* [PATCH] target/i386: Added consistency checks for CR3
@ 2021-07-23 11:27 Lara Lazier
2021-07-23 13:46 ` Paolo Bonzini
0 siblings, 1 reply; 2+ messages in thread
From: Lara Lazier @ 2021-07-23 11:27 UTC (permalink / raw)
To: qemu-devel; +Cc: Lara Lazier
All MBZ in CR3 must be zero (APM2 15.5)
Added checks in both helper_vmrun and helper_write_crN.
When EFER.LMA is zero the upper 32 bits needs to be zeroed.
Signed-off-by: Lara Lazier <laramglazier@gmail.com>
---
target/i386/tcg/sysemu/misc_helper.c | 7 +++++++
target/i386/tcg/sysemu/svm_helper.c | 10 +++++++---
2 files changed, 14 insertions(+), 3 deletions(-)
diff --git a/target/i386/tcg/sysemu/misc_helper.c b/target/i386/tcg/sysemu/misc_helper.c
index a2af2c9bba..d347af2a99 100644
--- a/target/i386/tcg/sysemu/misc_helper.c
+++ b/target/i386/tcg/sysemu/misc_helper.c
@@ -96,6 +96,13 @@ void helper_write_crN(CPUX86State *env, int reg, target_ulong t0)
cpu_x86_update_cr0(env, t0);
break;
case 3:
+ if ((env->efer & MSR_EFER_LMA) &&
+ (t0 & ((~0UL) << env_archcpu(env)->phys_bits))) {
+ cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
+ }
+ if (!(env->efer & MSR_EFER_LMA)) {
+ t0 &= 0xffffffffUL;
+ }
cpu_x86_update_cr3(env, t0);
break;
case 4:
diff --git a/target/i386/tcg/sysemu/svm_helper.c b/target/i386/tcg/sysemu/svm_helper.c
index 37dbe8e434..8b1ba53c64 100644
--- a/target/i386/tcg/sysemu/svm_helper.c
+++ b/target/i386/tcg/sysemu/svm_helper.c
@@ -111,6 +111,7 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
uint32_t int_ctl;
uint32_t asid;
uint64_t new_cr0;
+ uint64_t new_cr3;
uint64_t new_cr4;
cpu_svm_check_intercept_param(env, SVM_EXIT_VMRUN, 0, GETPC());
@@ -252,6 +253,11 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
if ((new_cr0 & CR0_NW_MASK) && !(new_cr0 & CR0_CD_MASK)) {
cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
}
+ new_cr3 = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.cr3));
+ if ((env->efer & MSR_EFER_LMA) &&
+ (new_cr3 & ((~0UL) << cpu->phys_bits))) {
+ cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
+ }
new_cr4 = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.cr4));
if (new_cr4 & cr4_reserved_bits(env)) {
cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
@@ -262,9 +268,7 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
cpu_x86_update_cr0(env, new_cr0);
cpu_x86_update_cr4(env, new_cr4);
- cpu_x86_update_cr3(env, x86_ldq_phys(cs,
- env->vm_vmcb + offsetof(struct vmcb,
- save.cr3)));
+ cpu_x86_update_cr3(env, new_cr3);
env->cr[2] = x86_ldq_phys(cs,
env->vm_vmcb + offsetof(struct vmcb, save.cr2));
int_ctl = x86_ldl_phys(cs,
--
2.25.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] target/i386: Added consistency checks for CR3
2021-07-23 11:27 [PATCH] target/i386: Added consistency checks for CR3 Lara Lazier
@ 2021-07-23 13:46 ` Paolo Bonzini
0 siblings, 0 replies; 2+ messages in thread
From: Paolo Bonzini @ 2021-07-23 13:46 UTC (permalink / raw)
To: Lara Lazier, qemu-devel
On 23/07/21 13:27, Lara Lazier wrote:
> All MBZ in CR3 must be zero (APM2 15.5)
> Added checks in both helper_vmrun and helper_write_crN.
> When EFER.LMA is zero the upper 32 bits needs to be zeroed.
>
> Signed-off-by: Lara Lazier <laramglazier@gmail.com>
> ---
> target/i386/tcg/sysemu/misc_helper.c | 7 +++++++
> target/i386/tcg/sysemu/svm_helper.c | 10 +++++++---
> 2 files changed, 14 insertions(+), 3 deletions(-)
>
> diff --git a/target/i386/tcg/sysemu/misc_helper.c b/target/i386/tcg/sysemu/misc_helper.c
> index a2af2c9bba..d347af2a99 100644
> --- a/target/i386/tcg/sysemu/misc_helper.c
> +++ b/target/i386/tcg/sysemu/misc_helper.c
> @@ -96,6 +96,13 @@ void helper_write_crN(CPUX86State *env, int reg, target_ulong t0)
> cpu_x86_update_cr0(env, t0);
> break;
> case 3:
> + if ((env->efer & MSR_EFER_LMA) &&
> + (t0 & ((~0UL) << env_archcpu(env)->phys_bits))) {
> + cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
> + }
> + if (!(env->efer & MSR_EFER_LMA)) {
> + t0 &= 0xffffffffUL;
> + }
> cpu_x86_update_cr3(env, t0);
> break;
> case 4:
> diff --git a/target/i386/tcg/sysemu/svm_helper.c b/target/i386/tcg/sysemu/svm_helper.c
> index 37dbe8e434..8b1ba53c64 100644
> --- a/target/i386/tcg/sysemu/svm_helper.c
> +++ b/target/i386/tcg/sysemu/svm_helper.c
> @@ -111,6 +111,7 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
> uint32_t int_ctl;
> uint32_t asid;
> uint64_t new_cr0;
> + uint64_t new_cr3;
> uint64_t new_cr4;
>
> cpu_svm_check_intercept_param(env, SVM_EXIT_VMRUN, 0, GETPC());
> @@ -252,6 +253,11 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
> if ((new_cr0 & CR0_NW_MASK) && !(new_cr0 & CR0_CD_MASK)) {
> cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
> }
> + new_cr3 = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.cr3));
> + if ((env->efer & MSR_EFER_LMA) &&
> + (new_cr3 & ((~0UL) << cpu->phys_bits))) {
> + cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
> + }
> new_cr4 = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.cr4));
> if (new_cr4 & cr4_reserved_bits(env)) {
> cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
> @@ -262,9 +268,7 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
>
> cpu_x86_update_cr0(env, new_cr0);
> cpu_x86_update_cr4(env, new_cr4);
> - cpu_x86_update_cr3(env, x86_ldq_phys(cs,
> - env->vm_vmcb + offsetof(struct vmcb,
> - save.cr3)));
> + cpu_x86_update_cr3(env, new_cr3);
> env->cr[2] = x86_ldq_phys(cs,
> env->vm_vmcb + offsetof(struct vmcb, save.cr2));
> int_ctl = x86_ldl_phys(cs,
>
Queued, thanks.
Paolo
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-07-23 13:48 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-07-23 11:27 [PATCH] target/i386: Added consistency checks for CR3 Lara Lazier
2021-07-23 13:46 ` Paolo Bonzini
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.