165 lines
5.0 KiB
Diff
165 lines
5.0 KiB
Diff
From 79270591de89ee777f2293a1d02f46f6f3db03b3 Mon Sep 17 00:00:00 2001
|
|
From: Gleb Natapov <gleb@redhat.com>
|
|
Date: Wed, 10 Feb 2010 05:22:09 +0000
|
|
Subject: [PATCH 2/4] Check IOPL level during io instruction emulation.
|
|
|
|
Make emulator check that vcpu is allowed to execute IN, INS, OUT,
|
|
OUTS, CLI, STI.
|
|
|
|
[forward-ported by Ben Hutchings <ben@decadent.org.uk>]
|
|
Signed-off-by: Gleb Natapov <gleb@redhat.com>
|
|
---
|
|
arch/x86/include/asm/kvm_host.h | 1 +
|
|
arch/x86/kvm/emulate.c | 18 ++++++++---
|
|
arch/x86/kvm/x86.c | 65 +++++++++++++++++++++++++++++++++++---
|
|
3 files changed, 73 insertions(+), 11 deletions(-)
|
|
|
|
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
|
|
index f483404..eb2531b 100644
|
|
--- a/arch/x86/include/asm/kvm_host.h
|
|
+++ b/arch/x86/include/asm/kvm_host.h
|
|
@@ -663,6 +663,7 @@ void kvm_disable_tdp(void);
|
|
|
|
int load_pdptrs(struct kvm_vcpu *vcpu, unsigned long cr3);
|
|
int complete_pio(struct kvm_vcpu *vcpu);
|
|
+bool kvm_check_iopl(struct kvm_vcpu *vcpu);
|
|
|
|
struct kvm_memory_slot *gfn_to_memslot_unaliased(struct kvm *kvm, gfn_t gfn);
|
|
|
|
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
|
|
index 8f159f7..91f0eed 100644
|
|
--- a/arch/x86/kvm/emulate.c
|
|
+++ b/arch/x86/kvm/emulate.c
|
|
@@ -2098,13 +2098,21 @@ special_insn:
|
|
c->dst.type = OP_NONE; /* Disable writeback. */
|
|
break;
|
|
case 0xfa: /* cli */
|
|
- ctxt->eflags &= ~X86_EFLAGS_IF;
|
|
- c->dst.type = OP_NONE; /* Disable writeback. */
|
|
+ if (kvm_check_iopl(ctxt->vcpu))
|
|
+ kvm_inject_gp(ctxt->vcpu, 0);
|
|
+ else {
|
|
+ ctxt->eflags &= ~X86_EFLAGS_IF;
|
|
+ c->dst.type = OP_NONE; /* Disable writeback. */
|
|
+ }
|
|
break;
|
|
case 0xfb: /* sti */
|
|
- toggle_interruptibility(ctxt, X86_SHADOW_INT_STI);
|
|
- ctxt->eflags |= X86_EFLAGS_IF;
|
|
- c->dst.type = OP_NONE; /* Disable writeback. */
|
|
+ if (kvm_check_iopl(ctxt->vcpu))
|
|
+ kvm_inject_gp(ctxt->vcpu, 0);
|
|
+ else {
|
|
+ toggle_interruptibility(ctxt, X86_SHADOW_INT_STI);
|
|
+ ctxt->eflags |= X86_EFLAGS_IF;
|
|
+ c->dst.type = OP_NONE; /* Disable writeback. */
|
|
+ }
|
|
break;
|
|
case 0xfc: /* cld */
|
|
ctxt->eflags &= ~EFLG_DF;
|
|
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
|
|
index 012dd8b..06f1b69 100644
|
|
--- a/arch/x86/kvm/x86.c
|
|
+++ b/arch/x86/kvm/x86.c
|
|
@@ -3075,11 +3075,60 @@ static int pio_string_write(struct kvm_vcpu *vcpu)
|
|
return r;
|
|
}
|
|
|
|
+bool kvm_check_iopl(struct kvm_vcpu *vcpu)
|
|
+{
|
|
+ int iopl;
|
|
+ if (!(vcpu->arch.cr0 & X86_CR0_PE))
|
|
+ return false;
|
|
+ if (kvm_x86_ops->get_rflags(vcpu) & X86_EFLAGS_VM)
|
|
+ return true;
|
|
+ iopl = (kvm_x86_ops->get_rflags(vcpu) & X86_EFLAGS_IOPL) >> IOPL_SHIFT;
|
|
+ return kvm_x86_ops->get_cpl(vcpu) > iopl;
|
|
+}
|
|
+
|
|
+bool kvm_check_io_port_access_allowed(struct kvm_vcpu *vcpu, u16 port, u16 len)
|
|
+{
|
|
+ struct kvm_segment tr_seg;
|
|
+ int r;
|
|
+ u16 io_bitmap_ptr;
|
|
+ u8 perm, bit_idx = port & 0x7;
|
|
+ unsigned mask = (1 << len) - 1;
|
|
+
|
|
+ kvm_get_segment(vcpu, &tr_seg, VCPU_SREG_TR);
|
|
+ if (tr_seg.unusable)
|
|
+ return false;
|
|
+ if (tr_seg.limit < 103)
|
|
+ return false;
|
|
+ r = kvm_read_guest_virt_system(tr_seg.base + 102, &io_bitmap_ptr, 2,
|
|
+ vcpu, NULL);
|
|
+ if (r != X86EMUL_CONTINUE)
|
|
+ return false;
|
|
+ if (io_bitmap_ptr + port/8 >= tr_seg.limit)
|
|
+ return false;
|
|
+ r = kvm_read_guest_virt_system(tr_seg.base + io_bitmap_ptr + port/8,
|
|
+ &perm, 1, vcpu, NULL);
|
|
+ if (r != X86EMUL_CONTINUE)
|
|
+ return false;
|
|
+ if ((perm >> bit_idx) & mask)
|
|
+ return false;
|
|
+ return true;
|
|
+}
|
|
+
|
|
int kvm_emulate_pio(struct kvm_vcpu *vcpu, struct kvm_run *run, int in,
|
|
int size, unsigned port)
|
|
{
|
|
unsigned long val;
|
|
|
|
+ trace_kvm_pio(vcpu->run->io.direction == KVM_EXIT_IO_OUT, port,
|
|
+ size, 1);
|
|
+
|
|
+ if (kvm_check_iopl(vcpu)) {
|
|
+ if (!kvm_check_io_port_access_allowed(vcpu, port, size)) {
|
|
+ kvm_inject_gp(vcpu, 0);
|
|
+ return 1;
|
|
+ }
|
|
+ }
|
|
+
|
|
vcpu->run->exit_reason = KVM_EXIT_IO;
|
|
vcpu->run->io.direction = in ? KVM_EXIT_IO_IN : KVM_EXIT_IO_OUT;
|
|
vcpu->run->io.size = vcpu->arch.pio.size = size;
|
|
@@ -3091,9 +3140,6 @@ int kvm_emulate_pio(struct kvm_vcpu *vcpu, struct kvm_run *run, int in,
|
|
vcpu->arch.pio.down = 0;
|
|
vcpu->arch.pio.rep = 0;
|
|
|
|
- trace_kvm_pio(vcpu->run->io.direction == KVM_EXIT_IO_OUT, port,
|
|
- size, 1);
|
|
-
|
|
val = kvm_register_read(vcpu, VCPU_REGS_RAX);
|
|
memcpy(vcpu->arch.pio_data, &val, 4);
|
|
|
|
@@ -3112,6 +3158,16 @@ int kvm_emulate_pio_string(struct kvm_vcpu *vcpu, struct kvm_run *run, int in,
|
|
unsigned now, in_page;
|
|
int ret = 0;
|
|
|
|
+ trace_kvm_pio(vcpu->run->io.direction == KVM_EXIT_IO_OUT, port,
|
|
+ size, 1);
|
|
+
|
|
+ if (kvm_check_iopl(vcpu)) {
|
|
+ if (!kvm_check_io_port_access_allowed(vcpu, port, size)) {
|
|
+ kvm_inject_gp(vcpu, 0);
|
|
+ return 1;
|
|
+ }
|
|
+ }
|
|
+
|
|
vcpu->run->exit_reason = KVM_EXIT_IO;
|
|
vcpu->run->io.direction = in ? KVM_EXIT_IO_IN : KVM_EXIT_IO_OUT;
|
|
vcpu->run->io.size = vcpu->arch.pio.size = size;
|
|
@@ -3123,9 +3179,6 @@ int kvm_emulate_pio_string(struct kvm_vcpu *vcpu, struct kvm_run *run, int in,
|
|
vcpu->arch.pio.down = down;
|
|
vcpu->arch.pio.rep = rep;
|
|
|
|
- trace_kvm_pio(vcpu->run->io.direction == KVM_EXIT_IO_OUT, port,
|
|
- size, count);
|
|
-
|
|
if (!count) {
|
|
kvm_x86_ops->skip_emulated_instruction(vcpu);
|
|
return 1;
|
|
--
|
|
1.6.6
|
|
|