Re: KVM: VMX: fix incorrect cached cpl value with real/v8086 modes

[Gleb Natapov <gleb@redhat.com>]

On Wed, Dec 26, 2012 at 11:25:24AM -0200, Marcelo Tosatti wrote:
> On Wed, Dec 26, 2012 at 07:25:49AM +0200, Gleb Natapov wrote:
> > On Tue, Dec 25, 2012 at 07:37:10PM -0200, Marcelo Tosatti wrote:
> > > On Tue, Dec 25, 2012 at 02:48:08PM +0200, Gleb Natapov wrote:
> > > > On Sat, Dec 22, 2012 at 02:31:10PM +0200, Avi Kivity wrote:
> > > > > On Wed, Dec 19, 2012 at 3:29 PM, Marcelo Tosatti <mtosatti@redhat.com>wrote:
> > > > > 
> > > > > >
> > > > > >
> > > > > > CPL is always 0 when in real mode, and always 3 when virtual 8086 mode.
> > > > > >
> > > > > > Using values other than those can cause failures on operations that check
> > > > > > CPL.
> > > > > >
> > > > > > Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
> > > > > >
> > > > > > diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
> > > > > > index a4ecf7c..3abe433 100644
> > > > > > --- a/arch/x86/kvm/vmx.c
> > > > > > +++ b/arch/x86/kvm/vmx.c
> > > > > > @@ -3215,13 +3215,6 @@ static u64 vmx_get_segment_base(struct kvm_vcpu
> > > > > > *vcpu, int seg)
> > > > > >
> > > > > >  static int __vmx_get_cpl(struct kvm_vcpu *vcpu)
> > > > > >  {
> > > > > > -       if (!is_protmode(vcpu))
> > > > > > -               return 0;
> > > > > > -
> > > > > > -       if (!is_long_mode(vcpu)
> > > > > > -           && (kvm_get_rflags(vcpu) & X86_EFLAGS_VM)) /* if virtual 8086
> > > > > > */
> > > > > > -               return 3;
> > > > > > -
> > > > > >         return vmx_read_guest_seg_selector(to_vmx(vcpu), VCPU_SREG_CS) & 3;
> > > > > >  }
> > > > > >
> > > > > > @@ -3229,6 +3222,13 @@ static int vmx_get_cpl(struct kvm_vcpu *vcpu)
> > > > > >  {
> > > > > >         struct vcpu_vmx *vmx = to_vmx(vcpu);
> > > > > >
> > > > > > +       if (!is_protmode(vcpu))
> > > > > > +               return 0;
> > > > > > +
> > > > > > +       if (!is_long_mode(vcpu)
> > > > > > +           && (kvm_get_rflags(vcpu) & X86_EFLAGS_VM)) /* if virtual 8086
> > > > > > */
> > > > > > +               return 3;
> > > > > > +
> > > > > >         /*
> > > > > >          * If we enter real mode with cs.sel & 3 != 0, the normal CPL
> > > > > > calculations
> > > > > >          * fail; use the cache instead.
> > > > > >
> > > > > 
> > > > > 
> > > > > This undoes the cache, now every vmx_get_cpl() in protected mode has to
> > > > > VMREAD(GUEST_RFLAGS).
> > > > True. Marcelo what failure do you see without the patch?
> > > > 
> > > > --
> > > > 			Gleb.
> > > 
> > > On transition _to_ real mode, linearize fails due to CPL checks
> > > (FreeBSD). I'll resend the patch with use of cache for
> > > VMREAD(GUEST_RFLAGS), which is already implemented.
> > I am curious does it still fails with all my vmx patches applied too?
> 
> Yes.
> 
Which FreeBSD exactly? Cannot reproduce with FreeBSD 9 64 bits here.

> > The question is how does it happen that we enter real mode while cache
> > is set to 3. It should never be 3 during boot since boot process never
> > enters the userspace.
> 
> Its transition _to_ real mode (from protected).
But in protected mode CPL should be 0 during boot.

--
			Gleb.