Commit dee281e4 authored by Sean Christopherson's avatar Sean Christopherson Committed by Paolo Bonzini
Browse files

KVM: x86: Move synthetic PFERR_* sanity checks to SVM's #NPF handler 



Move the sanity check that hardware never sets bits that collide with KVM-
define synthetic bits from kvm_mmu_page_fault() to npf_interception(),
i.e. make the sanity check #NPF specific.  The legacy #PF path already
WARNs if _any_ of bits 63:32 are set, and the error code that comes from
VMX's EPT Violatation and Misconfig is 100% synthesized (KVM morphs VMX's
EXIT_QUALIFICATION into error code flags).

Add a compile-time assert in the legacy #PF handler to make sure that KVM-
define flags are covered by its existing sanity check on the upper bits.

Opportunistically add a description of PFERR_IMPLICIT_ACCESS, since we
are removing the comment that defined it.

Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
Reviewed-by: default avatarKai Huang <kai.huang@intel.com>
Reviewed-by: default avatarBinbin Wu <binbin.wu@linux.intel.com>
Message-ID: <20240228024147.41573-8-seanjc@google.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent 9b62e03e

arch/x86/include/asm/kvm_host.h

+6 −0
Original line number Diff line number Diff line
@@ -267,7 +267,13 @@ enum x86_intercept_stage; 
#define PFERR_GUEST_ENC_MASK	BIT_ULL(34)

#define PFERR_GUEST_SIZEM_MASK	BIT_ULL(35)

#define PFERR_GUEST_VMPL_MASK	BIT_ULL(36)



/*

 * IMPLICIT_ACCESS is a KVM-defined flag used to correctly perform SMAP checks

 * when emulating instructions that triggers implicit access.

 */

#define PFERR_IMPLICIT_ACCESS	BIT_ULL(48)

#define PFERR_SYNTHETIC_MASK	(PFERR_IMPLICIT_ACCESS)



#define PFERR_NESTED_GUEST_PAGE (PFERR_GUEST_PAGE_MASK |	\

				 PFERR_WRITE_MASK |		\

arch/x86/kvm/mmu/mmu.c

+3 −11
Original line number Diff line number Diff line
@@ -4501,6 +4501,9 @@ int kvm_handle_page_fault(struct kvm_vcpu *vcpu, u64 error_code, 
		return -EFAULT;

#endif



	/* Ensure the above sanity check also covers KVM-defined flags. */

	BUILD_BUG_ON(lower_32_bits(PFERR_SYNTHETIC_MASK));



	vcpu->arch.l1tf_flush_l1d = true;

	if (!flags) {

		trace_kvm_page_fault(vcpu, fault_address, error_code);
@@ -5785,17 +5788,6 @@ int noinline kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa, u64 err 
	int r, emulation_type = EMULTYPE_PF;

	bool direct = vcpu->arch.mmu->root_role.direct;



	/*

	 * IMPLICIT_ACCESS is a KVM-defined flag used to correctly perform SMAP

	 * checks when emulating instructions that triggers implicit access.

	 * WARN if hardware generates a fault with an error code that collides

	 * with the KVM-defined value.  Clear the flag and continue on, i.e.

	 * don't terminate the VM, as KVM can't possibly be relying on a flag

	 * that KVM doesn't know about.

	 */

	if (WARN_ON_ONCE(error_code & PFERR_IMPLICIT_ACCESS))

		error_code &= ~PFERR_IMPLICIT_ACCESS;



	if (WARN_ON_ONCE(!VALID_PAGE(vcpu->arch.mmu->root.hpa)))

		return RET_PF_RETRY;

arch/x86/kvm/svm/svm.c

+9 −0
Original line number Diff line number Diff line
@@ -2047,6 +2047,15 @@ static int npf_interception(struct kvm_vcpu *vcpu) 
	u64 fault_address = svm->vmcb->control.exit_info_2;

	u64 error_code = svm->vmcb->control.exit_info_1;



	/*

	 * WARN if hardware generates a fault with an error code that collides

	 * with KVM-defined sythentic flags.  Clear the flags and continue on,

	 * i.e. don't terminate the VM, as KVM can't possibly be relying on a

	 * flag that KVM doesn't know about.

	 */

	if (WARN_ON_ONCE(error_code & PFERR_SYNTHETIC_MASK))

		error_code &= ~PFERR_SYNTHETIC_MASK;



	trace_kvm_page_fault(vcpu, fault_address, error_code);

	return kvm_mmu_page_fault(vcpu, fault_address, error_code,

			static_cpu_has(X86_FEATURE_DECODEASSISTS) ?