From patchwork Wed Mar 1 09:13:54 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sergey Dyasli X-Patchwork-Id: 9597897 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 48D4660429 for ; Wed, 1 Mar 2017 09:16:50 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3057B27D4A for ; Wed, 1 Mar 2017 09:16:50 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 2351428522; Wed, 1 Mar 2017 09:16:50 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=2.0 tests=BAYES_00 autolearn=ham version=3.3.1 Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 334C827D4A for ; Wed, 1 Mar 2017 09:16:39 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cj0Kr-0001Mt-Th; Wed, 01 Mar 2017 09:14:13 +0000 Received: from mail6.bemta3.messagelabs.com ([195.245.230.39]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cj0Kr-0001MW-1A for xen-devel@lists.xen.org; Wed, 01 Mar 2017 09:14:13 +0000 Received: from [85.158.137.68] by server-12.bemta-3.messagelabs.com id 02/0E-20054-4E096B85; Wed, 01 Mar 2017 09:14:12 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmpikeJIrShJLcpLzFFi42JxWrrBXvfxhG0 RBrcfGFos+biYxYHR4+ju30wBjFGsmXlJ+RUJrBn/Vr1kLnjBWzFp/hHWBsZV3F2MnBwSAv4S vY1HWEBsNgE9iY2zXzGB2CICshKru+awdzFycTALHGGUmLrqCDtIQljATWLJwhOsIDaLgIpEy 5ptQM0cHLwCthLnzkRAzJSTuLTtCzNImFPATuLZIwEQUwio4vrmWpAKIQFVidcvdoFt5RUQlD g58wmYzSwgIXHwxQvmCYy8s5CkZiFJLWBkWsWoXpxaVJZapGupl1SUmZ5RkpuYmaNraGCsl5t aXJyYnpqTmFSsl5yfu4kRGDb1DAyMOxhf/3Q6xCjJwaQkynuJa1uEEF9SfkplRmJxRnxRaU5q 8SFGGQ4OJQne5/1AOcGi1PTUirTMHGAAw6QlOHiURHgvg6R5iwsSc4sz0yFSpxgVpcR574MkB EASGaV5cG2wqLnEKCslzMvIwMAgxFOQWpSbWYIq/4pRnINRSZh3CcgUnsy8Erjpr4AWMwEtfq GyFWRxSSJCSqqB0SfdYhcT4wHuGcI/Vq0zSuyw0tiz+ErAa/Mv02Zv+Hf8+5K/Ore3Jn/QubJ UPf2q84Y72sdvr23t1/+x56S7kWnco5dsHqy1jzXOv5k/0Z3D+vKM224LbG9FOV0zVmhscQ0N 4xBuZi9yMXO7X9Z7XkJW+88enQVRs0ILXZlmGFeV3C3l+MMrpsRSnJFoqMVcVJwIAOGpMpKVA gAA X-Env-Sender: prvs=226945324=sergey.dyasli@citrix.com X-Msg-Ref: server-7.tower-31.messagelabs.com!1488359650!80413242!1 X-Originating-IP: [66.165.176.63] X-SpamReason: No, hits=0.0 required=7.0 tests=sa_preprocessor: VHJ1c3RlZCBJUDogNjYuMTY1LjE3Ni42MyA9PiAzMDYwNDg=\n, received_headers: No Received headers X-StarScan-Received: X-StarScan-Version: 9.2.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 60831 invoked from network); 1 Mar 2017 09:14:11 -0000 Received: from smtp02.citrix.com (HELO SMTP02.CITRIX.COM) (66.165.176.63) by server-7.tower-31.messagelabs.com with RC4-SHA encrypted SMTP; 1 Mar 2017 09:14:11 -0000 X-IronPort-AV: E=Sophos;i="5.35,224,1484006400"; d="scan'208";a="419410780" From: Sergey Dyasli To: Date: Wed, 1 Mar 2017 09:13:54 +0000 Message-ID: <20170301091355.24742-2-sergey.dyasli@citrix.com> X-Mailer: git-send-email 2.9.3 In-Reply-To: <20170301091355.24742-1-sergey.dyasli@citrix.com> References: <20170301091355.24742-1-sergey.dyasli@citrix.com> MIME-Version: 1.0 Cc: Andrew Cooper , Kevin Tian , Jan Beulich , Jun Nakajima , Sergey Dyasli Subject: [Xen-devel] [PATCH v1 1/2] x86/vvmx: check vmcs address in vmread/vmwrite X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" X-Virus-Scanned: ClamAV using ClamSMTP If nested vmcs's address is invalid, virtual_vmcs_enter() will fail during vmread/vmwrite: (XEN) Xen BUG at .../git/upstream/xen/xen/include/asm/hvm/vmx/vmx.h:333 (XEN) ----[ Xen-4.9-unstable x86_64 debug=y Tainted: H ]---- (XEN) Xen call trace: (XEN) [] vmcs.c#arch/x86/hvm/vmx/vmcs.o.unlikely+0x28/0x19a (XEN) [] virtual_vmcs_vmwrite_safe+0x16/0x52 (XEN) [] nvmx_handle_vmwrite+0x70/0xfe (XEN) [] vmx_vmexit_handler+0x1379/0x1c49 (XEN) [] vmx_asm_vmexit_handler+0x3c/0x120 Fix this by emulating VMfailInvalid if the address is invalid. Signed-off-by: Sergey Dyasli Reviewed-by: Andrew Cooper Acked-by: Kevin Tian --- xen/arch/x86/hvm/vmx/vvmx.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/xen/arch/x86/hvm/vmx/vvmx.c b/xen/arch/x86/hvm/vmx/vvmx.c index f6a25a6..4f5ee5a 100644 --- a/xen/arch/x86/hvm/vmx/vvmx.c +++ b/xen/arch/x86/hvm/vmx/vvmx.c @@ -1751,6 +1751,12 @@ int nvmx_handle_vmread(struct cpu_user_regs *regs) if ( rc != X86EMUL_OKAY ) return rc; + if ( vcpu_nestedhvm(v).nv_vvmcxaddr == INVALID_PADDR ) + { + vmfail_invalid(regs); + return X86EMUL_OKAY; + } + rc = get_vvmcs_safe(v, reg_read(regs, decode.reg2), &value); if ( rc != VMX_INSN_SUCCEED ) { @@ -1788,6 +1794,12 @@ int nvmx_handle_vmwrite(struct cpu_user_regs *regs) != X86EMUL_OKAY ) return X86EMUL_EXCEPTION; + if ( vcpu_nestedhvm(v).nv_vvmcxaddr == INVALID_PADDR ) + { + vmfail_invalid(regs); + return X86EMUL_OKAY; + } + vmcs_encoding = reg_read(regs, decode.reg2); err = set_vvmcs_safe(v, vmcs_encoding, operand); if ( err != VMX_INSN_SUCCEED )