Commit 6d0ecbf6 authored by Krish Sadhukhan's avatar Krish Sadhukhan Committed by Paolo Bonzini

nSVM: Test non-MBZ reserved bits in CR3 in long mode and legacy PAE mode

According to section "CR3" in APM vol. 2, the non-MBZ reserved bits in CR3
need to be set by software as follows:

	"Reserved Bits. Reserved fields should be cleared to 0 by software
	when writing CR3."

But experiments show that consistency checking in SVM ignores these
non-MBZ-reserved bits in CR3, meaning they can be set to 1 also. However,
setting them to 1 may cause guest crashes in some modes and in bare metal
environments. Hence, this test induces an #NPF by clearing the "P" bit in
the highest level page table, when testing the 1-setting of these bits.
Inducing an #NPF causes the guest to exit to userspace before any guest
instruction is executed thus avoiding any crash.
Signed-off-by: default avatarKrish Sadhukhan <krish.sadhukhan@oracle.com>
Message-Id: <20201006190654.32305-4-krish.sadhukhan@oracle.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent b07ffc34
Pipeline #2 failed with stage
in 0 seconds
...@@ -325,7 +325,9 @@ struct __attribute__ ((__packed__)) vmcb { ...@@ -325,7 +325,9 @@ struct __attribute__ ((__packed__)) vmcb {
#define SVM_CR0_SELECTIVE_MASK (X86_CR0_TS | X86_CR0_MP) #define SVM_CR0_SELECTIVE_MASK (X86_CR0_TS | X86_CR0_MP)
#define SVM_CR0_RESERVED_MASK 0xffffffff00000000U #define SVM_CR0_RESERVED_MASK 0xffffffff00000000U
#define SVM_CR3_LONG_RESERVED_MASK 0xfff0000000000000U #define SVM_CR3_LONG_MBZ_MASK 0xfff0000000000000U
#define SVM_CR3_LONG_RESERVED_MASK 0x0000000000000fe7U
#define SVM_CR3_PAE_LEGACY_RESERVED_MASK 0x0000000000000007U
#define SVM_CR4_LEGACY_RESERVED_MASK 0xff88f000U #define SVM_CR4_LEGACY_RESERVED_MASK 0xff88f000U
#define SVM_CR4_RESERVED_MASK 0xffffffffff88f000U #define SVM_CR4_RESERVED_MASK 0xffffffffff88f000U
#define SVM_DR6_RESERVED_MASK 0xffffffffffff1ff0U #define SVM_DR6_RESERVED_MASK 0xffffffffffff1ff0U
......
...@@ -1939,7 +1939,8 @@ static void basic_guest_main(struct svm_test *test) ...@@ -1939,7 +1939,8 @@ static void basic_guest_main(struct svm_test *test)
} \ } \
} }
#define SVM_TEST_CR_RESERVED_BITS(start, end, inc, cr, val, resv_mask) \ #define SVM_TEST_CR_RESERVED_BITS(start, end, inc, cr, val, resv_mask, \
exit_code) \
{ \ { \
u64 tmp, mask; \ u64 tmp, mask; \
int i; \ int i; \
...@@ -1959,7 +1960,7 @@ static void basic_guest_main(struct svm_test *test) ...@@ -1959,7 +1960,7 @@ static void basic_guest_main(struct svm_test *test)
case 4: \ case 4: \
vmcb->save.cr4 = tmp; \ vmcb->save.cr4 = tmp; \
} \ } \
report(svm_vmrun() == SVM_EXIT_ERR, "Test CR%d %d:%d: %lx",\ report(svm_vmrun() == exit_code, "Test CR%d %d:%d: %lx",\
cr, end, start, tmp); \ cr, end, start, tmp); \
} \ } \
} }
...@@ -2082,9 +2083,62 @@ static void test_cr3(void) ...@@ -2082,9 +2083,62 @@ static void test_cr3(void)
u64 cr3_saved = vmcb->save.cr3; u64 cr3_saved = vmcb->save.cr3;
SVM_TEST_CR_RESERVED_BITS(0, 63, 1, 3, cr3_saved, SVM_TEST_CR_RESERVED_BITS(0, 63, 1, 3, cr3_saved,
SVM_CR3_LONG_RESERVED_MASK); SVM_CR3_LONG_MBZ_MASK, SVM_EXIT_ERR);
vmcb->save.cr3 = cr3_saved & ~SVM_CR3_LONG_MBZ_MASK;
report(svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR3 63:0: %lx",
vmcb->save.cr3);
/*
* CR3 non-MBZ reserved bits based on different modes:
* [11:5] [2:0] - long mode
* [2:0] - PAE legacy mode
*/
u64 cr4_saved = vmcb->save.cr4;
u64 *pdpe = npt_get_pml4e();
/*
* Long mode
*/
if (this_cpu_has(X86_FEATURE_PCID)) {
vmcb->save.cr4 = cr4_saved | X86_CR4_PCIDE;
SVM_TEST_CR_RESERVED_BITS(0, 11, 1, 3, cr3_saved,
SVM_CR3_LONG_RESERVED_MASK, SVM_EXIT_VMMCALL);
vmcb->save.cr3 = cr3_saved & ~SVM_CR3_LONG_RESERVED_MASK;
report(svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR3 63:0: %lx",
vmcb->save.cr3);
} else {
vmcb->save.cr4 = cr4_saved & ~X86_CR4_PCIDE;
/* Clear P (Present) bit in NPT in order to trigger #NPF */
pdpe[0] &= ~1ULL;
SVM_TEST_CR_RESERVED_BITS(0, 11, 1, 3, cr3_saved,
SVM_CR3_LONG_RESERVED_MASK, SVM_EXIT_NPF);
pdpe[0] |= 1ULL;
vmcb->save.cr3 = cr3_saved & ~SVM_CR3_LONG_RESERVED_MASK;
report(svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR3 63:0: %lx",
vmcb->save.cr3);
}
/*
* PAE legacy
*/
pdpe[0] &= ~1ULL;
vmcb->save.cr4 = cr4_saved | X86_CR4_PAE;
SVM_TEST_CR_RESERVED_BITS(0, 2, 1, 3, cr3_saved,
SVM_CR3_PAE_LEGACY_RESERVED_MASK, SVM_EXIT_NPF);
pdpe[0] |= 1ULL;
vmcb->save.cr3 = cr3_saved & ~SVM_CR3_PAE_LEGACY_RESERVED_MASK;
report(svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR3 63:0: %lx",
vmcb->save.cr3);
vmcb->save.cr3 = cr3_saved; vmcb->save.cr3 = cr3_saved;
vmcb->save.cr4 = cr4_saved;
} }
static void test_cr4(void) static void test_cr4(void)
...@@ -2101,14 +2155,14 @@ static void test_cr4(void) ...@@ -2101,14 +2155,14 @@ static void test_cr4(void)
efer &= ~EFER_LME; efer &= ~EFER_LME;
vmcb->save.efer = efer; vmcb->save.efer = efer;
SVM_TEST_CR_RESERVED_BITS(12, 31, 1, 4, cr4_saved, SVM_TEST_CR_RESERVED_BITS(12, 31, 1, 4, cr4_saved,
SVM_CR4_LEGACY_RESERVED_MASK); SVM_CR4_LEGACY_RESERVED_MASK, SVM_EXIT_ERR);
efer |= EFER_LME; efer |= EFER_LME;
vmcb->save.efer = efer; vmcb->save.efer = efer;
SVM_TEST_CR_RESERVED_BITS(12, 31, 1, 4, cr4_saved, SVM_TEST_CR_RESERVED_BITS(12, 31, 1, 4, cr4_saved,
SVM_CR4_RESERVED_MASK); SVM_CR4_RESERVED_MASK, SVM_EXIT_ERR);
SVM_TEST_CR_RESERVED_BITS(32, 63, 4, 4, cr4_saved, SVM_TEST_CR_RESERVED_BITS(32, 63, 4, 4, cr4_saved,
SVM_CR4_RESERVED_MASK); SVM_CR4_RESERVED_MASK, SVM_EXIT_ERR);
vmcb->save.cr4 = cr4_saved; vmcb->save.cr4 = cr4_saved;
vmcb->save.efer = efer_saved; vmcb->save.efer = efer_saved;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment