All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sean Christopherson <seanjc@google.com>
To: Paolo Bonzini <pbonzini@redhat.com>
Cc: Sean Christopherson <seanjc@google.com>,
	Vitaly Kuznetsov <vkuznets@redhat.com>,
	Wanpeng Li <wanpengli@tencent.com>,
	Jim Mattson <jmattson@google.com>, Joerg Roedel <joro@8bytes.org>,
	kvm@vger.kernel.org, linux-kernel@vger.kernel.org,
	Babu Moger <babu.moger@amd.com>,
	Joao Martins <joao.m.martins@oracle.com>,
	David Woodhouse <dwmw@amazon.co.uk>
Subject: [PATCH 6/9] KVM: nVMX: Truncate base/index GPR value on address calc in !64-bit
Date: Fri, 12 Feb 2021 17:05:15 -0800	[thread overview]
Message-ID: <20210213010518.1682691-7-seanjc@google.com> (raw)
In-Reply-To: <20210213010518.1682691-1-seanjc@google.com>

Drop bits 63:32 of the base and/or index GPRs when calculating the
effective address of a VMX instruction memory operand.  Outside of 64-bit
mode, memory encodings are strictly limited to E*X and below.

Fixes: 064aea774768 ("KVM: nVMX: Decoding memory operands of VMX instructions")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 arch/x86/kvm/vmx/nested.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index d6c892ea551c..a02d8744ca66 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -4601,9 +4601,9 @@ int get_vmx_mem_address(struct kvm_vcpu *vcpu, unsigned long exit_qualification,
 	else if (addr_size == 0)
 		off = (gva_t)sign_extend64(off, 15);
 	if (base_is_valid)
-		off += kvm_register_read(vcpu, base_reg);
+		off += kvm_register_readl(vcpu, base_reg);
 	if (index_is_valid)
-		off += kvm_register_read(vcpu, index_reg) << scaling;
+		off += kvm_register_readl(vcpu, index_reg) << scaling;
 	vmx_get_segment(vcpu, &s, seg_reg);
 
 	/*
-- 
2.30.0.478.g8a0d178c01-goog


  parent reply	other threads:[~2021-02-13  1:08 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-02-13  1:05 [PATCH 0/9] KVM: x86: Fixes for (benign?) truncation bugs Sean Christopherson
2021-02-13  1:05 ` [PATCH 1/9] KVM: x86: Remove emulator's broken checks on CR0/CR3/CR4 loads Sean Christopherson
2021-02-13  1:05 ` [PATCH 2/9] KVM: x86: Check CR3 GPA for validity regardless of vCPU mode Sean Christopherson
2021-02-13  1:05 ` [PATCH 3/9] KVM: SVM: Truncate GPR value for DR and CR accesses in !64-bit mode Sean Christopherson
2021-02-13  1:05 ` [PATCH 4/9] KVM: VMX: Truncate GPR value for DR and CR reads " Sean Christopherson
2021-02-13  1:05 ` [PATCH 5/9] KVM: nVMX: Truncate bits 63:32 of VMCS field on nested check in !64-bit Sean Christopherson
2021-02-13  1:05 ` Sean Christopherson [this message]
2021-02-13  1:05 ` [PATCH 7/9] KVM: x86/xen: Drop RAX[63:32] when processing hypercall Sean Christopherson
2021-02-13  1:05 ` [PATCH 8/9] KVM: SVM: Use default rAX size for INVLPGA emulation Sean Christopherson
2021-02-13  1:05 ` [PATCH 9/9] KVM: x86: Rename GPR accessors to make mode-aware variants the defaults Sean Christopherson

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210213010518.1682691-7-seanjc@google.com \
    --to=seanjc@google.com \
    --cc=babu.moger@amd.com \
    --cc=dwmw@amazon.co.uk \
    --cc=jmattson@google.com \
    --cc=joao.m.martins@oracle.com \
    --cc=joro@8bytes.org \
    --cc=kvm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=pbonzini@redhat.com \
    --cc=vkuznets@redhat.com \
    --cc=wanpengli@tencent.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.