From mboxrd@z Thu Jan 1 00:00:00 1970 From: Avi Kivity Subject: Re: [PATCH] VMX: Fix and improve guest state validity checks Date: Tue, 25 May 2010 12:37:40 +0300 Message-ID: <4BFB9A64.8070803@redhat.com> References: <1273596761-29923-1-git-send-email-m.gamal005@gmail.com> <4BEB9B04.4060302@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: mtosatti@redhat.com, kvm@vger.kernel.org To: Mohammed Gamal Return-path: Received: from mx1.redhat.com ([209.132.183.28]:60255 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932169Ab0EYJhn (ORCPT ); Tue, 25 May 2010 05:37:43 -0400 In-Reply-To: Sender: kvm-owner@vger.kernel.org List-ID: On 05/13/2010 11:15 PM, Mohammed Gamal wrote: > On Thu, May 13, 2010 at 9:24 AM, Avi Kivity wrote: > >> On 05/11/2010 07:52 PM, Mohammed Gamal wrote: >> >>> - Add 's' and 'g' field checks on segment registers >>> - Correct SS checks for request and descriptor privilege levels >>> >>> Signed-off-by: Mohammed Gamal >>> --- >>> arch/x86/kvm/vmx.c | 73 >>> +++++++++++++++++++++++++++++++++++++++++++++++---- >>> 1 files changed, 67 insertions(+), 6 deletions(-) >>> >>> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c >>> index 777e00d..9805c2a 100644 >>> --- a/arch/x86/kvm/vmx.c >>> +++ b/arch/x86/kvm/vmx.c >>> @@ -2121,16 +2121,30 @@ static bool stack_segment_valid(struct kvm_vcpu >>> *vcpu) >>> vmx_get_segment(vcpu,&ss, VCPU_SREG_SS); >>> ss_rpl = ss.selector& SELECTOR_RPL_MASK; >>> >>> - if (ss.unusable) >>> + if (ss.dpl != ss_rpl) /* DPL != RPL */ >>> + return false; >>> + >>> + if (ss.unusable) /* Short-circuit */ >>> return true; >>> >>> >> If ss.unusable, do the dpl and rpl have any meaning? >> > The idea is that dpl and rpl are checked on vmentry regardless of > whether ss is usable or not. While the other checks are performed only > if ss is usable. > Any reference to back this up? I think rpl is valid regardless of ss.unusable (i.e. loading selector 0003 results in an unusable segment with rpl=3), but I don't see how dpl can be valid in an unusable segment. -- error compiling committee.c: too many arguments to function