Re: KVM: VMX: fix incorrect cached cpl value with real/v8086 modes

Marcelo Tosatti
2012-12-26T13:26:37Z

On Wed, Dec 26, 2012 at 07:25:49AM +0200, Gleb Natapov wrote:
> On Tue, Dec 25, 2012 at 07:37:10PM -0200, Marcelo Tosatti wrote:
> > On Tue, Dec 25, 2012 at 02:48:08PM +0200, Gleb Natapov wrote:
> > > On Sat, Dec 22, 2012 at 02:31:10PM +0200, Avi Kivity wrote:
> > > > On Wed, Dec 19, 2012 at 3:29 PM, Marcelo Tosatti <mtosatti@redhat.com>wrote:
> > > >
> > > > >
> > > > >
> > > > > CPL is always 0 when in real mode, and always 3 when virtual 8086 mode.
> > > > >
> > > > > Using values other than those can cause failures on operations that check
> > > > > CPL.
> > > > >
> > > > > Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
> > > > >
> > > > > diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
> > > > > index a4ecf7c..3abe433 100644
> > > > > --- a/arch/x86/kvm/vmx.c
> > > > > +++ b/arch/x86/kvm/vmx.c
> > > > > @@ -3215,13 +3215,6 @@ static u64 vmx_get_segment_base(struct kvm_vcpu
> > > > > *vcpu, int seg)
> > > > >
> > > > > static int __vmx_get_cpl(struct kvm_vcpu *vcpu)
> > > > > {
> > > > > - if (!is_protmode(vcpu))
> > > > > - return 0;
> > > > > -
> > > > > - if (!is_long_mode(vcpu)
> > > > > - && (kvm_get_rflags(vcpu) & X86_EFLAGS_VM)) /* if virtual 8086
> > > > > */
> > > > > - return 3;
> > > > > -
> > > > > return vmx_read_guest_seg_selector(to_vmx(vcpu), VCPU_SREG_CS) & 3;
> > > > > }
> > > > >
> > > > > @@ -3229,6 +3222,13 @@ static int vmx_get_cpl(struct kvm_vcpu *vcpu)
> > > > > {
> > > > > struct vcpu_vmx *vmx = to_vmx(vcpu);
> > > > >
> > > > > + if (!is_protmode(vcpu))
> > > > > + return 0;
> > > > > +
> > > > > + if (!is_long_mode(vcpu)
> > > > > + && (kvm_get_rflags(vcpu) & X86_EFLAGS_VM)) /* if virtual 8086
> > > > > */
> > > > > + return 3;
> > > > > +
> > > > > /*
> > > > > * If we enter real mode with cs.sel & 3 != 0, the normal CPL
> > > > > calculations
> > > > > * fail; use the cache instead.
> > > > >
> > > >
> > > >
> > > > This undoes the cache, now every vmx_get_cpl() in protected mode has to
> > > > VMREAD(GUEST_RFLAGS).
> > > True. Marcelo what failure do you see without the patch?
> > >
> > > --
> > > Gleb.
> >
> > On transition _to_ real mode, linearize fails due to CPL checks
> > (FreeBSD). I'll resend the patch with use of cache for
> > VMREAD(GUEST_RFLAGS), which is already implemented.
> I am curious does it still fails with all my vmx patches applied too?

Yes.

> The question is how does it happen that we enter real mode while cache
> is set to 3. It should never be 3 during boot since boot process never
> enters the userspace.

Its transition _to_ real mode (from protected).