Commit d4b69c3d authored by Sean Christopherson's avatar Sean Christopherson
Browse files

KVM: SVM: Inject #GP if memory operand for INVPCID is non-canonical 

Inject a #GP if the memory operand received by INVCPID is non-canonical.
The APM clearly states that the intercept takes priority over all #GP
checks except the CPL0 restriction.

Of course, that begs the question of how the CPU generates a linear
address in the first place.  Tracing confirms that EXITINFO1 does hold a
linear address, at least for 64-bit mode guests (hooray GS prefix).
Unfortunately, the APM says absolutely nothing about the EXITINFO fields
for INVPCID intercepts, so it's not at all clear what's supposed to
happen.

Add a FIXME to call out that KVM still does the wrong thing for 32-bit
guests, and if the stack segment is used for the memory operand.

Cc: Babu Moger <babu.moger@amd.com>
Cc: Jim Mattson <jmattson@google.com>
Fixes: 4407a797 ("KVM: SVM: Enable INVPCID feature on AMD")
Link: https://lore.kernel.org/r/20250224174522.2363400-1-seanjc@google.com


Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
parent fa662c90

arch/x86/kvm/svm/svm.c

+11 −0
Original line number Diff line number Diff line
@@ -3272,6 +3272,17 @@ static int invpcid_interception(struct kvm_vcpu *vcpu) 
	type = svm->vmcb->control.exit_info_2;

	gva = svm->vmcb->control.exit_info_1;



	/*

	 * FIXME: Perform segment checks for 32-bit mode, and inject #SS if the

	 *        stack segment is used.  The intercept takes priority over all

	 *        #GP checks except CPL>0, but somehow still generates a linear

	 *        address?  The APM is sorely lacking.

	 */

	if (is_noncanonical_address(gva, vcpu, 0)) {

		kvm_queue_exception_e(vcpu, GP_VECTOR, 0);

		return 1;

	}



	return kvm_handle_invpcid(vcpu, type, gva);

}