target/i386: Added consistency checks for CR4
All MBZ bits in CR4 must be zero. (APM2 15.5) Added reserved bitmask and added checks in both helper_vmrun and helper_write_crN. Signed-off-by: Lara Lazier <laramglazier@gmail.com> Message-Id: <20210721152651.14683-2-laramglazier@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
parent
b128b25a5a
commit
213ff024a2
|
@ -240,6 +240,7 @@ typedef enum X86Seg {
|
||||||
#define CR4_OSFXSR_SHIFT 9
|
#define CR4_OSFXSR_SHIFT 9
|
||||||
#define CR4_OSFXSR_MASK (1U << CR4_OSFXSR_SHIFT)
|
#define CR4_OSFXSR_MASK (1U << CR4_OSFXSR_SHIFT)
|
||||||
#define CR4_OSXMMEXCPT_MASK (1U << 10)
|
#define CR4_OSXMMEXCPT_MASK (1U << 10)
|
||||||
|
#define CR4_UMIP_MASK (1U << 11)
|
||||||
#define CR4_LA57_MASK (1U << 12)
|
#define CR4_LA57_MASK (1U << 12)
|
||||||
#define CR4_VMXE_MASK (1U << 13)
|
#define CR4_VMXE_MASK (1U << 13)
|
||||||
#define CR4_SMXE_MASK (1U << 14)
|
#define CR4_SMXE_MASK (1U << 14)
|
||||||
|
@ -251,6 +252,14 @@ typedef enum X86Seg {
|
||||||
#define CR4_PKE_MASK (1U << 22)
|
#define CR4_PKE_MASK (1U << 22)
|
||||||
#define CR4_PKS_MASK (1U << 24)
|
#define CR4_PKS_MASK (1U << 24)
|
||||||
|
|
||||||
|
#define CR4_RESERVED_MASK \
|
||||||
|
(~(target_ulong)(CR4_VME_MASK | CR4_PVI_MASK | CR4_TSD_MASK \
|
||||||
|
| CR4_DE_MASK | CR4_PSE_MASK | CR4_PAE_MASK \
|
||||||
|
| CR4_MCE_MASK | CR4_PGE_MASK | CR4_PCE_MASK \
|
||||||
|
| CR4_OSFXSR_MASK | CR4_OSXMMEXCPT_MASK |CR4_UMIP_MASK \
|
||||||
|
| CR4_FSGSBASE_MASK | CR4_PCIDE_MASK | CR4_OSXSAVE_MASK \
|
||||||
|
| CR4_SMEP_MASK | CR4_SMAP_MASK | CR4_PKE_MASK | CR4_PKS_MASK))
|
||||||
|
|
||||||
#define DR6_BD (1 << 13)
|
#define DR6_BD (1 << 13)
|
||||||
#define DR6_BS (1 << 14)
|
#define DR6_BS (1 << 14)
|
||||||
#define DR6_BT (1 << 15)
|
#define DR6_BT (1 << 15)
|
||||||
|
@ -2196,6 +2205,36 @@ static inline bool hyperv_feat_enabled(X86CPU *cpu, int feat)
|
||||||
return !!(cpu->hyperv_features & BIT(feat));
|
return !!(cpu->hyperv_features & BIT(feat));
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static inline uint64_t cr4_reserved_bits(CPUX86State *env)
|
||||||
|
{
|
||||||
|
uint64_t reserved_bits = CR4_RESERVED_MASK;
|
||||||
|
if (!env->features[FEAT_XSAVE]) {
|
||||||
|
reserved_bits |= CR4_OSXSAVE_MASK;
|
||||||
|
}
|
||||||
|
if (!(env->features[FEAT_7_0_EBX] & CPUID_7_0_EBX_SMEP)) {
|
||||||
|
reserved_bits |= CR4_SMEP_MASK;
|
||||||
|
}
|
||||||
|
if (!(env->features[FEAT_7_0_EBX] & CPUID_7_0_EBX_SMAP)) {
|
||||||
|
reserved_bits |= CR4_SMAP_MASK;
|
||||||
|
}
|
||||||
|
if (!(env->features[FEAT_7_0_EBX] & CPUID_7_0_EBX_FSGSBASE)) {
|
||||||
|
reserved_bits |= CR4_FSGSBASE_MASK;
|
||||||
|
}
|
||||||
|
if (!(env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_PKU)) {
|
||||||
|
reserved_bits |= CR4_PKE_MASK;
|
||||||
|
}
|
||||||
|
if (!(env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_LA57)) {
|
||||||
|
reserved_bits |= CR4_LA57_MASK;
|
||||||
|
}
|
||||||
|
if (!(env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_UMIP)) {
|
||||||
|
reserved_bits |= CR4_UMIP_MASK;
|
||||||
|
}
|
||||||
|
if (!(env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_PKS)) {
|
||||||
|
reserved_bits |= CR4_PKS_MASK;
|
||||||
|
}
|
||||||
|
return reserved_bits;
|
||||||
|
}
|
||||||
|
|
||||||
#if defined(TARGET_X86_64) && \
|
#if defined(TARGET_X86_64) && \
|
||||||
defined(CONFIG_USER_ONLY) && \
|
defined(CONFIG_USER_ONLY) && \
|
||||||
defined(CONFIG_LINUX)
|
defined(CONFIG_LINUX)
|
||||||
|
|
|
@ -99,6 +99,9 @@ void helper_write_crN(CPUX86State *env, int reg, target_ulong t0)
|
||||||
cpu_x86_update_cr3(env, t0);
|
cpu_x86_update_cr3(env, t0);
|
||||||
break;
|
break;
|
||||||
case 4:
|
case 4:
|
||||||
|
if (t0 & cr4_reserved_bits(env)) {
|
||||||
|
cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
|
||||||
|
}
|
||||||
if (((t0 ^ env->cr[4]) & CR4_LA57_MASK) &&
|
if (((t0 ^ env->cr[4]) & CR4_LA57_MASK) &&
|
||||||
(env->hflags & HF_CS64_MASK)) {
|
(env->hflags & HF_CS64_MASK)) {
|
||||||
raise_exception_ra(env, EXCP0D_GPF, GETPC());
|
raise_exception_ra(env, EXCP0D_GPF, GETPC());
|
||||||
|
|
|
@ -85,6 +85,7 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
|
||||||
uint32_t int_ctl;
|
uint32_t int_ctl;
|
||||||
uint32_t asid;
|
uint32_t asid;
|
||||||
uint64_t new_cr0;
|
uint64_t new_cr0;
|
||||||
|
uint64_t new_cr4;
|
||||||
|
|
||||||
cpu_svm_check_intercept_param(env, SVM_EXIT_VMRUN, 0, GETPC());
|
cpu_svm_check_intercept_param(env, SVM_EXIT_VMRUN, 0, GETPC());
|
||||||
|
|
||||||
|
@ -225,14 +226,16 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
|
||||||
if ((new_cr0 & CR0_NW_MASK) && !(new_cr0 & CR0_CD_MASK)) {
|
if ((new_cr0 & CR0_NW_MASK) && !(new_cr0 & CR0_CD_MASK)) {
|
||||||
cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
|
cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
|
||||||
}
|
}
|
||||||
|
new_cr4 = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.cr4));
|
||||||
|
if (new_cr4 & cr4_reserved_bits(env)) {
|
||||||
|
cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
|
||||||
|
}
|
||||||
/* clear exit_info_2 so we behave like the real hardware */
|
/* clear exit_info_2 so we behave like the real hardware */
|
||||||
x86_stq_phys(cs,
|
x86_stq_phys(cs,
|
||||||
env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2), 0);
|
env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2), 0);
|
||||||
|
|
||||||
cpu_x86_update_cr0(env, new_cr0);
|
cpu_x86_update_cr0(env, new_cr0);
|
||||||
cpu_x86_update_cr4(env, x86_ldq_phys(cs,
|
cpu_x86_update_cr4(env, new_cr4);
|
||||||
env->vm_vmcb + offsetof(struct vmcb,
|
|
||||||
save.cr4)));
|
|
||||||
cpu_x86_update_cr3(env, x86_ldq_phys(cs,
|
cpu_x86_update_cr3(env, x86_ldq_phys(cs,
|
||||||
env->vm_vmcb + offsetof(struct vmcb,
|
env->vm_vmcb + offsetof(struct vmcb,
|
||||||
save.cr3)));
|
save.cr3)));
|
||||||
|
|
Loading…
Reference in a new issue