[PATCH] target/i386: Added consistency checks for event injection

[PATCH] target/i386: Added consistency checks for event injection

[Lara Lazier]

VMRUN exits with SVM_EXIT_ERR if either:
 * The event injected has a reserved type.
 * When the event injected is of type 3 (exception), and the vector that
 has been specified does not correspond to an exception.

This does not fix the entire exc_inj test in kvm-unit-tests.

Signed-off-by: Lara Lazier <laramglazier@gmail.com>
---
 target/i386/tcg/sysemu/svm_helper.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/target/i386/tcg/sysemu/svm_helper.c b/target/i386/tcg/sysemu/svm_helper.c
index a61aa23017..70d5c2e35d 100644
--- a/target/i386/tcg/sysemu/svm_helper.c
+++ b/target/i386/tcg/sysemu/svm_helper.c
@@ -395,6 +395,9 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
             cpu_loop_exit(cs);
             break;
         case SVM_EVTINJ_TYPE_EXEPT:
+            if (vector == EXCP02_NMI || vector >= 31)  {
+                cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
+            }
             cs->exception_index = vector;
             env->error_code = event_inj_err;
             env->exception_is_int = 0;
@@ -410,6 +413,9 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
             qemu_log_mask(CPU_LOG_TB_IN_ASM, "SOFT");
             cpu_loop_exit(cs);
             break;
+        default:
+            cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
+            break;
         }
         qemu_log_mask(CPU_LOG_TB_IN_ASM, " %#x %#x\n", cs->exception_index,
                       env->error_code);
-- 
2.25.1

Re: [PATCH] target/i386: Added consistency checks for event injection

[Paolo Bonzini]

On 25/07/21 11:08, Lara Lazier wrote:
> VMRUN exits with SVM_EXIT_ERR if either:
>   * The event injected has a reserved type.
>   * When the event injected is of type 3 (exception), and the vector that
>   has been specified does not correspond to an exception.
> 
> This does not fix the entire exc_inj test in kvm-unit-tests.
> 
> Signed-off-by: Lara Lazier <laramglazier@gmail.com>
> ---
>   target/i386/tcg/sysemu/svm_helper.c | 6 ++++++
>   1 file changed, 6 insertions(+)
> 
> diff --git a/target/i386/tcg/sysemu/svm_helper.c b/target/i386/tcg/sysemu/svm_helper.c
> index a61aa23017..70d5c2e35d 100644
> --- a/target/i386/tcg/sysemu/svm_helper.c
> +++ b/target/i386/tcg/sysemu/svm_helper.c
> @@ -395,6 +395,9 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
>               cpu_loop_exit(cs);
>               break;
>           case SVM_EVTINJ_TYPE_EXEPT:
> +            if (vector == EXCP02_NMI || vector >= 31)  {
> +                cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
> +            }
>               cs->exception_index = vector;
>               env->error_code = event_inj_err;
>               env->exception_is_int = 0;
> @@ -410,6 +413,9 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
>               qemu_log_mask(CPU_LOG_TB_IN_ASM, "SOFT");
>               cpu_loop_exit(cs);
>               break;
> +        default:
> +            cpu_vmexit(env, SVM_EXIT_ERR, 0, GETPC());
> +            break;
>           }
>           qemu_log_mask(CPU_LOG_TB_IN_ASM, " %#x %#x\n", cs->exception_index,
>                         env->error_code);
> 

Queued, thanks.

Paolo