KVM: x86: MOV to CR3 can set bit 63 (9d88fca7) · Commits · 戴 / test

Although Intel SDM mentions bit 63 is reserved, MOV to CR3 can have bit 63 set. As Intel SDM states in section 4.10.4 "Invalidation of TLBs and Paging-Structure Caches": " MOV to CR3. ... If CR4.PCIDE = 1 and bit 63 of the instructionâ€™s source operand is 0 ..." In other words, bit 63 is not reserved. KVM emulator currently consider bit 63 as reserved. Fix it. Signed-off-by:

Nadav Amit <namit@cs.technion.ac.il> Signed-off-by:

Paolo Bonzini <pbonzini@redhat.com>

arch/x86/include/asm/kvm_host.h

+1 −0

Original line number	Diff line number	Diff line
		@@ -51,6 +51,7 @@
		\| X86_CR0_NW \| X86_CR0_CD \| X86_CR0_PG))

		#define CR3_L_MODE_RESERVED_BITS 0xFFFFFF0000000000ULL
		#define CR3_PCID_INVD (1UL << 63)
		#define CR4_RESERVED_BITS \
		(~(unsigned long)(X86_CR4_VME \| X86_CR4_PVI \| X86_CR4_TSD \| X86_CR4_DE\
		\| X86_CR4_PSE \| X86_CR4_PAE \| X86_CR4_MCE \

arch/x86/kvm/emulate.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -3564,7 +3564,7 @@ static int check_cr_write(struct x86_emulate_ctxt *ctxt)

		ctxt->ops->get_msr(ctxt, MSR_EFER, &efer);
		if (efer & EFER_LMA)
		rsvd = CR3_L_MODE_RESERVED_BITS;
		rsvd = CR3_L_MODE_RESERVED_BITS & ~CR3_PCID_INVD;

		if (new_val & rsvd)
		return emulate_gp(ctxt, 0);

arch/x86/kvm/x86.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -750,6 +750,8 @@ EXPORT_SYMBOL_GPL(kvm_set_cr4);

		int kvm_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
		{
		cr3 &= ~CR3_PCID_INVD;

		if (cr3 == kvm_read_cr3(vcpu) && !pdptrs_changed(vcpu)) {
		kvm_mmu_sync_roots(vcpu);
		kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);

Admin message