LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Vitaly Kuznetsov <vkuznets@redhat.com>
To: kvm@vger.kernel.org, Paolo Bonzini <pbonzini@redhat.com>
Cc: Sean Christopherson <seanjc@google.com>,
	Wanpeng Li <wanpengli@tencent.com>,
	Jim Mattson <jmattson@google.com>,
	Siddharth Chandrasekaran <sidcha@amazon.de>,
	linux-kernel@vger.kernel.org
Subject: [PATCH 3/4] KVM: x86: hyper-v: Check if guest is allowed to use XMM registers for hypercall input
Date: Fri, 30 Jul 2021 14:26:24 +0200	[thread overview]
Message-ID: <20210730122625.112848-4-vkuznets@redhat.com> (raw)
In-Reply-To: <20210730122625.112848-1-vkuznets@redhat.com>

TLFS states that "Availability of the XMM fast hypercall interface is
indicated via the “Hypervisor Feature Identification” CPUID Leaf
(0x40000003, see section 2.4.4) ... Any attempt to use this interface
when the hypervisor does not indicate availability will result in a #UD
fault."

Implement the check for 'strict' mode (KVM_CAP_HYPERV_ENFORCE_CPUID).

Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
---
 arch/x86/kvm/hyperv.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c
index 2945b93dbadd..0b38f944c6b6 100644
--- a/arch/x86/kvm/hyperv.c
+++ b/arch/x86/kvm/hyperv.c
@@ -2140,6 +2140,7 @@ static bool hv_check_hypercall_access(struct kvm_vcpu_hv *hv_vcpu, u16 code)
 
 int kvm_hv_hypercall(struct kvm_vcpu *vcpu)
 {
+	struct kvm_vcpu_hv *hv_vcpu = to_hv_vcpu(vcpu);
 	struct kvm_hv_hcall hc;
 	u64 ret = HV_STATUS_SUCCESS;
 
@@ -2177,13 +2178,21 @@ int kvm_hv_hypercall(struct kvm_vcpu *vcpu)
 	trace_kvm_hv_hypercall(hc.code, hc.fast, hc.rep_cnt, hc.rep_idx,
 			       hc.ingpa, hc.outgpa);
 
-	if (unlikely(!hv_check_hypercall_access(to_hv_vcpu(vcpu), hc.code))) {
+	if (unlikely(!hv_check_hypercall_access(hv_vcpu, hc.code))) {
 		ret = HV_STATUS_ACCESS_DENIED;
 		goto hypercall_complete;
 	}
 
-	if (hc.fast && is_xmm_fast_hypercall(&hc))
+	if (hc.fast && is_xmm_fast_hypercall(&hc)) {
+		if (unlikely(hv_vcpu->enforce_cpuid &&
+			     !(hv_vcpu->cpuid_cache.features_edx &
+			       HV_X64_HYPERCALL_XMM_INPUT_AVAILABLE))) {
+			kvm_queue_exception(vcpu, UD_VECTOR);
+			return 1;
+		}
+
 		kvm_hv_hypercall_read_xmm(&hc);
+	}
 
 	switch (hc.code) {
 	case HVCALL_NOTIFY_LONG_SPIN_WAIT:
-- 
2.31.1


  parent reply	other threads:[~2021-07-30 12:26 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-07-30 12:26 [PATCH 0/4] " Vitaly Kuznetsov
2021-07-30 12:26 ` [PATCH 1/4] KVM: x86: hyper-v: Check access to hypercall before reading XMM registers Vitaly Kuznetsov
2021-07-30 14:29   ` Siddharth Chandrasekaran
2021-07-30 12:26 ` [PATCH 2/4] KVM: x86: Introduce trace_kvm_hv_hypercall_done() Vitaly Kuznetsov
2021-07-30 14:30   ` Siddharth Chandrasekaran
2021-07-30 12:26 ` Vitaly Kuznetsov [this message]
2021-07-30 14:30   ` [PATCH 3/4] KVM: x86: hyper-v: Check if guest is allowed to use XMM registers for hypercall input Siddharth Chandrasekaran
2021-07-30 12:26 ` [PATCH 4/4] KVM: selftests: Test access to XMM fast hypercalls Vitaly Kuznetsov
2021-07-30 14:35   ` Siddharth Chandrasekaran
2021-07-30 14:50     ` Vitaly Kuznetsov
2021-07-30 15:01       ` Siddharth Chandrasekaran
2021-08-03 10:10       ` Paolo Bonzini
2021-08-03 10:10 ` [PATCH 0/4] KVM: x86: hyper-v: Check if guest is allowed to use XMM registers for hypercall input Paolo Bonzini
2021-08-03 10:17 ` Paolo Bonzini

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210730122625.112848-4-vkuznets@redhat.com \
    --to=vkuznets@redhat.com \
    --cc=jmattson@google.com \
    --cc=kvm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=pbonzini@redhat.com \
    --cc=seanjc@google.com \
    --cc=sidcha@amazon.de \
    --cc=wanpengli@tencent.com \
    --subject='Re: [PATCH 3/4] KVM: x86: hyper-v: Check if guest is allowed to use XMM registers for hypercall input' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).