; + } + + return false; +} + void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend) { CPUState *cs = env_cpu(env); @@ -277,6 +312,10 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend) cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC()); } + if (is_efer_invalid_state(env)) { + cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC()); + } + switch (x86_ldub_phys(cs, env->vm_vmcb + offsetof(struct vmcb, control.tlb_ctl))) { case TLB_CONTROL_DO_NOTHING: From patchwork Mon Jul 5 08:18:02 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lara Lazier X-Patchwork-Id: 12358391 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E1F02C07E98 for ; Mon, 5 Jul 2021 08:20:21 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 427036128B for ; Mon, 5 Jul 2021 08:20:21 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 427036128B Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Received: from localhost ([::1]:38200 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1m0Jq0-00008w-9Y for qemu-devel@archiver.kernel.org; Mon, 05 Jul 2021 04:20:20 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:42136) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1m0Jo3-0006MK-Vp for qemu-devel@nongnu.org; Mon, 05 Jul 2021 04:18:19 -0400 Received: from mail-wm1-x335.google.com ([2a00:1450:4864:20::335]:54879) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1m0Jo1-0005b7-Km for qemu-devel@nongnu.org; Mon, 05 Jul 2021 04:18:19 -0400 Received: by mail-wm1-x335.google.com with SMTP id l1so10770809wme.4 for ; Mon, 05 Jul 2021 01:18:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=7CagZ6K0MtLBhw9uGydgN1M2pP4f5ZiE6fG19o2njqY=; b=NbQ8wvkabs9XB6xoLDTm8i7ghhDY5ZcyuN3/NGELh8oHsNbj8d8bWjYLxXYOqZUPtS niZ59s9cyOnZRhPEZeZCp/xQ2xKdqrwSiQ4lMVkUj6OdQM3/APbW/S5BAe+vNqO2Z8tx smu7enfhcTQ6K628ILgg663y4CO7cLNlj2+BOPP8TK+syIztQiYbuSWUpQt3Xtd7WXpR fSZdoCgo6vNeIQyycgHMxJWuj01mo6/L5Pu96nHd8P/rDgkbIcKSRzKL+TdbG8alYwlB NWF8oAOLrX45ANws7DLSGU/ksL2VqufpqEJnkK6chvaRRJ+53rbpVxO2Vh3N5L7p5NQ2 JWSA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=7CagZ6K0MtLBhw9uGydgN1M2pP4f5ZiE6fG19o2njqY=; b=i9C1Okt7346k30dARwf952ZBfZy/up69x6YOd1SgBuJdNoDJJwRFxBk/+o3oeZhwYK f7bsqi9cAJ9mCNx4Bmuh0gTmzZdyd+TOKCJL0Ks4yQKmp+mSeUntju+3ZQOh78WmOFsT zsjUUVbCZgkF+noKWVyMzzJCAJocLUR+KM5a5LFlPDxdHaq8MT6a+d57EVzkKe+kS/wj yQEC96BkMIpm8nxgeO9Pk4UApPgbXhe5B3eN5lNMm28oVbKBjoBCdn3onM0w28Tei3NJ IIekGtW/gyTpUA62p1rLPjL8OZMFIKr4tdEQ9FpWYqZemjnaWzenPd02W0M5GbB4madN oV+w== X-Gm-Message-State: AOAM531tMiqm/Y4JT4frlIkHteTHtOGSM4cGP8DybHS5dT0SriIQdX7f 9EqqfEDZ4iopd7orpW2UqSAh+XV6hylfxw== X-Google-Smtp-Source: ABdhPJy3AUkJEGKs/Ff0dCD8GQm6lemYD4gmGmGRWfNAQNpcsEeSKM1DqVlYYzRqxUgE5mqFM+l47A== X-Received: by 2002:a05:600c:4ba9:: with SMTP id e41mr13505991wmp.72.1625473093956; Mon, 05 Jul 2021 01:18:13 -0700 (PDT) Received: from localhost.localdomain ([37.160.151.142]) by smtp.gmail.com with ESMTPSA id n5sm3662014wri.31.2021.07.05.01.18.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 05 Jul 2021 01:18:13 -0700 (PDT) From: Lara Lazier To: qemu-devel@nongnu.org Subject: [PATCH 4/4] target/i386: Added VMRUN consistency checks for CR3 and CR4 Date: Mon, 5 Jul 2021 10:18:02 +0200 Message-Id: <20210705081802.18960-5-laramglazier@gmail.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210705081802.18960-1-laramglazier@gmail.com> References: <20210705081802.18960-1-laramglazier@gmail.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::335; envelope-from=laramglazier@gmail.com; helo=mail-wm1-x335.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Lara Lazier Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: "Qemu-devel" All MBZ bits in CR3 and CR4 must be zero. (APM2 15.5) Added reserved bitmask for CR4 and added checks in both helper_vmrun and helper_write_crN. Signed-off-by: Lara Lazier --- target/i386/cpu.h | 29 ++++++++++++++++++++++++++++ target/i386/tcg/sysemu/misc_helper.c | 6 ++++++ target/i386/tcg/sysemu/svm_helper.c | 18 +++++++++++------ 3 files changed, 47 insertions(+), 6 deletions(-) diff --git a/target/i386/cpu.h b/target/i386/cpu.h index f5280b2951..0368551a66 100644 --- a/target/i386/cpu.h +++ b/target/i386/cpu.h @@ -240,6 +240,7 @@ typedef enum X86Seg { #define CR4_OSFXSR_SHIFT 9 #define CR4_OSFXSR_MASK (1U << CR4_OSFXSR_SHIFT) #define CR4_OSXMMEXCPT_MASK (1U << 10) +#define CR4_UMIP_MASK (1U << 11) #define CR4_LA57_MASK (1U << 12) #define CR4_VMXE_MASK (1U << 13) #define CR4_SMXE_MASK (1U << 14) @@ -251,6 +252,34 @@ typedef enum X86Seg { #define CR4_PKE_MASK (1U << 22) #define CR4_PKS_MASK (1U << 24) +#define CR4_RESERVED_MASK \ +(~(unsigned long)(CR4_VME_MASK | CR4_PVI_MASK | CR4_TSD_MASK \ + | CR4_DE_MASK | CR4_PSE_MASK | CR4_PAE_MASK \ + | CR4_MCE_MASK | CR4_PGE_MASK | CR4_PCE_MASK \ + | CR4_OSFXSR_MASK | CR4_OSXMMEXCPT_MASK |CR4_UMIP_MASK \ + | CR4_FSGSBASE_MASK | CR4_PCIDE_MASK | CR4_OSXSAVE_MASK \ + | CR4_SMEP_MASK | CR4_SMAP_MASK | CR4_PKE_MASK)) + +#define cr4_reserved_bits(env) \ +({ \ + uint64_t __reserved_bits = CR4_RESERVED_MASK; \ + if (!env->features[FEAT_XSAVE]) \ + __reserved_bits |= CR4_OSXSAVE_MASK; \ + if (!(env->features[FEAT_7_0_EBX] & CPUID_7_0_EBX_SMEP)) \ + __reserved_bits |= CR4_SMEP_MASK; \ + if (!(env->features[FEAT_7_0_EBX] & CPUID_7_0_EBX_SMAP)) \ + __reserved_bits |= CR4_SMAP_MASK; \ + if (!(env->features[FEAT_7_0_EBX] & CPUID_7_0_EBX_FSGSBASE)) \ + __reserved_bits |= CR4_FSGSBASE_MASK; \ + if (!(env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_PKU)) \ + __reserved_bits |= CR4_PKE_MASK; \ + if (!(env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_LA57)) \ + __reserved_bits |= CR4_LA57_MASK; \ + if (!(env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_UMIP)) \ + __reserved_bits |= CR4_UMIP_MASK; \ + __reserved_bits; \ +}) + #define DR6_BD (1 << 13) #define DR6_BS (1 << 14) #define DR6_BT (1 << 15) diff --git a/target/i386/tcg/sysemu/misc_helper.c b/target/i386/tcg/sysemu/misc_helper.c index db0d8a9d79..cdb4826987 100644 --- a/target/i386/tcg/sysemu/misc_helper.c +++ b/target/i386/tcg/sysemu/misc_helper.c @@ -96,9 +96,15 @@ void helper_write_crN(CPUX86State *env, int reg, target_ulong t0) cpu_x86_update_cr0(env, t0); break; case 3: + if (t0 & ((~0UL) << env_archcpu(env)->phys_bits)) { + cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC()); + } cpu_x86_update_cr3(env, t0); break; case 4: + if (t0 & cr4_reserved_bits(env)) { + cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC()); + } if (((t0 ^ env->cr[4]) & CR4_LA57_MASK) && (env->hflags & HF_CS64_MASK)) { raise_exception_ra(env, EXCP0D_GPF, GETPC()); diff --git a/target/i386/tcg/sysemu/svm_helper.c b/target/i386/tcg/sysemu/svm_helper.c index d652d6f9da..e3a4fa74d2 100644 --- a/target/i386/tcg/sysemu/svm_helper.c +++ b/target/i386/tcg/sysemu/svm_helper.c @@ -110,6 +110,8 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend) uint32_t int_ctl; uint32_t asid; uint64_t new_cr0; + uint64_t new_cr3; + uint64_t new_cr4; cpu_svm_check_intercept_param(env, SVM_EXIT_VMRUN, 0, GETPC()); @@ -250,17 +252,21 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend) if ((new_cr0 & CR0_NW_MASK) && !(new_cr0 & CR0_CD_MASK)) { cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC()); } + new_cr3 = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.cr3)); + if (new_cr3 & ((~0UL) << cpu->phys_bits)) { + cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC()); + } + new_cr4 = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.cr4)); + if (new_cr4 & cr4_reserved_bits(env)) { + cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC()); + } /* clear exit_info_2 so we behave like the real hardware */ x86_stq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2), 0); cpu_x86_update_cr0(env, new_cr0); - cpu_x86_update_cr4(env, x86_ldq_phys(cs, - env->vm_vmcb + offsetof(struct vmcb, - save.cr4))); - cpu_x86_update_cr3(env, x86_ldq_phys(cs, - env->vm_vmcb + offsetof(struct vmcb, - save.cr3))); + cpu_x86_update_cr4(env, new_cr4); + cpu_x86_update_cr3(env, new_cr3); env->cr[2] = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.cr2)); int_ctl = x86_ldl_phys(cs,