[PATCH] VMX: Invalid guest state detection enhancements and bug fixes

[Mohammed Gamal <m.gamal005@xxxxxxxxx>]

- Correct unusable flag check on SS, DS, ES, FS, GS, and LDTR
- Add IDTR and GDTR checks
- Add rflags checks

Signed-off-by: Mohammed Gamal <m.gamal005@xxxxxxxxx>
---
 arch/x86/kvm/vmx.c |   64 ++++++++++++++++++++++++++++++++++++++++++++++++---
 1 files changed, 60 insertions(+), 4 deletions(-)

diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 777e00d..f736008 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2122,7 +2122,7 @@ static bool stack_segment_valid(struct kvm_vcpu *vcpu)
 	ss_rpl = ss.selector & SELECTOR_RPL_MASK;
 
 	if (ss.unusable)
-		return true;
+		return false;
 	if (ss.type != 3 && ss.type != 7)
 		return false;
 	if (!ss.s)
@@ -2144,7 +2144,7 @@ static bool data_segment_valid(struct kvm_vcpu *vcpu, int seg)
 	rpl = var.selector & SELECTOR_RPL_MASK;
 
 	if (var.unusable)
-		return true;
+		return false;
 	if (!var.s)
 		return false;
 	if (!var.present)
@@ -2185,7 +2185,7 @@ static bool ldtr_valid(struct kvm_vcpu *vcpu)
 	vmx_get_segment(vcpu, &ldtr, VCPU_SREG_LDTR);
 
 	if (ldtr.unusable)
-		return true;
+		return false;
 	if (ldtr.selector & SELECTOR_TI_MASK)	/* TI = 1 */
 		return false;
 	if (ldtr.type != 2)
@@ -2196,6 +2196,23 @@ static bool ldtr_valid(struct kvm_vcpu *vcpu)
 	return true;
 }
 
+static bool gdtr_idtr_valid(struct kvm_vcpu *vcpu)
+{
+	struct desc_ptr gdt;
+	struct desc_ptr idt;
+
+	vmx_get_gdt(vcpu, &gdt);
+	vmx_get_idt(vcpu, &idt);
+
+	if (gdt.size & 0xffff0000)
+		return false;
+
+	if (idt.size & 0xffff0000)
+		return false;
+
+	return true;
+}
+
 static bool cs_ss_rpl_check(struct kvm_vcpu *vcpu)
 {
 	struct kvm_segment cs, ss;
@@ -2207,6 +2224,41 @@ static bool cs_ss_rpl_check(struct kvm_vcpu *vcpu)
 		 (ss.selector & SELECTOR_RPL_MASK));
 }
 
+static bool rflags_valid(struct kvm_vcpu *vcpu)
+{
+	unsigned long rflags;
+	u32 entry_intr_info;
+
+	rflags = vmcs_readl(GUEST_RFLAGS);
+	entry_intr_info = vmcs_read32(VM_ENTRY_INTR_INFO_FIELD);
+#ifdef CONFIG_X86_64
+	if (rflags & 0xffffffffffc00000)
+		return false;
+	if (is_long_mode(vcpu))
+		if (rflags & X86_EFLAGS_VM)
+			return false;	
+#else
+	if (rflags & 0xffc00000)
+		return false;
+#endif
+	if (rflags & 0x8000)
+		return false;
+	if (rflags & 0x20)
+		return false;
+	if (rflags & 0x8)
+		return false;
+	if (!(rflags & 0x2))
+		return false;
+
+	if ((entry_intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_EXT_INTR 
+		&& (entry_intr_info & INTR_INFO_VALID_MASK)) {
+		if (!(rflags & X86_EFLAGS_IF))
+			return false;
+	}
+
+	return true;
+}
+
 /*
  * Check if guest state is valid. Returns true if valid, false if
  * not.
@@ -2251,8 +2303,11 @@ static bool guest_state_valid(struct kvm_vcpu *vcpu)
 	}
 	/* TODO:
 	 * - Add checks on RIP
-	 * - Add checks on RFLAGS
 	 */
+	if (!rflags_valid(vcpu))
+		return false;
+	if (!gdtr_idtr_valid(vcpu))
+		return false;
 
 	return true;
 }
@@ -3559,6 +3614,7 @@ static int handle_invalid_guest_state(struct kvm_vcpu *vcpu)
 		}
 
 		if (err != EMULATE_DONE) {
+			kvm_report_emulation_failure(vcpu, "invalid guest state handler");
 			vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
 			vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION;
 			vcpu->run->internal.ndata = 0;
-- 
1.7.0.4

--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html