It is not obvious that the CPL will be guessed right the next time
we run vmx_get_cpl. Make the code similar to SVM, and do the "guess"
already during vmx_set_segment while we have the correct value of CR0.PE.
For unrestricted guest mode, there is still a small window where CR0.PE
and we could set the CS selector to a real mode value. It is not clear
how the processor could know the correct CPL on the next vmentry in this
case; the only way to solve it would be to force invalid guest state
in that case and emulate protected mode entry until the long jump.
Do not do this yet, since unrestricted guest seems to work with the
test case that prompted this change.
Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx>
---
arch/x86/kvm/vmx.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 10256c27694d..7dc5fdd30d7f 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -3603,14 +3603,6 @@ static void vmx_set_segment(struct kvm_vcpu *vcpu,
const struct kvm_vmx_segment_field *sf = &kvm_vmx_segment_fields[seg];
vmx_segment_cache_clear(vmx);
- if (seg == VCPU_SREG_CS) {
- if (set_cpl) {
- __set_bit(VCPU_EXREG_CPL, (ulong *)&vcpu->arch.regs_avail);
- vmx->cpl = var->cpl;
- } else
- __clear_bit(VCPU_EXREG_CPL, (ulong *)&vcpu->arch.regs_avail);
- }
-
if (vmx->rmode.vm86_active && seg != VCPU_SREG_LDTR) {
vmx->rmode.segs[seg] = *var;
if (seg == VCPU_SREG_TR)
@@ -3640,6 +3632,14 @@ static void vmx_set_segment(struct kvm_vcpu *vcpu,
vmcs_write32(sf->ar_bytes, vmx_segment_access_rights(var));
+ if (seg == VCPU_SREG_CS) {
+ __set_bit(VCPU_EXREG_CPL, (ulong *)&vcpu->arch.regs_avail);
+ if (set_cpl)
+ vmx->cpl = var->cpl;
+ else
+ vmx->cpl = vmx_get_cpl(vcpu);
+ }
+
out:
vmx->emulation_required = emulation_required(vcpu);
}
--
1.8.3.1
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
