From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jim Mattson Subject: [PATCH v2] kvm: x86: Disallow illegal IA32_APIC_BASE MSR values Date: Wed, 9 Aug 2017 09:54:01 -0700 Message-ID: <20170809165401.82004-1-jmattson@google.com> References: Cc: Jim Mattson To: David Hildenbrand , kvm list Return-path: Received: from mail-pf0-f182.google.com ([209.85.192.182]:34602 "EHLO mail-pf0-f182.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752905AbdHIQye (ORCPT ); Wed, 9 Aug 2017 12:54:34 -0400 Received: by mail-pf0-f182.google.com with SMTP id o86so30180609pfj.1 for ; Wed, 09 Aug 2017 09:54:34 -0700 (PDT) In-Reply-To: Sender: kvm-owner@vger.kernel.org List-ID: Host-initiated writes to the IA32_APIC_BASE MSR do not have to follow local APIC state transition constraints, but the value written must be valid. Signed-off-by: Jim Mattson --- arch/x86/kvm/x86.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index d734aa8c5b4f..77f17a6ea48a 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -313,10 +313,10 @@ int kvm_set_apic_base(struct kvm_vcpu *vcpu, struct msr_data *msr_info) u64 reserved_bits = ((~0ULL) << cpuid_maxphyaddr(vcpu)) | 0x2ff | (guest_cpuid_has_x2apic(vcpu) ? 0 : X2APIC_ENABLE); + if ((msr_info->data & reserved_bits) || new_state == X2APIC_ENABLE) + return 1; if (!msr_info->host_initiated && - ((msr_info->data & reserved_bits) != 0 || - new_state == X2APIC_ENABLE || - (new_state == MSR_IA32_APICBASE_ENABLE && + ((new_state == MSR_IA32_APICBASE_ENABLE && old_state == (MSR_IA32_APICBASE_ENABLE | X2APIC_ENABLE)) || (new_state == (MSR_IA32_APICBASE_ENABLE | X2APIC_ENABLE) && old_state == 0))) @@ -7444,7 +7444,8 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct kvm_vcpu *vcpu, kvm_x86_ops->set_efer(vcpu, sregs->efer); apic_base_msr.data = sregs->apic_base; apic_base_msr.host_initiated = true; - kvm_set_apic_base(vcpu, &apic_base_msr); + if (kvm_set_apic_base(vcpu, &apic_base_msr)) + return -EINVAL; mmu_reset_needed |= kvm_read_cr0(vcpu) != sregs->cr0; kvm_x86_ops->set_cr0(vcpu, sregs->cr0); -- 2.14.0.434.g98096fd7a8-goog