2023-01-07 01:13:23

by Sean Christopherson

Subject: [PATCH 1/6] KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC Self-IPI

Inject a #GP if the guest attempts to set reserved bits in the x2APIC-only
Self-IPI register. Bits 7:0 hold the vector, all other bits are reserved.

Reported-by: Marc Orr <[email protected]>
Cc: Ben Gardon <[email protected]>
Cc: Venkatesh Srinivas <[email protected]>
Cc: [email protected]
Signed-off-by: Sean Christopherson <[email protected]>
---
arch/x86/kvm/lapic.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 80f92cbc4029..f77da92c6ea6 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -2315,10 +2315,14 @@ static int kvm_lapic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val)
break;

case APIC_SELF_IPI:
- if (apic_x2apic_mode(apic))
- kvm_apic_send_ipi(apic, APIC_DEST_SELF | (val & APIC_VECTOR_MASK), 0);
- else
+ /*
+ * Self-IPI exists only when x2APIC is enabled. Bits 7:0 hold
+ * the vector, everything else is reserved.
+ */
+ if (!apic_x2apic_mode(apic) || (val & ~APIC_VECTOR_MASK))
ret = 1;
+ else
+ kvm_apic_send_ipi(apic, APIC_DEST_SELF | val, 0);
break;
default:
ret = 1;
--
2.39.0.314.g84b9a713c41-goog

2023-01-08 16:58:07

by Maxim Levitsky

Subject: Re: [PATCH 1/6] KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC Self-IPI

On Sat, 2023-01-07 at 01:10 +0000, Sean Christopherson wrote:
> Inject a #GP if the guest attempts to set reserved bits in the x2APIC-only
> Self-IPI register. Bits 7:0 hold the vector, all other bits are reserved.
>
> Reported-by: Marc Orr <[email protected]>
> Cc: Ben Gardon <[email protected]>
> Cc: Venkatesh Srinivas <[email protected]>
> Cc: [email protected]
> Signed-off-by: Sean Christopherson <[email protected]>
> ---
> arch/x86/kvm/lapic.c | 10 +++++++---
> 1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
> index 80f92cbc4029..f77da92c6ea6 100644
> --- a/arch/x86/kvm/lapic.c
> +++ b/arch/x86/kvm/lapic.c
> @@ -2315,10 +2315,14 @@ static int kvm_lapic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val)
> break;
>
> case APIC_SELF_IPI:
> - if (apic_x2apic_mode(apic))
> - kvm_apic_send_ipi(apic, APIC_DEST_SELF | (val & APIC_VECTOR_MASK), 0);
> - else
> + /*
> + * Self-IPI exists only when x2APIC is enabled. Bits 7:0 hold
> + * the vector, everything else is reserved.
> + */
> + if (!apic_x2apic_mode(apic) || (val & ~APIC_VECTOR_MASK))
> ret = 1;
> + else
> + kvm_apic_send_ipi(apic, APIC_DEST_SELF | val, 0);
> break;
> default:
> ret = 1;

Reviewed-by: Maxim Levitsky <[email protected]>

Best regards,
Maxim Levitsky