target/i386: Added consistency checks for CR3
All MBZ in CR3 must be zero (APM2 15.5) Added checks in both helper_vmrun and helper_write_crN. When EFER.LMA is zero the upper 32 bits needs to be zeroed. Signed-off-by: Lara Lazier <laramglazier@gmail.com> Message-Id: <20210723112740.45962-1-laramglazier@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
parent
917ddc27d8
commit
3407259b20
|
@ -96,6 +96,13 @@ void helper_write_crN(CPUX86State *env, int reg, target_ulong t0)
|
||||||
cpu_x86_update_cr0(env, t0);
|
cpu_x86_update_cr0(env, t0);
|
||||||
break;
|
break;
|
||||||
case 3:
|
case 3:
|
||||||
|
if ((env->efer & MSR_EFER_LMA) &&
|
||||||
|
(t0 & ((~0UL) << env_archcpu(env)->phys_bits))) {
|
||||||
|
cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
|
||||||
|
}
|
||||||
|
if (!(env->efer & MSR_EFER_LMA)) {
|
||||||
|
t0 &= 0xffffffffUL;
|
||||||
|
}
|
||||||
cpu_x86_update_cr3(env, t0);
|
cpu_x86_update_cr3(env, t0);
|
||||||
break;
|
break;
|
||||||
case 4:
|
case 4:
|
||||||
|
|
|
@ -120,6 +120,7 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
|
||||||
uint32_t int_ctl;
|
uint32_t int_ctl;
|
||||||
uint32_t asid;
|
uint32_t asid;
|
||||||
uint64_t new_cr0;
|
uint64_t new_cr0;
|
||||||
|
uint64_t new_cr3;
|
||||||
uint64_t new_cr4;
|
uint64_t new_cr4;
|
||||||
|
|
||||||
cpu_svm_check_intercept_param(env, SVM_EXIT_VMRUN, 0, GETPC());
|
cpu_svm_check_intercept_param(env, SVM_EXIT_VMRUN, 0, GETPC());
|
||||||
|
@ -261,6 +262,11 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
|
||||||
if ((new_cr0 & CR0_NW_MASK) && !(new_cr0 & CR0_CD_MASK)) {
|
if ((new_cr0 & CR0_NW_MASK) && !(new_cr0 & CR0_CD_MASK)) {
|
||||||
cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
|
cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
|
||||||
}
|
}
|
||||||
|
new_cr3 = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.cr3));
|
||||||
|
if ((env->efer & MSR_EFER_LMA) &&
|
||||||
|
(new_cr3 & ((~0UL) << cpu->phys_bits))) {
|
||||||
|
cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
|
||||||
|
}
|
||||||
new_cr4 = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.cr4));
|
new_cr4 = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.cr4));
|
||||||
if (new_cr4 & cr4_reserved_bits(env)) {
|
if (new_cr4 & cr4_reserved_bits(env)) {
|
||||||
cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
|
cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
|
||||||
|
@ -271,9 +277,7 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
|
||||||
|
|
||||||
cpu_x86_update_cr0(env, new_cr0);
|
cpu_x86_update_cr0(env, new_cr0);
|
||||||
cpu_x86_update_cr4(env, new_cr4);
|
cpu_x86_update_cr4(env, new_cr4);
|
||||||
cpu_x86_update_cr3(env, x86_ldq_phys(cs,
|
cpu_x86_update_cr3(env, new_cr3);
|
||||||
env->vm_vmcb + offsetof(struct vmcb,
|
|
||||||
save.cr3)));
|
|
||||||
env->cr[2] = x86_ldq_phys(cs,
|
env->cr[2] = x86_ldq_phys(cs,
|
||||||
env->vm_vmcb + offsetof(struct vmcb, save.cr2));
|
env->vm_vmcb + offsetof(struct vmcb, save.cr2));
|
||||||
int_ctl = x86_ldl_phys(cs,
|
int_ctl = x86_ldl_phys(cs,
|
||||||
|
|
Loading…
Reference in a new issue