[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 2/9] target/i386: Added consistency checks for CR3
From: |
Paolo Bonzini |
Subject: |
[PULL 2/9] target/i386: Added consistency checks for CR3 |
Date: |
Sat, 24 Jul 2021 10:54:46 +0200 |
From: Lara Lazier <laramglazier@gmail.com>
All MBZ in CR3 must be zero (APM2 15.5)
Added checks in both helper_vmrun and helper_write_crN.
When EFER.LMA is zero the upper 32 bits needs to be zeroed.
Signed-off-by: Lara Lazier <laramglazier@gmail.com>
Message-Id: <20210723112740.45962-1-laramglazier@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
target/i386/tcg/sysemu/misc_helper.c | 7 +++++++
target/i386/tcg/sysemu/svm_helper.c | 10 +++++++---
2 files changed, 14 insertions(+), 3 deletions(-)
diff --git a/target/i386/tcg/sysemu/misc_helper.c
b/target/i386/tcg/sysemu/misc_helper.c
index a2af2c9bba..d347af2a99 100644
--- a/target/i386/tcg/sysemu/misc_helper.c
+++ b/target/i386/tcg/sysemu/misc_helper.c
@@ -96,6 +96,13 @@ void helper_write_crN(CPUX86State *env, int reg,
target_ulong t0)
cpu_x86_update_cr0(env, t0);
break;
case 3:
+ if ((env->efer & MSR_EFER_LMA) &&
+ (t0 & ((~0UL) << env_archcpu(env)->phys_bits))) {
+ cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
+ }
+ if (!(env->efer & MSR_EFER_LMA)) {
+ t0 &= 0xffffffffUL;
+ }
cpu_x86_update_cr3(env, t0);
break;
case 4:
diff --git a/target/i386/tcg/sysemu/svm_helper.c
b/target/i386/tcg/sysemu/svm_helper.c
index 4d64ec378e..145511d635 100644
--- a/target/i386/tcg/sysemu/svm_helper.c
+++ b/target/i386/tcg/sysemu/svm_helper.c
@@ -120,6 +120,7 @@ void helper_vmrun(CPUX86State *env, int aflag, int
next_eip_addend)
uint32_t int_ctl;
uint32_t asid;
uint64_t new_cr0;
+ uint64_t new_cr3;
uint64_t new_cr4;
cpu_svm_check_intercept_param(env, SVM_EXIT_VMRUN, 0, GETPC());
@@ -261,6 +262,11 @@ void helper_vmrun(CPUX86State *env, int aflag, int
next_eip_addend)
if ((new_cr0 & CR0_NW_MASK) && !(new_cr0 & CR0_CD_MASK)) {
cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
}
+ new_cr3 = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.cr3));
+ if ((env->efer & MSR_EFER_LMA) &&
+ (new_cr3 & ((~0UL) << cpu->phys_bits))) {
+ cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
+ }
new_cr4 = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.cr4));
if (new_cr4 & cr4_reserved_bits(env)) {
cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
@@ -271,9 +277,7 @@ void helper_vmrun(CPUX86State *env, int aflag, int
next_eip_addend)
cpu_x86_update_cr0(env, new_cr0);
cpu_x86_update_cr4(env, new_cr4);
- cpu_x86_update_cr3(env, x86_ldq_phys(cs,
- env->vm_vmcb + offsetof(struct vmcb,
- save.cr3)));
+ cpu_x86_update_cr3(env, new_cr3);
env->cr[2] = x86_ldq_phys(cs,
env->vm_vmcb + offsetof(struct vmcb, save.cr2));
int_ctl = x86_ldl_phys(cs,
--
2.31.1
- [PULL 0/9] Misc QEMU patches for 6.0-rc, Paolo Bonzini, 2021/07/24
- [PULL 1/9] meson: fix dependencies for modinfo #2, Paolo Bonzini, 2021/07/24
- [PULL 2/9] target/i386: Added consistency checks for CR3,
Paolo Bonzini <=
- [PULL 4/9] MAINTAINERS: Replace Eduardo as "Host Memory Backends" maintainer, Paolo Bonzini, 2021/07/24
- [PULL 9/9] qom: use correct field name when getting/setting alias properties, Paolo Bonzini, 2021/07/24
- [PULL 5/9] MAINTAINERS: Add Peter Xu and myself as co-maintainer of "Memory API", Paolo Bonzini, 2021/07/24
- [PULL 3/9] i386: do not call cpudef-only models functions for max, host, base, Paolo Bonzini, 2021/07/24
- [PULL 7/9] gitlab: only let pages be published from default branch, Paolo Bonzini, 2021/07/24
- [PULL 6/9] MAINTAINERS: Add memory_mapping.h and memory_mapping.c to "Memory API", Paolo Bonzini, 2021/07/24
- [PULL 8/9] qapi: introduce forwarding visitor, Paolo Bonzini, 2021/07/24
- Re: [PULL 0/9] Misc QEMU patches for 6.0-rc, Peter Maydell, 2021/07/24