Re: [PATCH v3 3/4] KVM: SVM: Fix CPL updates

[Kevin Wolf <kwolf@redhat.com>]

Am 06.02.2012 10:57, schrieb Gleb Natapov:
> On Mon, Feb 06, 2012 at 10:18:35AM +0100, Kevin Wolf wrote:
>> Am 05.02.2012 12:16, schrieb Gleb Natapov:
>>> On Fri, Feb 03, 2012 at 07:29:24PM +0100, Kevin Wolf wrote:
>>>> Keep CPL at 0 in real mode and at 3 in VM86. In protected/long mode, use
>>>> RPL rather than DPL of the code segment.
>>>>
>>>> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
>>>> ---
>>>>  arch/x86/kvm/svm.c |   19 ++++++++++++++++---
>>>>  1 files changed, 16 insertions(+), 3 deletions(-)
>>>>
>>>> diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
>>>> index 6a977c1..4124a7e 100644
>>>> --- a/arch/x86/kvm/svm.c
>>>> +++ b/arch/x86/kvm/svm.c
>>>> @@ -1263,6 +1263,21 @@ static void svm_vcpu_put(struct kvm_vcpu *vcpu)
>>>>  		wrmsrl(host_save_user_msrs[i], svm->host_user_msrs[i]);
>>>>  }
>>>>  
>>>> +static void svm_update_cpl(struct kvm_vcpu *vcpu)
>>>> +{
>>>> +	struct vcpu_svm *svm = to_svm(vcpu);
>>>> +	int cpl;
>>>> +
>>>> +	if (!is_protmode(vcpu))
>>>> +		cpl = 0;
>>>> +	else if (svm->vmcb->save.rflags & X86_EFLAGS_VM)
>>>> +		cpl = 3;
>>>> +	else
>>>> +		cpl = svm->vmcb->save.cs.selector & 0x3;
>>>> +
>>>> +	svm->vmcb->save.cpl = cpl;
>>>> +}
>>>> +
>>> As you probably know already I think cpl should be updated in
>>> svm_get_rflags() too. With current patch restoring CS segment
>>> register before rflags register after migration may cause cpl
>>> to get wrong value for instance.
>>
>> I think you mean set_rflags rather than get_rflags?
>>
> Uh, yes.
> 
>> Patch 4 adds this with the set_rflags emulator callback.
>>
> Sorry, missed that, I expected it to be in this patch for some reason.
> 
> I think calling svm_update_cpl() from set_rflags() is incorrect though.
> svm_update_cpl() checks cr0 so if guest does "mov 1, %cr0; popf" and
> popf happens to be emulated it will change cpl to cs&3 which is
> incorrect.

Good point. The easy, but IMHO somewhat hackish way to fix it is to only
call svm_update_cpl() if the VM flag has changed.

For the real thing, we'd have to know whether we are in the middle of a
mode switch, i.e. whether the segment selector is a protected mode or
real mode selector. I don't think we have this information, do we?

Kevin