Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d99e4152 authored by Gleb Natapov's avatar Gleb Natapov Committed by Marcelo Tosatti
Browse files

KVM: VMX: fix emulation of invalid guest state. 



Currently when emulation of invalid guest state is enable
(emulate_invalid_guest_state=1) segment registers are still fixed for
entry to vm86 mode some times. Segment register fixing is avoided in
enter_rmode(), but vmx_set_segment() still does it unconditionally.
The patch fixes it.

Signed-off-by: default avatarGleb Natapov <gleb@redhat.com>
Signed-off-by: default avatarMarcelo Tosatti <mtosatti@redhat.com>
parent 89efbed0

arch/x86/kvm/vmx.c

+68 −54
Original line number Diff line number Diff line
@@ -624,6 +624,8 @@ static void vmx_set_segment(struct kvm_vcpu *vcpu, 
			    struct kvm_segment *var, int seg);

static void vmx_get_segment(struct kvm_vcpu *vcpu,

			    struct kvm_segment *var, int seg);

static bool guest_state_valid(struct kvm_vcpu *vcpu);

static u32 vmx_segment_access_rights(struct kvm_segment *var);



static DEFINE_PER_CPU(struct vmcs *, vmxarea);

static DEFINE_PER_CPU(struct vmcs *, current_vmcs);
@@ -2758,18 +2760,23 @@ static __exit void hardware_unsetup(void) 
	free_kvm_area();

}



static void fix_pmode_dataseg(struct kvm_vcpu *vcpu, int seg, struct kvm_segment *save)

static void fix_pmode_dataseg(struct kvm_vcpu *vcpu, int seg,

		struct kvm_segment *save)

{

	const struct kvm_vmx_segment_field *sf = &kvm_vmx_segment_fields[seg];

	struct kvm_segment tmp = *save;



	if (!(vmcs_readl(sf->base) == tmp.base && tmp.s)) {

		tmp.base = vmcs_readl(sf->base);

		tmp.selector = vmcs_read16(sf->selector);

		tmp.dpl = tmp.selector & SELECTOR_RPL_MASK;

		tmp.s = 1;

	if (!emulate_invalid_guest_state) {

		/*

		 * CS and SS RPL should be equal during guest entry according

		 * to VMX spec, but in reality it is not always so. Since vcpu

		 * is in the middle of the transition from real mode to

		 * protected mode it is safe to assume that RPL 0 is a good

		 * default value.

		 */

		if (seg == VCPU_SREG_CS || seg == VCPU_SREG_SS)

			save->selector &= ~SELECTOR_RPL_MASK;

		save->dpl = save->selector & SELECTOR_RPL_MASK;

		save->s = 1;

	}

	vmx_set_segment(vcpu, &tmp, seg);

	vmx_set_segment(vcpu, save, seg);

}



static void enter_pmode(struct kvm_vcpu *vcpu)
@@ -2777,6 +2784,17 @@ static void enter_pmode(struct kvm_vcpu *vcpu) 
	unsigned long flags;

	struct vcpu_vmx *vmx = to_vmx(vcpu);



	/*

	 * Update real mode segment cache. It may be not up-to-date if sement

	 * register was written while vcpu was in a guest mode.

	 */

	vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_ES], VCPU_SREG_ES);

	vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_DS], VCPU_SREG_DS);

	vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_FS], VCPU_SREG_FS);

	vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_GS], VCPU_SREG_GS);

	vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_SS], VCPU_SREG_SS);

	vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_CS], VCPU_SREG_CS);



	vmx->emulation_required = 1;

	vmx->rmode.vm86_active = 0;
@@ -2794,22 +2812,12 @@ static void enter_pmode(struct kvm_vcpu *vcpu) 


	update_exception_bitmap(vcpu);



	if (emulate_invalid_guest_state)

		return;



	fix_pmode_dataseg(vcpu, VCPU_SREG_CS, &vmx->rmode.segs[VCPU_SREG_CS]);

	fix_pmode_dataseg(vcpu, VCPU_SREG_SS, &vmx->rmode.segs[VCPU_SREG_SS]);

	fix_pmode_dataseg(vcpu, VCPU_SREG_ES, &vmx->rmode.segs[VCPU_SREG_ES]);

	fix_pmode_dataseg(vcpu, VCPU_SREG_DS, &vmx->rmode.segs[VCPU_SREG_DS]);

	fix_pmode_dataseg(vcpu, VCPU_SREG_FS, &vmx->rmode.segs[VCPU_SREG_FS]);

	fix_pmode_dataseg(vcpu, VCPU_SREG_GS, &vmx->rmode.segs[VCPU_SREG_GS]);



	vmx_segment_cache_clear(vmx);



	vmcs_write16(GUEST_SS_SELECTOR, 0);

	vmcs_write32(GUEST_SS_AR_BYTES, 0x93);



	vmcs_write16(GUEST_CS_SELECTOR,

		     vmcs_read16(GUEST_CS_SELECTOR) & ~SELECTOR_RPL_MASK);

	vmcs_write32(GUEST_CS_AR_BYTES, 0x9b);

}



static gva_t rmode_tss_base(struct kvm *kvm)
@@ -2831,22 +2839,40 @@ static gva_t rmode_tss_base(struct kvm *kvm) 
static void fix_rmode_seg(int seg, struct kvm_segment *save)

{

	const struct kvm_vmx_segment_field *sf = &kvm_vmx_segment_fields[seg];

	struct kvm_segment var = *save;



	vmcs_write16(sf->selector, save->base >> 4);

	vmcs_write32(sf->base, save->base & 0xffff0);

	vmcs_write32(sf->limit, 0xffff);

	vmcs_write32(sf->ar_bytes, 0xf3);

	var.dpl = 0x3;

	if (seg == VCPU_SREG_CS)

		var.type = 0x3;



	if (!emulate_invalid_guest_state) {

		var.selector = var.base >> 4;

		var.base = var.base & 0xffff0;

		var.limit = 0xffff;

		var.g = 0;

		var.db = 0;

		var.present = 1;

		var.s = 1;

		var.l = 0;

		var.unusable = 0;

		var.type = 0x3;

		var.avl = 0;

		if (save->base & 0xf)

		printk_once(KERN_WARNING "kvm: segment base is not paragraph"

			    " aligned when entering protected mode (seg=%d)",

			    seg);

			printk_once(KERN_WARNING "kvm: segment base is not "

					"paragraph aligned when entering "

					"protected mode (seg=%d)", seg);

	}



	vmcs_write16(sf->selector, var.selector);

	vmcs_write32(sf->base, var.base);

	vmcs_write32(sf->limit, var.limit);

	vmcs_write32(sf->ar_bytes, vmx_segment_access_rights(&var));

}



static void enter_rmode(struct kvm_vcpu *vcpu)

{

	unsigned long flags;

	struct vcpu_vmx *vmx = to_vmx(vcpu);

	struct kvm_segment var;



	if (enable_unrestricted_guest)

		return;
@@ -2862,7 +2888,6 @@ static void enter_rmode(struct kvm_vcpu *vcpu) 
	vmx->emulation_required = 1;

	vmx->rmode.vm86_active = 1;





	/*

	 * Very old userspace does not call KVM_SET_TSS_ADDR before entering

	 * vcpu. Call it here with phys address pointing 16M below 4G.
@@ -2890,28 +2915,13 @@ static void enter_rmode(struct kvm_vcpu *vcpu) 
	vmcs_writel(GUEST_CR4, vmcs_readl(GUEST_CR4) | X86_CR4_VME);

	update_exception_bitmap(vcpu);



	if (emulate_invalid_guest_state)

		goto continue_rmode;



	vmx_get_segment(vcpu, &var, VCPU_SREG_SS);

	vmx_set_segment(vcpu, &var, VCPU_SREG_SS);

	fix_rmode_seg(VCPU_SREG_SS, &vmx->rmode.segs[VCPU_SREG_SS]);

	fix_rmode_seg(VCPU_SREG_CS, &vmx->rmode.segs[VCPU_SREG_CS]);

	fix_rmode_seg(VCPU_SREG_ES, &vmx->rmode.segs[VCPU_SREG_ES]);

	fix_rmode_seg(VCPU_SREG_DS, &vmx->rmode.segs[VCPU_SREG_DS]);

	fix_rmode_seg(VCPU_SREG_GS, &vmx->rmode.segs[VCPU_SREG_GS]);

	fix_rmode_seg(VCPU_SREG_FS, &vmx->rmode.segs[VCPU_SREG_FS]);



	vmx_get_segment(vcpu, &var, VCPU_SREG_CS);

	vmx_set_segment(vcpu, &var, VCPU_SREG_CS);



	vmx_get_segment(vcpu, &var, VCPU_SREG_ES);

	vmx_set_segment(vcpu, &var, VCPU_SREG_ES);



	vmx_get_segment(vcpu, &var, VCPU_SREG_DS);

	vmx_set_segment(vcpu, &var, VCPU_SREG_DS);



	vmx_get_segment(vcpu, &var, VCPU_SREG_GS);

	vmx_set_segment(vcpu, &var, VCPU_SREG_GS);



	vmx_get_segment(vcpu, &var, VCPU_SREG_FS);

	vmx_set_segment(vcpu, &var, VCPU_SREG_FS);



continue_rmode:

	kvm_mmu_reset_context(vcpu);

}
@@ -3278,7 +3288,7 @@ static void vmx_set_segment(struct kvm_vcpu *vcpu, 
			vmcs_write16(sf->selector, var->selector);

		else if (var->s)

			fix_rmode_seg(seg, &vmx->rmode.segs[seg]);

		return;

		goto out;

	}



	vmcs_writel(sf->base, var->base);
@@ -3300,6 +3310,10 @@ static void vmx_set_segment(struct kvm_vcpu *vcpu, 
		var->type |= 0x1; /* Accessed */



	vmcs_write32(sf->ar_bytes, vmx_segment_access_rights(var));



out:

	if (!vmx->emulation_required)

		vmx->emulation_required = !guest_state_valid(vcpu);

}



static void vmx_get_cs_db_l_bits(struct kvm_vcpu *vcpu, int *db, int *l)