[PATCH] VMX: Fix and improve guest state validity checks

[Mohammed Gamal <m.gamal005@gmail.com>]

- Add 's' and 'g' field checks on segment registers
- Correct SS checks for request and descriptor privilege levels

Signed-off-by: Mohammed Gamal <m.gamal005@gmail.com>
---
 arch/x86/kvm/vmx.c |   73 +++++++++++++++++++++++++++++++++++++++++++++++----
 1 files changed, 67 insertions(+), 6 deletions(-)

diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 777e00d..9805c2a 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2121,16 +2121,30 @@ static bool stack_segment_valid(struct kvm_vcpu *vcpu)
 	vmx_get_segment(vcpu, &ss, VCPU_SREG_SS);
 	ss_rpl = ss.selector & SELECTOR_RPL_MASK;
 
-	if (ss.unusable)
+	if (ss.dpl != ss_rpl) /* DPL != RPL */
+		return false;
+
+	if (ss.unusable) /* Short-circuit */
 		return true;
+
 	if (ss.type != 3 && ss.type != 7)
 		return false;
 	if (!ss.s)
 		return false;
-	if (ss.dpl != ss_rpl) /* DPL != RPL */
-		return false;
 	if (!ss.present)
 		return false;
+	if (ss.limit & 0xfff00000) {
+                if ((ss.limit & 0xfff) < 0xfff)
+                        return false;
+                if (!ss.g)
+                        return false;
+        } else {
+                if ((ss.limit & 0xfff) == 0xfff)
+                        return false;
+                if (ss.g)
+                        return false;
+        }
+
 
 	return true;
 }
@@ -2143,8 +2157,15 @@ static bool data_segment_valid(struct kvm_vcpu *vcpu, int seg)
 	vmx_get_segment(vcpu, &var, seg);
 	rpl = var.selector & SELECTOR_RPL_MASK;
 
-	if (var.unusable)
+	if (var.unusable)  /* Short-circuit */
 		return true;
+	if (!(var.type & AR_TYPE_ACCESSES_MASK))
+		return false;
+	if (var.type & AR_TYPE_CODE_MASK) {
+		if (!(var.type & AR_TYPE_READABLE_MASK))
+			return false;
+	}
+
 	if (!var.s)
 		return false;
 	if (!var.present)
@@ -2154,6 +2175,18 @@ static bool data_segment_valid(struct kvm_vcpu *vcpu, int seg)
 			return false;
 	}
 
+	if (var.limit & 0xfff00000) {
+		if ((var.limit & 0xfff) < 0xfff)
+			return false;
+		if (!var.g)
+			return false;
+	} else {
+		if ((var.limit & 0xfff) == 0xfff)
+			return false;
+		if (var.g)
+			return false;
+	}
+
 	/* TODO: Add other members to kvm_segment_field to allow checking for other access
 	 * rights flags
 	 */
@@ -2172,6 +2205,21 @@ static bool tr_valid(struct kvm_vcpu *vcpu)
 		return false;
 	if (tr.type != 3 && tr.type != 11) /* TODO: Check if guest is in IA32e mode */
 		return false;
+	if (tr.s)
+		return false;
+	if (tr.limit & 0xfff00000) {
+                if ((tr.limit & 0xfff) < 0xfff)
+                        return false;
+                if (!tr.g)
+                        return false;
+        } else {
+                if ((tr.limit & 0xfff) == 0xfff)
+                        return false;
+                if (tr.g)
+                        return false;
+        }
+
+
 	if (!tr.present)
 		return false;
 
@@ -2184,7 +2232,7 @@ static bool ldtr_valid(struct kvm_vcpu *vcpu)
 
 	vmx_get_segment(vcpu, &ldtr, VCPU_SREG_LDTR);
 
-	if (ldtr.unusable)
+	if (ldtr.unusable)	/* Short-circuit */
 		return true;
 	if (ldtr.selector & SELECTOR_TI_MASK)	/* TI = 1 */
 		return false;
@@ -2192,6 +2240,20 @@ static bool ldtr_valid(struct kvm_vcpu *vcpu)
 		return false;
 	if (!ldtr.present)
 		return false;
+	if (ldtr.s)
+		return false;
+	if (ldtr.limit & 0xfff00000) {
+                if ((ldtr.limit & 0xfff) < 0xfff)
+                        return false;
+                if (!ldtr.g)
+                        return false;
+        } else {
+                if ((ldtr.limit & 0xfff) == 0xfff)
+                        return false;
+                if (ldtr.g)
+                        return false;
+        }
+
 
 	return true;
 }
@@ -2251,7 +2313,6 @@ static bool guest_state_valid(struct kvm_vcpu *vcpu)
 	}
 	/* TODO:
 	 * - Add checks on RIP
-	 * - Add checks on RFLAGS
 	 */
 
 	return true;
-- 
1.7.0.4