From patchwork Tue May 11 16:52:41 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mohammed Gamal X-Patchwork-Id: 98778 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter.kernel.org (8.14.3/8.14.3) with ESMTP id o4BGrAQV011277 for ; Tue, 11 May 2010 16:53:10 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755695Ab0EKQxF (ORCPT ); Tue, 11 May 2010 12:53:05 -0400 Received: from mail-ww0-f46.google.com ([74.125.82.46]:59485 "EHLO mail-ww0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751155Ab0EKQxE (ORCPT ); Tue, 11 May 2010 12:53:04 -0400 Received: by wwi18 with SMTP id 18so69928wwi.19 for ; Tue, 11 May 2010 09:53:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:from:to:cc:subject:date :message-id:x-mailer; bh=enr3HlVfcCFxgp0tP6ubIHiWHK4yfSnjiqyyU+O3ahQ=; b=Wi86PNe+lx8alWDcPcQDBrztPRFvhtssqyRAk5I6gylh0Pzos1plp9wIaSPHV0LZLk /6YjyJw5iODHmeRfFC9QgqR+JBYSlK+KaZ+Dp3SvBvlzNlO832YZqaEyr7P9tCbfox/a HNvfsud6ei2XTMbtgluO3OGjL0I6EVNWiv1AY= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=from:to:cc:subject:date:message-id:x-mailer; b=cSqeWTXetSGshe0vBefR1H0hR+3GejhvWPHiQCeMmCzglnPhEnoI2w/z03RUSEnUG8 jH4siUAxZpA+QUyFwgxt/M0JqpWukSnreImZsRbqTIN7yVYxeY02X4XI0wkCLDQKZ5Hl yICkSCY/4UktRDraHb135hklLtCmptnCJeons= Received: by 10.216.86.14 with SMTP id v14mr3654652wee.157.1273596781991; Tue, 11 May 2010 09:53:01 -0700 (PDT) Received: from localhost ([41.239.64.220]) by mx.google.com with ESMTPS id t70sm2276171weq.14.2010.05.11.09.52.46 (version=TLSv1/SSLv3 cipher=RC4-MD5); Tue, 11 May 2010 09:52:48 -0700 (PDT) From: Mohammed Gamal To: avi@redhat.com Cc: mtosatti@redhat.com, kvm@vger.kernel.org, Mohammed Gamal Subject: [PATCH] VMX: Fix and improve guest state validity checks Date: Tue, 11 May 2010 19:52:41 +0300 Message-Id: <1273596761-29923-1-git-send-email-m.gamal005@gmail.com> X-Mailer: git-send-email 1.7.0.4 Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.3 (demeter.kernel.org [140.211.167.41]); Tue, 11 May 2010 16:53:11 +0000 (UTC) diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index 777e00d..9805c2a 100644 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -2121,16 +2121,30 @@ static bool stack_segment_valid(struct kvm_vcpu *vcpu) vmx_get_segment(vcpu, &ss, VCPU_SREG_SS); ss_rpl = ss.selector & SELECTOR_RPL_MASK; - if (ss.unusable) + if (ss.dpl != ss_rpl) /* DPL != RPL */ + return false; + + if (ss.unusable) /* Short-circuit */ return true; + if (ss.type != 3 && ss.type != 7) return false; if (!ss.s) return false; - if (ss.dpl != ss_rpl) /* DPL != RPL */ - return false; if (!ss.present) return false; + if (ss.limit & 0xfff00000) { + if ((ss.limit & 0xfff) < 0xfff) + return false; + if (!ss.g) + return false; + } else { + if ((ss.limit & 0xfff) == 0xfff) + return false; + if (ss.g) + return false; + } + return true; } @@ -2143,8 +2157,15 @@ static bool data_segment_valid(struct kvm_vcpu *vcpu, int seg) vmx_get_segment(vcpu, &var, seg); rpl = var.selector & SELECTOR_RPL_MASK; - if (var.unusable) + if (var.unusable) /* Short-circuit */ return true; + if (!(var.type & AR_TYPE_ACCESSES_MASK)) + return false; + if (var.type & AR_TYPE_CODE_MASK) { + if (!(var.type & AR_TYPE_READABLE_MASK)) + return false; + } + if (!var.s) return false; if (!var.present) @@ -2154,6 +2175,18 @@ static bool data_segment_valid(struct kvm_vcpu *vcpu, int seg) return false; } + if (var.limit & 0xfff00000) { + if ((var.limit & 0xfff) < 0xfff) + return false; + if (!var.g) + return false; + } else { + if ((var.limit & 0xfff) == 0xfff) + return false; + if (var.g) + return false; + } + /* TODO: Add other members to kvm_segment_field to allow checking for other access * rights flags */ @@ -2172,6 +2205,21 @@ static bool tr_valid(struct kvm_vcpu *vcpu) return false; if (tr.type != 3 && tr.type != 11) /* TODO: Check if guest is in IA32e mode */ return false; + if (tr.s) + return false; + if (tr.limit & 0xfff00000) { + if ((tr.limit & 0xfff) < 0xfff) + return false; + if (!tr.g) + return false; + } else { + if ((tr.limit & 0xfff) == 0xfff) + return false; + if (tr.g) + return false; + } + + if (!tr.present) return false; @@ -2184,7 +2232,7 @@ static bool ldtr_valid(struct kvm_vcpu *vcpu) vmx_get_segment(vcpu, &ldtr, VCPU_SREG_LDTR); - if (ldtr.unusable) + if (ldtr.unusable) /* Short-circuit */ return true; if (ldtr.selector & SELECTOR_TI_MASK) /* TI = 1 */ return false; @@ -2192,6 +2240,20 @@ static bool ldtr_valid(struct kvm_vcpu *vcpu) return false; if (!ldtr.present) return false; + if (ldtr.s) + return false; + if (ldtr.limit & 0xfff00000) { + if ((ldtr.limit & 0xfff) < 0xfff) + return false; + if (!ldtr.g) + return false; + } else { + if ((ldtr.limit & 0xfff) == 0xfff) + return false; + if (ldtr.g) + return false; + } + return true; } @@ -2251,7 +2313,6 @@ static bool guest_state_valid(struct kvm_vcpu *vcpu) } /* TODO: * - Add checks on RIP - * - Add checks on RFLAGS */ return true;