From: Krish Sadhukhan <krish.sadhukhan@oracle.com>
To: kvm@vger.kernel.org
Cc: pbonzini@redhat.com, jmattson@google.com, seanjc@google.com
Subject: [PATCH 4/7 v7] nSVM: Check addresses of MSR and IO permission maps
Date: Mon, 12 Apr 2021 17:56:08 -0400 [thread overview]
Message-ID: <20210412215611.110095-5-krish.sadhukhan@oracle.com> (raw)
In-Reply-To: <20210412215611.110095-1-krish.sadhukhan@oracle.com>
According to section "Canonicalization and Consistency Checks" in APM vol 2,
the following guest state is illegal:
"The MSR or IOIO intercept tables extend to a physical address that
is greater than or equal to the maximum supported physical address."
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Krish Sadhukhan <krish.sadhukhan@oracle.com>
---
arch/x86/kvm/svm/nested.c | 25 ++++++++++++++++++++++---
1 file changed, 22 insertions(+), 3 deletions(-)
diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
index fd42c8b7f99a..c3e5f4e7c987 100644
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -215,7 +215,19 @@ static bool nested_svm_vmrun_msrpm(struct vcpu_svm *svm)
return true;
}
-static bool nested_vmcb_check_controls(struct vmcb_control_area *control)
+/*
+ * Bits 11:0 of bitmap address are ignored by hardware
+ */
+static bool nested_svm_check_bitmap_pa(struct kvm_vcpu *vcpu, u64 pa, u32 size)
+{
+ u64 addr = PAGE_ALIGN(pa);
+
+ return kvm_vcpu_is_legal_gpa(vcpu, addr) &&
+ kvm_vcpu_is_legal_gpa(vcpu, addr + size - 1);
+}
+
+static bool nested_vmcb_check_controls(struct kvm_vcpu *vcpu,
+ struct vmcb_control_area *control)
{
if (CC(!vmcb_is_intercept(control, INTERCEPT_VMRUN)))
return false;
@@ -226,6 +238,13 @@ static bool nested_vmcb_check_controls(struct vmcb_control_area *control)
if (CC((control->nested_ctl & SVM_NESTED_CTL_NP_ENABLE) && !npt_enabled))
return false;
+ if (CC(!nested_svm_check_bitmap_pa(vcpu, control->msrpm_base_pa,
+ MSRPM_SIZE)))
+ return false;
+ if (CC(!nested_svm_check_bitmap_pa(vcpu, control->iopm_base_pa,
+ IOPM_SIZE)))
+ return false;
+
return true;
}
@@ -602,7 +621,7 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu)
nested_load_control_from_vmcb12(svm, &vmcb12->control);
if (!nested_vmcb_valid_sregs(vcpu, &vmcb12->save) ||
- !nested_vmcb_check_controls(&svm->nested.ctl)) {
+ !nested_vmcb_check_controls(vcpu, &svm->nested.ctl)) {
vmcb12->control.exit_code = SVM_EXIT_ERR;
vmcb12->control.exit_code_hi = SVM_CONSISTENCY_ERR;
vmcb12->control.exit_info_1 = 0;
@@ -1250,7 +1269,7 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu,
goto out_free;
ret = -EINVAL;
- if (!nested_vmcb_check_controls(ctl))
+ if (!nested_vmcb_check_controls(vcpu, ctl))
goto out_free;
/*
--
2.27.0
next prev parent reply other threads:[~2021-04-12 22:45 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-12 21:56 [PATCH 0/7 v7] KVM: nSVM: Check addresses of MSR bitmap and IO bitmap tables on vmrun of nested guests Krish Sadhukhan
2021-04-12 21:56 ` [PATCH 1/7 v7] KVM: SVM: Define actual size of IOPM and MSRPM tables Krish Sadhukhan
2021-04-12 21:56 ` [PATCH 2/7 v7] KVM: nSVM: Define an exit code to reflect consistency check failure Krish Sadhukhan
2021-04-17 14:17 ` Paolo Bonzini
2021-04-19 17:57 ` Krish Sadhukhan
2021-04-19 18:28 ` Paolo Bonzini
2021-04-19 18:36 ` Jim Mattson
2021-04-12 21:56 ` [PATCH 3/7 v7] KVM: nSVM: No need to set bits 11:0 in MSRPM and IOPM bitmaps Krish Sadhukhan
2021-04-17 14:18 ` Paolo Bonzini
2021-04-20 20:00 ` Sean Christopherson
2021-04-22 17:50 ` Krish Sadhukhan
2021-04-22 17:52 ` Krish Sadhukhan
2021-04-22 17:56 ` Krish Sadhukhan
2021-04-22 18:01 ` Sean Christopherson
2021-04-23 1:12 ` Krish Sadhukhan
2021-04-23 15:56 ` Sean Christopherson
2021-04-23 20:31 ` Paolo Bonzini
2021-04-26 21:59 ` Krish Sadhukhan
2021-04-26 22:07 ` Sean Christopherson
2021-04-12 21:56 ` Krish Sadhukhan [this message]
2021-04-12 21:56 ` [PATCH 5/7 v7] SVM: Use ALIGN macro when aligning 'io_bitmap_area' Krish Sadhukhan
2021-04-12 21:56 ` [PATCH 6/7 v7] nSVM: Define an exit code to reflect consistency check failure Krish Sadhukhan
2021-04-12 21:56 ` [PATCH 7/7 v7] nSVM: Test addresses of MSR and IO permissions maps Krish Sadhukhan
2021-04-17 14:35 ` [PATCH 0/7 v7] KVM: nSVM: Check addresses of MSR bitmap and IO bitmap tables on vmrun of nested guests Paolo Bonzini
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210412215611.110095-5-krish.sadhukhan@oracle.com \
--to=krish.sadhukhan@oracle.com \
--cc=jmattson@google.com \
--cc=kvm@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=seanjc@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).