Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
KVM: SVM: check validity of VMCB controls when returning from SMM
The VMCB12 is stored in guest memory and can be mangled while in SMM; it
is then reloaded by svm_leave_smm(), but it is not checked again for
validity.
Move the cached vmcb12 control and save consistency checks out of
svm_set_nested_state() and into a helper, and reuse it in
svm_leave_smm().
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+15
-2
+10
-2
arch/x86/kvm/svm/nested.c
+10
-2
arch/x86/kvm/svm/nested.c
···
418
418
return __nested_vmcb_check_controls(vcpu, ctl);
419
419
}
420
420
421
+
int nested_svm_check_cached_vmcb12(struct kvm_vcpu *vcpu)
422
+
{
423
+
if (!nested_vmcb_check_save(vcpu) ||
424
+
!nested_vmcb_check_controls(vcpu))
425
+
return -EINVAL;
426
+
427
+
return 0;
428
+
}
429
+
421
430
/*
422
431
* If a feature is not advertised to L1, clear the corresponding vmcb12
423
432
* intercept.
···
1037
1028
nested_copy_vmcb_control_to_cache(svm, &vmcb12->control);
1038
1029
nested_copy_vmcb_save_to_cache(svm, &vmcb12->save);
1039
1030
1040
-
if (!nested_vmcb_check_save(vcpu) ||
1041
-
!nested_vmcb_check_controls(vcpu)) {
1031
+
if (nested_svm_check_cached_vmcb12(vcpu) < 0) {
1042
1032
vmcb12->control.exit_code = SVM_EXIT_ERR;
1043
1033
vmcb12->control.exit_info_1 = 0;
1044
1034
vmcb12->control.exit_info_2 = 0;
+4
arch/x86/kvm/svm/svm.c
+4
arch/x86/kvm/svm/svm.c
···
4880
4880
vmcb12 = map.hva;
4881
4881
nested_copy_vmcb_control_to_cache(svm, &vmcb12->control);
4882
4882
nested_copy_vmcb_save_to_cache(svm, &vmcb12->save);
4883
+
4884
+
if (nested_svm_check_cached_vmcb12(vcpu) < 0)
4885
+
goto unmap_save;
4886
+
4883
4887
ret = enter_svm_guest_mode(vcpu, smram64->svm_guest_vmcb_gpa, vmcb12, false);
4884
4888
4885
4889
if (ret)
+1
arch/x86/kvm/svm/svm.h
+1
arch/x86/kvm/svm/svm.h
···
797
797
798
798
int nested_svm_exit_handled(struct vcpu_svm *svm);
799
799
int nested_svm_check_permissions(struct kvm_vcpu *vcpu);
800
+
int nested_svm_check_cached_vmcb12(struct kvm_vcpu *vcpu);
800
801
int nested_svm_check_exception(struct vcpu_svm *svm, unsigned nr,
801
802
bool has_error_code, u32 error_code);
802
803
int nested_svm_exit_special(struct vcpu_svm *svm);