[PATCH kvm-unit-tests 2/2] VMX: Check for validity of vmcs region when calling vmclear/vmptrld

[Bandan Das <bsd@xxxxxxxxxx>]

Check if the vmcs pointer is not aligned to page size,
and if bits beyond physical address width are set. Also,
vmclear and vmptrld should fail if the vmxon region is
supplied instead of the vmcs

Signed-off-by: Bandan Das <bsd@xxxxxxxxxx>
---
 x86/vmx.c | 63 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 60 insertions(+), 3 deletions(-)

diff --git a/x86/vmx.c b/x86/vmx.c
index 207eb81..64c46aa 100644
--- a/x86/vmx.c
+++ b/x86/vmx.c
@@ -130,10 +130,43 @@ void print_vmexit_info()
 static void test_vmclear(void)
 {
 	u64 rflags;
+	struct vmcs *tmp_root;
+	int width = cpuid(0x80000008).a & 0xff;
+
+	/*
+	 * Note- The tests below do not necessarily have a
+	 * valid VMCS, but that's ok since the invalid vmcs
+	 * is only used for a specific test and is discarded
+	 * without touching its contents
+	 */
+
+	/* Unaligned page access */
+	tmp_root = (struct vmcs *)((intptr_t)vmcs_root + 1);
+	rflags = read_rflags() | X86_EFLAGS_CF | X86_EFLAGS_ZF;
+	write_rflags(rflags);
+	report("test vmclear with unaligned vmcs",
+	       vmcs_clear(tmp_root) == 1);
+
+	/* gpa bits beyond physical address width are set*/
+	tmp_root = (struct vmcs *)((intptr_t)vmcs_root |
+				   ((u64)1 << (width+1)));
+	rflags = read_rflags() | X86_EFLAGS_CF | X86_EFLAGS_ZF;
+	write_rflags(rflags);
+	report("test vmclear with vmcs address bits set beyond physical address width",
+	       vmcs_clear(tmp_root) == 1);
 
+	/* Pass VMXON region */
+	tmp_root = (struct vmcs *)vmxon_region;
 	rflags = read_rflags() | X86_EFLAGS_CF | X86_EFLAGS_ZF;
 	write_rflags(rflags);
-	report("test vmclear", vmcs_clear(vmcs_root) == 0);
+	report("test vmclear with vmxon region",
+	       vmcs_clear(tmp_root) == 1);
+
+	/* Valid VMCS */
+	rflags = read_rflags() | X86_EFLAGS_CF | X86_EFLAGS_ZF;
+	write_rflags(rflags);
+	report("test vmclear with valid vmcs region", vmcs_clear(vmcs_root) == 0);
+
 }
 
 static void test_vmxoff(void)
@@ -651,13 +684,37 @@ out:
 static void test_vmptrld(void)
 {
 	u64 rflags;
-	struct vmcs *vmcs;
+	struct vmcs *vmcs, *tmp_root;
+	int width = cpuid(0x80000008).a & 0xff;
 
 	vmcs = alloc_page();
 	vmcs->revision_id = basic.revision;
+
+	/* Unaligned page access */
+	tmp_root = (struct vmcs *)((intptr_t)vmcs + 1);
+	rflags = read_rflags() | X86_EFLAGS_CF | X86_EFLAGS_ZF;
+	write_rflags(rflags);
+	report("test vmptrld with unaligned vmcs",
+	       make_vmcs_current(tmp_root) == 1);
+
+	/* gpa bits beyond physical address width are set*/
+	tmp_root = (struct vmcs *)((intptr_t)vmcs |
+				   ((u64)1 << (width+1)));
+	rflags = read_rflags() | X86_EFLAGS_CF | X86_EFLAGS_ZF;
+	write_rflags(rflags);
+	report("test vmptrld with vmcs address bits set beyond physical address width",
+	       make_vmcs_current(tmp_root) == 1);
+
+	/* Pass VMXON region */
+	tmp_root = (struct vmcs *)vmxon_region;
+	rflags = read_rflags() | X86_EFLAGS_CF | X86_EFLAGS_ZF;
+	write_rflags(rflags);
+	report("test vmptrld with vmxon region",
+	       make_vmcs_current(tmp_root) == 1);
+
 	rflags = read_rflags() | X86_EFLAGS_CF | X86_EFLAGS_ZF;
 	write_rflags(rflags);
-	report("test vmptrld", make_vmcs_current(vmcs) == 0);
+	report("test vmptrld with valid vmcs", make_vmcs_current(vmcs) == 0);
 }
 
 static void test_vmptrst(void)
-- 
1.8.3.1

--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html