From patchwork Tue Oct 6 19:06:51 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Krish Sadhukhan X-Patchwork-Id: 11819079 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 8AA4714F7 for ; Tue, 6 Oct 2020 19:07:11 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 61A88206F4 for ; Tue, 6 Oct 2020 19:07:11 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=oracle.com header.i=@oracle.com header.b="KpQv3zNS" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727007AbgJFTHJ (ORCPT ); Tue, 6 Oct 2020 15:07:09 -0400 Received: from userp2120.oracle.com ([156.151.31.85]:57522 "EHLO userp2120.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727002AbgJFTHJ (ORCPT ); Tue, 6 Oct 2020 15:07:09 -0400 Received: from pps.filterd (userp2120.oracle.com [127.0.0.1]) by userp2120.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 096IxRiZ088708; Tue, 6 Oct 2020 19:07:04 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references; s=corp-2020-01-29; bh=708udkJmuvBzBN+G7FJxjGzlQoGjWc2P1e/kMUoa7m0=; b=KpQv3zNSkeMp7sI5gCTTalhXiJSrjBikdOgL0LPig0Jhh9edmy/AaWrXHHTiJMPMJ0Mt MYBRILaBDr8yrPB5Ik4aRlMUWG1mq8yk+nWMYpxx9yS/AjKQkn+UkVGB6ZIm1FDTj7aK TD6ktCojLtaHouHB1sUbtYST+jMTGWp+/sYHRsc4WU1YSSutHOfKEL0vRBAY61s6I3be Pj/2GLBvcN/Wzetfm2QNxQkJgkM34DjHmFy/e7AAfqXIH8XO/nG3x/xwkiJL4dDo0ZZJ 5IfR2WznrIWOcBOrLdg4KezIQsdNL85G7XASe9UU6k3NE8uiInRG5zBfxoajtKsvRIOB zw== Received: from userp3020.oracle.com (userp3020.oracle.com [156.151.31.79]) by userp2120.oracle.com with ESMTP id 33xhxmwuqb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL); Tue, 06 Oct 2020 19:07:04 +0000 Received: from pps.filterd (userp3020.oracle.com [127.0.0.1]) by userp3020.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 096J1BeH095817; Tue, 6 Oct 2020 19:07:04 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by userp3020.oracle.com with ESMTP id 33yyjg2kyx-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 06 Oct 2020 19:07:03 +0000 Received: from abhmp0015.oracle.com (abhmp0015.oracle.com [141.146.116.21]) by aserv0121.oracle.com (8.14.4/8.13.8) with ESMTP id 096J72Y8025555; Tue, 6 Oct 2020 19:07:02 GMT Received: from nsvm-sadhukhan-1.osdevelopmeniad.oraclevcn.com (/100.100.230.216) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 06 Oct 2020 12:07:02 -0700 From: Krish Sadhukhan To: kvm@vger.kernel.org Cc: pbonzini@redhat.com, jmattson@google.com, sean.j.christopherson@intel.com Subject: [PATCH 1/4 v3] KVM: nSVM: CR3 MBZ bits are only 63:52 Date: Tue, 6 Oct 2020 19:06:51 +0000 Message-Id: <20201006190654.32305-2-krish.sadhukhan@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20201006190654.32305-1-krish.sadhukhan@oracle.com> References: <20201006190654.32305-1-krish.sadhukhan@oracle.com> X-Proofpoint-Virus-Version: vendor=nai engine=6000 definitions=9766 signatures=668680 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=1 adultscore=0 bulkscore=0 phishscore=0 mlxlogscore=999 mlxscore=0 spamscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2010060123 X-Proofpoint-Virus-Version: vendor=nai engine=6000 definitions=9766 signatures=668680 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 malwarescore=0 bulkscore=0 impostorscore=0 lowpriorityscore=0 suspectscore=1 phishscore=0 mlxlogscore=999 adultscore=0 clxscore=1015 spamscore=0 priorityscore=1501 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2010060123 Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org Commit 761e4169346553c180bbd4a383aedd72f905bc9a created a wrong mask for the CR3 MBZ bits. According to APM vol 2, only the upper 12 bits are MBZ. (Fixes 761e4169346553c180bbd4a383aedd72f905bc9a) Signed-off-by: Krish Sadhukhan --- arch/x86/kvm/svm/svm.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h index a798e1731709..c0d75b1e0664 100644 --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -345,7 +345,7 @@ static inline bool gif_set(struct vcpu_svm *svm) /* svm.c */ #define MSR_CR3_LEGACY_RESERVED_MASK 0xfe7U #define MSR_CR3_LEGACY_PAE_RESERVED_MASK 0x7U -#define MSR_CR3_LONG_RESERVED_MASK 0xfff0000000000fe7U +#define MSR_CR3_LONG_MBZ_MASK 0xfff0000000000000U #define MSR_INVALID 0xffffffffU u32 svm_msrpm_offset(u32 msr); From patchwork Tue Oct 6 19:06:52 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Krish Sadhukhan X-Patchwork-Id: 11819085 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id BE21B6CA for ; Tue, 6 Oct 2020 19:09:10 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9B5D0206B5 for ; Tue, 6 Oct 2020 19:09:10 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=oracle.com header.i=@oracle.com header.b="hR9/EHHN" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726960AbgJFTJJ (ORCPT ); Tue, 6 Oct 2020 15:09:09 -0400 Received: from aserp2130.oracle.com ([141.146.126.79]:47938 "EHLO aserp2130.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726943AbgJFTJJ (ORCPT ); Tue, 6 Oct 2020 15:09:09 -0400 Received: from pps.filterd (aserp2130.oracle.com [127.0.0.1]) by aserp2130.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 096J09xF109287; Tue, 6 Oct 2020 19:09:05 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references; s=corp-2020-01-29; bh=rdka2jjTEeN3nmXtfJ22paxgOqiCjdnOwofrk9ZtLMI=; b=hR9/EHHNllnkKNapywvLZF2vgyDlViH++na5iMjTPf+i6xiM8XhOCOmT/xy+J9JP0BvX 5IbamQ47alm+xzUwVt6R2XZGMBskscoNpjN8BHbkN6myLx51oSzQrpSqnu475lLt1HjW EsL9BjJih3qcU3pUqjJp0Pvfn7aizeUHsmCQ7e69Il8rJQq8M3QJ7SqoeIVKRLP3okBT wGka2nRuuOQVO6Ve++t32VHvGOm4af7TuDit/8SgcV+NRPnLSr52si2+kYEDZ4o6N9XP QhnXU/+Hknewkf08iBZCFfU4vh5VVb1SiVdNIt92byvC98ReB8CKyOcZ1Pg9m9wuYHP3 wg== Received: from aserp3020.oracle.com (aserp3020.oracle.com [141.146.126.70]) by aserp2130.oracle.com with ESMTP id 33xetax3sd-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL); Tue, 06 Oct 2020 19:09:05 +0000 Received: from pps.filterd (aserp3020.oracle.com [127.0.0.1]) by aserp3020.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 096J0oxf109698; Tue, 6 Oct 2020 19:07:04 GMT Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by aserp3020.oracle.com with ESMTP id 33y36yf1jk-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 06 Oct 2020 19:07:04 +0000 Received: from abhmp0015.oracle.com (abhmp0015.oracle.com [141.146.116.21]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id 096J73Nj004251; Tue, 6 Oct 2020 19:07:03 GMT Received: from nsvm-sadhukhan-1.osdevelopmeniad.oraclevcn.com (/100.100.230.216) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 06 Oct 2020 12:07:03 -0700 From: Krish Sadhukhan To: kvm@vger.kernel.org Cc: pbonzini@redhat.com, jmattson@google.com, sean.j.christopherson@intel.com Subject: [PATCH 2/4 v3] KVM: nSVM: Add check for reserved bits for CR3, CR4, DR6, DR7 and EFER to svm_set_nested_state() Date: Tue, 6 Oct 2020 19:06:52 +0000 Message-Id: <20201006190654.32305-3-krish.sadhukhan@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20201006190654.32305-1-krish.sadhukhan@oracle.com> References: <20201006190654.32305-1-krish.sadhukhan@oracle.com> X-Proofpoint-Virus-Version: vendor=nai engine=6000 definitions=9766 signatures=668680 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=999 adultscore=0 bulkscore=0 spamscore=0 malwarescore=0 suspectscore=1 phishscore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2010060123 X-Proofpoint-Virus-Version: vendor=nai engine=6000 definitions=9766 signatures=668680 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 spamscore=0 mlxscore=0 clxscore=1015 priorityscore=1501 adultscore=0 mlxlogscore=999 phishscore=0 impostorscore=0 malwarescore=0 suspectscore=1 lowpriorityscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2010060123 Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org The path for SVM_SET_NESTED_STATE needs to have the same checks for the CPU registers, as we have in the VMRUN path for a nested guest. This patch adds those missing checks to svm_set_nested_state(). Suggested-by: Sean Christopherson Signed-off-by: Krish Sadhukhan --- arch/x86/kvm/svm/nested.c | 49 +++++++++++++++++++++------------------ 1 file changed, 27 insertions(+), 22 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index e90bc436f584..28a931fa599e 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -215,9 +215,29 @@ static bool nested_vmcb_check_controls(struct vmcb_control_area *control) return true; } +static bool nested_vmcb_check_cr3_cr4(struct vcpu_svm *svm, + struct vmcb_save_area *save) +{ + if ((save->efer & EFER_LME) && (save->cr0 & X86_CR0_PG)) { + if (!(save->cr4 & X86_CR4_PAE) || !(save->cr0 & X86_CR0_PE) || + (save->cr3 & MSR_CR3_LONG_MBZ_MASK)) + return false; + } else if (save->cr4 & X86_CR4_PAE) { + if (save->cr3 & MSR_CR3_LEGACY_PAE_RESERVED_MASK) + return false; + } else { + if (save->cr3 & MSR_CR3_LEGACY_RESERVED_MASK) + return false; + } + + if (kvm_valid_cr4(&svm->vcpu, save->cr4)) + return false; + + return true; +} + static bool nested_vmcb_checks(struct vcpu_svm *svm, struct vmcb *vmcb) { - bool nested_vmcb_lma; if ((vmcb->save.efer & EFER_SVME) == 0) return false; @@ -228,25 +248,7 @@ static bool nested_vmcb_checks(struct vcpu_svm *svm, struct vmcb *vmcb) if (!kvm_dr6_valid(vmcb->save.dr6) || !kvm_dr7_valid(vmcb->save.dr7)) return false; - nested_vmcb_lma = - (vmcb->save.efer & EFER_LME) && - (vmcb->save.cr0 & X86_CR0_PG); - - if (!nested_vmcb_lma) { - if (vmcb->save.cr4 & X86_CR4_PAE) { - if (vmcb->save.cr3 & MSR_CR3_LEGACY_PAE_RESERVED_MASK) - return false; - } else { - if (vmcb->save.cr3 & MSR_CR3_LEGACY_RESERVED_MASK) - return false; - } - } else { - if (!(vmcb->save.cr4 & X86_CR4_PAE) || - !(vmcb->save.cr0 & X86_CR0_PE) || - (vmcb->save.cr3 & MSR_CR3_LONG_RESERVED_MASK)) - return false; - } - if (kvm_valid_cr4(&svm->vcpu, vmcb->save.cr4)) + if (!nested_vmcb_check_cr3_cr4(svm, &(vmcb->save))) return false; return nested_vmcb_check_controls(&vmcb->control); @@ -1116,9 +1118,12 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu, /* * Validate host state saved from before VMRUN (see * nested_svm_check_permissions). - * TODO: validate reserved bits for all saved state. */ - if (!(save.cr0 & X86_CR0_PG)) + if (!(save.cr0 & X86_CR0_PG) || + !nested_vmcb_check_cr3_cr4(svm, &save) || + !kvm_dr6_valid(save.dr6) || + !kvm_dr7_valid(save.dr7) || + !kvm_valid_efer(vcpu, save.efer)) return -EINVAL; /* From patchwork Tue Oct 6 19:06:53 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Krish Sadhukhan X-Patchwork-Id: 11819083 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 6235759D for ; Tue, 6 Oct 2020 19:07:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3C803206F4 for ; Tue, 6 Oct 2020 19:07:17 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=oracle.com header.i=@oracle.com header.b="SSiNHggV" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727025AbgJFTHQ (ORCPT ); Tue, 6 Oct 2020 15:07:16 -0400 Received: from userp2120.oracle.com ([156.151.31.85]:57586 "EHLO userp2120.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727018AbgJFTHO (ORCPT ); Tue, 6 Oct 2020 15:07:14 -0400 Received: from pps.filterd (userp2120.oracle.com [127.0.0.1]) by userp2120.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 096IxPu5088592; Tue, 6 Oct 2020 19:07:06 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references; s=corp-2020-01-29; bh=WlsT3nGyPUgfvtjyhik+PX0/iFyko6GrgHTE0WmTI2w=; b=SSiNHggVg0v16V+PWiHHCv+yluvxKd0cH3t3kRPKfxjU2Ab+xm+2dhcoR0QRCRTifMpQ BcuC6pqxKUubSdGv0ejq+4Z86FLZ1+LegGL4z1JFq97h9oQKW1asCga1ZpjfgD7zQrU5 0+7yAZ3+XSNgcEzUlxaCael21hujy6lMIrHb8EEWnzFB4/Hsaqzf6G1ZyEl7gsa46qsK xdE0OyqN6M3J7b+iwnOVxhONiwhyDfHh6BXHDKT94ycdcS07pxqZRg6RDNBUdidC2Qr1 BObG4Y/xWP7d7e4EH03HOrTS/frLNfbUoeRczcfa02SHYBY7hJxeg8m++EoQYeFEnfYe 3A== Received: from aserp3030.oracle.com (aserp3030.oracle.com [141.146.126.71]) by userp2120.oracle.com with ESMTP id 33xhxmwuqf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL); Tue, 06 Oct 2020 19:07:05 +0000 Received: from pps.filterd (aserp3030.oracle.com [127.0.0.1]) by aserp3030.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 096J1IDu134166; Tue, 6 Oct 2020 19:07:05 GMT Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by aserp3030.oracle.com with ESMTP id 33y2vnep1x-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 06 Oct 2020 19:07:05 +0000 Received: from abhmp0015.oracle.com (abhmp0015.oracle.com [141.146.116.21]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id 096J73Zm016157; Tue, 6 Oct 2020 19:07:04 GMT Received: from nsvm-sadhukhan-1.osdevelopmeniad.oraclevcn.com (/100.100.230.216) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 06 Oct 2020 12:07:03 -0700 From: Krish Sadhukhan To: kvm@vger.kernel.org Cc: pbonzini@redhat.com, jmattson@google.com, sean.j.christopherson@intel.com Subject: [PATCH 3/4 v3] nSVM: Test non-MBZ reserved bits in CR3 in long mode and legacy PAE mode Date: Tue, 6 Oct 2020 19:06:53 +0000 Message-Id: <20201006190654.32305-4-krish.sadhukhan@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20201006190654.32305-1-krish.sadhukhan@oracle.com> References: <20201006190654.32305-1-krish.sadhukhan@oracle.com> X-Proofpoint-Virus-Version: vendor=nai engine=6000 definitions=9766 signatures=668680 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 mlxlogscore=999 malwarescore=0 suspectscore=1 spamscore=0 phishscore=0 bulkscore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2010060123 X-Proofpoint-Virus-Version: vendor=nai engine=6000 definitions=9766 signatures=668680 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 malwarescore=0 bulkscore=0 impostorscore=0 lowpriorityscore=0 suspectscore=1 phishscore=0 mlxlogscore=999 adultscore=0 clxscore=1015 spamscore=0 priorityscore=1501 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2010060123 Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org According to section "CR3" in APM vol. 2, the non-MBZ reserved bits in CR3 need to be set by software as follows: "Reserved Bits. Reserved fields should be cleared to 0 by software when writing CR3." But experiments show that consistency checking in SVM ignores these non-MBZ-reserved bits in CR3, meaning they can be set to 1 also. However, setting them to 1 may cause guest crashes in some modes and in bare metal environments. Hence, this test induces an #NPF by clearing the "P" bit in the highest level page table, when testing the 1-setting of these bits. Inducing an #NPF causes the guest to exit to userspace before any guest instruction is executed thus avoiding any crash. Signed-off-by: Krish Sadhukhan --- x86/svm.h | 4 ++- x86/svm_tests.c | 66 ++++++++++++++++++++++++++++++++++++++++++++----- 2 files changed, 63 insertions(+), 7 deletions(-) diff --git a/x86/svm.h b/x86/svm.h index 15e0f18..d657592 100644 --- a/x86/svm.h +++ b/x86/svm.h @@ -325,7 +325,9 @@ struct __attribute__ ((__packed__)) vmcb { #define SVM_CR0_SELECTIVE_MASK (X86_CR0_TS | X86_CR0_MP) #define SVM_CR0_RESERVED_MASK 0xffffffff00000000U -#define SVM_CR3_LONG_RESERVED_MASK 0xfff0000000000000U +#define SVM_CR3_LONG_MBZ_MASK 0xfff0000000000000U +#define SVM_CR3_LONG_RESERVED_MASK 0x0000000000000fe7U +#define SVM_CR3_PAE_LEGACY_RESERVED_MASK 0x0000000000000007U #define SVM_CR4_LEGACY_RESERVED_MASK 0xff88f000U #define SVM_CR4_RESERVED_MASK 0xffffffffff88f000U #define SVM_DR6_RESERVED_MASK 0xffffffffffff1ff0U diff --git a/x86/svm_tests.c b/x86/svm_tests.c index 1908c7c..ed21d21 100644 --- a/x86/svm_tests.c +++ b/x86/svm_tests.c @@ -1913,7 +1913,8 @@ static void basic_guest_main(struct svm_test *test) } \ } -#define SVM_TEST_CR_RESERVED_BITS(start, end, inc, cr, val, resv_mask) \ +#define SVM_TEST_CR_RESERVED_BITS(start, end, inc, cr, val, resv_mask, \ + exit_code) \ { \ u64 tmp, mask; \ int i; \ @@ -1933,7 +1934,7 @@ static void basic_guest_main(struct svm_test *test) case 4: \ vmcb->save.cr4 = tmp; \ } \ - report(svm_vmrun() == SVM_EXIT_ERR, "Test CR%d %d:%d: %lx",\ + report(svm_vmrun() == exit_code, "Test CR%d %d:%d: %lx",\ cr, end, start, tmp); \ } \ } @@ -2012,9 +2013,62 @@ static void test_cr3(void) u64 cr3_saved = vmcb->save.cr3; SVM_TEST_CR_RESERVED_BITS(0, 63, 1, 3, cr3_saved, - SVM_CR3_LONG_RESERVED_MASK); + SVM_CR3_LONG_MBZ_MASK, SVM_EXIT_ERR); + + vmcb->save.cr3 = cr3_saved & ~SVM_CR3_LONG_MBZ_MASK; + report(svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR3 63:0: %lx", + vmcb->save.cr3); + + /* + * CR3 non-MBZ reserved bits based on different modes: + * [11:5] [2:0] - long mode + * [2:0] - PAE legacy mode + */ + u64 cr4_saved = vmcb->save.cr4; + u64 *pdpe = npt_get_pml4e(); + + /* + * Long mode + */ + if (this_cpu_has(X86_FEATURE_PCID)) { + vmcb->save.cr4 = cr4_saved | X86_CR4_PCIDE; + SVM_TEST_CR_RESERVED_BITS(0, 11, 1, 3, cr3_saved, + SVM_CR3_LONG_RESERVED_MASK, SVM_EXIT_VMMCALL); + + vmcb->save.cr3 = cr3_saved & ~SVM_CR3_LONG_RESERVED_MASK; + report(svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR3 63:0: %lx", + vmcb->save.cr3); + } else { + + vmcb->save.cr4 = cr4_saved & ~X86_CR4_PCIDE; + + /* Clear P (Present) bit in NPT in order to trigger #NPF */ + pdpe[0] &= ~1ULL; + + SVM_TEST_CR_RESERVED_BITS(0, 11, 1, 3, cr3_saved, + SVM_CR3_LONG_RESERVED_MASK, SVM_EXIT_NPF); + + pdpe[0] |= 1ULL; + vmcb->save.cr3 = cr3_saved & ~SVM_CR3_LONG_RESERVED_MASK; + report(svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR3 63:0: %lx", + vmcb->save.cr3); + } + + /* + * PAE legacy + */ + pdpe[0] &= ~1ULL; + vmcb->save.cr4 = cr4_saved | X86_CR4_PAE; + SVM_TEST_CR_RESERVED_BITS(0, 2, 1, 3, cr3_saved, + SVM_CR3_PAE_LEGACY_RESERVED_MASK, SVM_EXIT_NPF); + + pdpe[0] |= 1ULL; + vmcb->save.cr3 = cr3_saved & ~SVM_CR3_PAE_LEGACY_RESERVED_MASK; + report(svm_vmrun() == SVM_EXIT_VMMCALL, "Test CR3 63:0: %lx", + vmcb->save.cr3); vmcb->save.cr3 = cr3_saved; + vmcb->save.cr4 = cr4_saved; } static void test_cr4(void) @@ -2031,14 +2085,14 @@ static void test_cr4(void) efer &= ~EFER_LME; vmcb->save.efer = efer; SVM_TEST_CR_RESERVED_BITS(12, 31, 1, 4, cr4_saved, - SVM_CR4_LEGACY_RESERVED_MASK); + SVM_CR4_LEGACY_RESERVED_MASK, SVM_EXIT_ERR); efer |= EFER_LME; vmcb->save.efer = efer; SVM_TEST_CR_RESERVED_BITS(12, 31, 1, 4, cr4_saved, - SVM_CR4_RESERVED_MASK); + SVM_CR4_RESERVED_MASK, SVM_EXIT_ERR); SVM_TEST_CR_RESERVED_BITS(32, 63, 4, 4, cr4_saved, - SVM_CR4_RESERVED_MASK); + SVM_CR4_RESERVED_MASK, SVM_EXIT_ERR); vmcb->save.cr4 = cr4_saved; vmcb->save.efer = efer_saved; From patchwork Tue Oct 6 19:06:54 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Krish Sadhukhan X-Patchwork-Id: 11819081 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id C85136CA for ; Tue, 6 Oct 2020 19:07:13 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A1574206F4 for ; Tue, 6 Oct 2020 19:07:13 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=oracle.com header.i=@oracle.com header.b="A9xQQcQe" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727013AbgJFTHM (ORCPT ); Tue, 6 Oct 2020 15:07:12 -0400 Received: from userp2120.oracle.com ([156.151.31.85]:57562 "EHLO userp2120.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727005AbgJFTHM (ORCPT ); Tue, 6 Oct 2020 15:07:12 -0400 Received: from pps.filterd (userp2120.oracle.com [127.0.0.1]) by userp2120.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 096IxSr8088743; Tue, 6 Oct 2020 19:07:06 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references; s=corp-2020-01-29; bh=l0DN7SaI5UEPyyJX46rJ/Q/12TWLBEcXNgvs0DHAGls=; b=A9xQQcQeTpwCmn76/yeWH8VyFelz9hCL+QxeoDBoCyqPqn7JTuJTZjWwNB8YZScWh7tA 2IfAuwa7ttPvQP0MTYeYwk+qqkjrEkL8pzOdI8r8DyIzxBgDpktg5c7wky+IBtTNn6d+ Ao58037G6+exaqpU6XORTdRAcHyiywIyYWd2NZht/VQkEGsXktozgc4Aw76mQT9u5wAn AxwhvamrfVwxbCHcte8r6spZQizO0V/4E0/XATmexmX2Hqn3Oq0OtZs4vGh/1y6td8s+ ZdPJOtFUCFRlWML9cVjMuaWVEJYpyQg3yR/PJH6IqG1votd2+t8yo2TVbmKnaGDc2O0O zQ== Received: from aserp3020.oracle.com (aserp3020.oracle.com [141.146.126.70]) by userp2120.oracle.com with ESMTP id 33xhxmwuqh-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL); Tue, 06 Oct 2020 19:07:06 +0000 Received: from pps.filterd (aserp3020.oracle.com [127.0.0.1]) by aserp3020.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 096J0pRP109851; Tue, 6 Oct 2020 19:07:05 GMT Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by aserp3020.oracle.com with ESMTP id 33y36yf1k4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 06 Oct 2020 19:07:05 +0000 Received: from abhmp0015.oracle.com (abhmp0015.oracle.com [141.146.116.21]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id 096J74O3016168; Tue, 6 Oct 2020 19:07:04 GMT Received: from nsvm-sadhukhan-1.osdevelopmeniad.oraclevcn.com (/100.100.230.216) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 06 Oct 2020 12:07:04 -0700 From: Krish Sadhukhan To: kvm@vger.kernel.org Cc: pbonzini@redhat.com, jmattson@google.com, sean.j.christopherson@intel.com Subject: [PATCH 4/4 v3] KVM: nSVM: nested_vmcb_checks() needs to check all bits of EFER Date: Tue, 6 Oct 2020 19:06:54 +0000 Message-Id: <20201006190654.32305-5-krish.sadhukhan@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20201006190654.32305-1-krish.sadhukhan@oracle.com> References: <20201006190654.32305-1-krish.sadhukhan@oracle.com> X-Proofpoint-Virus-Version: vendor=nai engine=6000 definitions=9766 signatures=668680 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=968 adultscore=0 bulkscore=0 spamscore=0 malwarescore=0 suspectscore=1 phishscore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2010060123 X-Proofpoint-Virus-Version: vendor=nai engine=6000 definitions=9766 signatures=668680 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 malwarescore=0 bulkscore=0 impostorscore=0 lowpriorityscore=0 suspectscore=1 phishscore=0 mlxlogscore=978 adultscore=0 clxscore=1015 spamscore=0 priorityscore=1501 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2010060123 Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org Current implementation of nested_vmcb_checks() checks only the SVME bit in EFER. We need to check all other bits of EFER including the reserved bits. This patch enhances nested_vmcb_checks() by calling kvm_valid_efer() which checks all bits of EFER. Signed-off-by: Krish Sadhukhan --- arch/x86/kvm/svm/nested.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 28a931fa599e..2426f50226d8 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -238,7 +238,8 @@ static bool nested_vmcb_check_cr3_cr4(struct vcpu_svm *svm, static bool nested_vmcb_checks(struct vcpu_svm *svm, struct vmcb *vmcb) { - if ((vmcb->save.efer & EFER_SVME) == 0) + if (((vmcb->save.efer & EFER_SVME) == 0) || + !kvm_valid_efer(&(svm->vcpu), vmcb->save.efer)) return false; if (((vmcb->save.cr0 & X86_CR0_CD) == 0) &&