From: Krish Sadhukhan <krish.sadhukhan@oracle.com>
To: kvm@vger.kernel.org
Cc: pbonzini@redhat.com, seanjc@google.com, jmattson@google.com
Subject: [PATCH 1/2 v5] KVM: nSVM: Check reserved values for 'Type' and invalid vectors in EVENTINJ
Date: Sat, 12 Dec 2020 00:50:18 +0000 [thread overview]
Message-ID: <20201212005019.6807-2-krish.sadhukhan@oracle.com> (raw)
In-Reply-To: <20201212005019.6807-1-krish.sadhukhan@oracle.com>
According to sections "Canonicalization and Consistency Checks" and "Event
Injection" in APM vol 2
VMRUN exits with VMEXIT_INVALID error code if either:
- Reserved values of TYPE have been specified, or
- TYPE = 3 (exception) has been specified with a vector that does not
correspond to an exception (this includes vector 2, which is an NMI,
not an exception).
Signed-off-by: Krish Sadhukhan <krish.sadhukhan@oracle.com>
---
arch/x86/include/asm/svm.h | 4 ++++
arch/x86/kvm/svm/nested.c | 15 +++++++++++++++
2 files changed, 19 insertions(+)
diff --git a/arch/x86/include/asm/svm.h b/arch/x86/include/asm/svm.h
index 71d630bb5e08..d676f140cd19 100644
--- a/arch/x86/include/asm/svm.h
+++ b/arch/x86/include/asm/svm.h
@@ -341,9 +341,13 @@ struct vmcb {
#define SVM_EVTINJ_TYPE_MASK (7 << SVM_EVTINJ_TYPE_SHIFT)
#define SVM_EVTINJ_TYPE_INTR (0 << SVM_EVTINJ_TYPE_SHIFT)
+#define SVM_EVTINJ_TYPE_RESV1 (1 << SVM_EVTINJ_TYPE_SHIFT)
#define SVM_EVTINJ_TYPE_NMI (2 << SVM_EVTINJ_TYPE_SHIFT)
#define SVM_EVTINJ_TYPE_EXEPT (3 << SVM_EVTINJ_TYPE_SHIFT)
#define SVM_EVTINJ_TYPE_SOFT (4 << SVM_EVTINJ_TYPE_SHIFT)
+#define SVM_EVTINJ_TYPE_RESV5 (5 << SVM_EVTINJ_TYPE_SHIFT)
+#define SVM_EVTINJ_TYPE_RESV6 (6 << SVM_EVTINJ_TYPE_SHIFT)
+#define SVM_EVTINJ_TYPE_RESV7 (7 << SVM_EVTINJ_TYPE_SHIFT)
#define SVM_EVTINJ_VALID (1 << 31)
#define SVM_EVTINJ_VALID_ERR (1 << 11)
diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
index 9e4c226dbf7d..cb5593bdda11 100644
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -212,6 +212,10 @@ static bool svm_get_nested_state_pages(struct kvm_vcpu *vcpu)
static bool nested_vmcb_check_controls(struct vmcb_control_area *control)
{
+ u8 vector;
+ u32 type;
+ bool valid;
+
if ((vmcb_is_intercept(control, INTERCEPT_VMRUN)) == 0)
return false;
@@ -222,6 +226,17 @@ static bool nested_vmcb_check_controls(struct vmcb_control_area *control)
!npt_enabled)
return false;
+ valid = control->event_inj & SVM_EVTINJ_VALID;
+ type = control->event_inj & SVM_EVTINJ_TYPE_MASK;
+ if (valid && (type == SVM_EVTINJ_TYPE_RESV1 ||
+ type >= SVM_EVTINJ_TYPE_RESV5))
+ return false;
+
+ vector = control->event_inj & SVM_EVTINJ_VEC_MASK;
+ if (valid && type == SVM_EVTINJ_TYPE_EXEPT &&
+ (vector == NMI_VECTOR || vector > 31))
+ return false;
+
return true;
}
--
2.27.0
next prev parent reply other threads:[~2020-12-12 0:56 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-12 0:50 [PATCH 0/2 v5] KVM: nSVM: Check reserved values for 'Type' and invalid vectors in EVENTINJ Krish Sadhukhan
2020-12-12 0:50 ` Krish Sadhukhan [this message]
2020-12-12 0:50 ` [PATCH 2/2 v5] nSVM: Test " Krish Sadhukhan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201212005019.6807-2-krish.sadhukhan@oracle.com \
--to=krish.sadhukhan@oracle.com \
--cc=jmattson@google.com \
--cc=kvm@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=seanjc@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).