| Message ID | 20250224174522.2363400-1-seanjc@google.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | KVM: SVM: Inject #GP if memory operand for INVPCID is non-canonical | expand |
On Mon, 24 Feb 2025 09:45:22 -0800, Sean Christopherson wrote: > Inject a #GP if the memory operand received by INVCPID is non-canonical. > The APM clearly states that the intercept takes priority over all #GP > checks except the CPL0 restriction. > > Of course, that begs the question of how the CPU generates a linear > address in the first place. Tracing confirms that EXITINFO1 does hold a > linear address, at least for 64-bit mode guests (hooray GS prefix). > Unfortunately, the APM says absolutely nothing about the EXITINFO fields > for INVPCID intercepts, so it's not at all clear what's supposed to > happen. > > [...] Applied to kvm-x86 svm, thanks! [1/1] KVM: SVM: Inject #GP if memory operand for INVPCID is non-canonical https://github.com/kvm-x86/linux/commit/d4b69c3d1471 -- https://github.com/kvm-x86/linux/tree/next
diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index b8aa0f36850f..63268d940ce1 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -3272,6 +3272,17 @@ static int invpcid_interception(struct kvm_vcpu *vcpu) type = svm->vmcb->control.exit_info_2; gva = svm->vmcb->control.exit_info_1; + /* + * FIXME: Perform segment checks for 32-bit mode, and inject #SS if the + * stack segment is used. The intercept takes priority over all + * #GP checks except CPL>0, but somehow still generates a linear + * address? The APM is sorely lacking. + */ + if (is_noncanonical_address(gva, vcpu, 0)) { + kvm_queue_exception_e(vcpu, GP_VECTOR, 0); + return 1; + } + return kvm_handle_invpcid(vcpu, type, gva); }
Inject a #GP if the memory operand received by INVCPID is non-canonical. The APM clearly states that the intercept takes priority over all #GP checks except the CPL0 restriction. Of course, that begs the question of how the CPU generates a linear address in the first place. Tracing confirms that EXITINFO1 does hold a linear address, at least for 64-bit mode guests (hooray GS prefix). Unfortunately, the APM says absolutely nothing about the EXITINFO fields for INVPCID intercepts, so it's not at all clear what's supposed to happen. Add a FIXME to call out that KVM still does the wrong thing for 32-bit guests, and if the stack segment is used for the memory operand. Cc: Babu Moger <babu.moger@amd.com> Cc: Jim Mattson <jmattson@google.com> Fixes: 4407a797e941 ("KVM: SVM: Enable INVPCID feature on AMD") Signed-off-by: Sean Christopherson <seanjc@google.com> --- arch/x86/kvm/svm/svm.c | 11 +++++++++++ 1 file changed, 11 insertions(+) base-commit: fed48e2967f402f561d80075a20c5c9e16866e53