From: Krish Sadhukhan <krish.sadhukhan@oracle.com>
To: kvm@vger.kernel.org
Cc: rkrcmar@redhat.com, pbonzini@redhat.com, jmattson@google.com
Subject: [PATCH 1/2] KVM: nVMX: Check Host Address Space Size on vmentry of nested guests
Date: Fri, 9 Aug 2019 12:26:19 -0700 (PDT) [thread overview]
Message-ID: <20190809192620.29318-2-krish.sadhukhan@oracle.com> (raw)
In-Reply-To: <20190809192620.29318-1-krish.sadhukhan@oracle.com>
According to section "Checks Related to Address-Space Size" in Intel SDM
vol 3C, the following checks are performed on vmentry of nested guests:
If the logical processor is outside IA-32e mode (if IA32_EFER.LMA = 0)
at the time of VM entry, the following must hold:
- The "IA-32e mode guest" VM-entry control is 0.
- The "host address-space size" VM-exit control is 0.
If the logical processor is in IA-32e mode (if IA32_EFER.LMA = 1) at the
time of VM entry, the "host address-space size" VM-exit control must be 1.
If the "host address-space size" VM-exit control is 0, the following must
hold:
- The "IA-32e mode guest" VM-entry control is 0.
- Bit 17 of the CR4 field (corresponding to CR4.PCIDE) is 0.
- Bits 63:32 in the RIP field are 0.
If the "host address-space size" VM-exit control is 1, the following must
hold:
- Bit 5 of the CR4 field (corresponding to CR4.PAE) is 1.
- The RIP field contains a canonical address.
On processors that do not support Intel 64 architecture, checks are
performed to ensure that the "IA-32e mode guest" VM-entry control and the
"host address-space size" VM-exit control are both 0.
Signed-off-by: Krish Sadhukhan <krish.sadhukhan@oracle.com>
Reviewed-by: Karl Heubaum <karl.heubaum@oracle.com>
---
arch/x86/kvm/vmx/nested.c | 28 ++++++++++++++++++++++++++++
1 file changed, 28 insertions(+)
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index bb509c254939..4de61b069d8c 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -2649,6 +2649,34 @@ static int nested_vmx_check_host_state(struct kvm_vcpu *vcpu,
is_noncanonical_address(vmcs12->host_idtr_base, vcpu) ||
is_noncanonical_address(vmcs12->host_tr_base, vcpu))
return -EINVAL;
+
+ if (!(vmcs12->host_ia32_efer & EFER_LMA) &&
+ ((vmcs12->vm_entry_controls & VM_ENTRY_IA32E_MODE) ||
+ (vmcs12->vm_exit_controls & VM_EXIT_HOST_ADDR_SPACE_SIZE))) {
+ return -EINVAL;
+ }
+
+ if ((vmcs12->host_ia32_efer & EFER_LMA) &&
+ !(vmcs12->vm_exit_controls & VM_EXIT_HOST_ADDR_SPACE_SIZE)) {
+ return -EINVAL;
+ }
+
+ if (!(vmcs12->vm_exit_controls & VM_EXIT_HOST_ADDR_SPACE_SIZE) &&
+ ((vmcs12->vm_entry_controls & VM_ENTRY_IA32E_MODE) ||
+ (vmcs12->host_cr4 & X86_CR4_PCIDE) ||
+ (((vmcs12->host_rip) >> 32) & 0xffffffff))) {
+ return -EINVAL;
+ }
+
+ if ((vmcs12->vm_exit_controls & VM_EXIT_HOST_ADDR_SPACE_SIZE) &&
+ ((!(vmcs12->host_cr4 & X86_CR4_PAE)) ||
+ (is_noncanonical_address(vmcs12->host_rip, vcpu)))) {
+ return -EINVAL;
+ }
+#else
+ if (vmcs12->vm_entry_controls & VM_ENTRY_IA32E_MODE ||
+ vmcs12->vm_exit_controls & VM_EXIT_HOST_ADDR_SPACE_SIZE)
+ return -EINVAL;
#endif
/*
--
2.20.1
next prev parent reply other threads:[~2019-08-09 19:54 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-09 19:26 [PATCH 0/2] KVM: nVMX: Check Host Address Space Size on vmentry of nested guests Krish Sadhukhan
2019-08-09 19:26 ` Krish Sadhukhan [this message]
2019-08-09 19:26 ` [PATCH 2/2] kvm-unit-test: " Krish Sadhukhan
2019-09-17 14:52 ` [PATCH 0/2] KVM: " Paolo Bonzini
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190809192620.29318-2-krish.sadhukhan@oracle.com \
--to=krish.sadhukhan@oracle.com \
--cc=jmattson@google.com \
--cc=kvm@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=rkrcmar@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.