SYS-OSS/FRET-qemu
4
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

target/i386: Added MSRPM and IOPM size check

Browse Source 
The address of the last entry in the MSRPM and
in the IOPM must be smaller than the largest physical address.
(APM2 15.10-15.11)

Signed-off-by: Lara Lazier <laramglazier@gmail.com>
Message-Id: <20210705081802.18960-2-laramglazier@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
Lara Lazier 2021-07-05 10:17:59 +02:00 committed by Paolo Bonzini
parent bca6eb34f0
commit 481077b28b
2 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
target/i386/svm.h
View File

@ -137,6 +137,9 @@
#define SVM_CR0_RESERVED_MASK 0xffffffff00000000U #define SVM_CR0_RESERVED_MASK 0xffffffff00000000U
#define SVM_MSRPM_SIZE (1ULL << 13)
#define SVM_IOPM_SIZE ((1ULL << 13) + 1)
struct QEMU_PACKED vmcb_control_area { struct QEMU_PACKED vmcb_control_area {
uint16_t intercept_cr_read; uint16_t intercept_cr_read;
uint16_t intercept_cr_write; uint16_t intercept_cr_write;

15
target/i386/tcg/sysemu/svm_helper.c
View File

@ -68,6 +68,7 @@ static inline void svm_load_seg_cache(CPUX86State *env, hwaddr addr,
void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend) void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
{ {
CPUState *cs = env_cpu(env); CPUState *cs = env_cpu(env);
X86CPU *cpu = env_archcpu(env);
target_ulong addr; target_ulong addr;
uint64_t nested_ctl; uint64_t nested_ctl;
uint32_t event_inj; uint32_t event_inj;
@ -159,6 +160,20 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
asid = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, asid = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb,
control.asid)); control.asid));
uint64_t msrpm_base_pa = x86_ldq_phys(cs, env->vm_vmcb +
offsetof(struct vmcb,
control.msrpm_base_pa));
uint64_t iopm_base_pa = x86_ldq_phys(cs, env->vm_vmcb +
offsetof(struct vmcb, control.iopm_base_pa));
if ((msrpm_base_pa & ~0xfff) >= (1ull << cpu->phys_bits) - SVM_MSRPM_SIZE) {
cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
}
if ((iopm_base_pa & ~0xfff) >= (1ull << cpu->phys_bits) - SVM_IOPM_SIZE) {
cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
}
env->nested_pg_mode = 0; env->nested_pg_mode = 0;
if (!cpu_svm_has_intercept(env, SVM_EXIT_VMRUN)) { if (!cpu_svm_has_intercept(env, SVM_EXIT_VMRUN)) {