Check guest physical address against it's maximum physical memory. If
the guest's physical address exceeds the maximum (i.e. has reserved bits
set), inject a guest page fault with PFERR_RSVD_MASK.
Signed-off-by: Mohammed Gamal <mgamal@xxxxxxxxxx>
---
arch/x86/kvm/vmx/vmx.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 63aaf44edd1f..477d196aa235 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -5162,6 +5162,12 @@ static int handle_ept_violation(struct kvm_vcpu *vcpu)
gpa = vmcs_read64(GUEST_PHYSICAL_ADDRESS);
trace_kvm_page_fault(gpa, exit_qualification);
+ /* Check if guest gpa doesn't exceed physical memory limits */
+ if (gpa >= (1ull << cpuid_maxphyaddr(vcpu))) {
+ kvm_inject_rsvd_bits_pf(vcpu, gpa);
+ return 1;
+ }
+
/* Is it a read fault? */
error_code = (exit_qualification & EPT_VIOLATION_ACC_READ)
? PFERR_USER_MASK : 0;
@@ -5193,6 +5199,13 @@ static int handle_ept_misconfig(struct kvm_vcpu *vcpu)
* nGPA here instead of the required GPA.
*/
gpa = vmcs_read64(GUEST_PHYSICAL_ADDRESS);
+
+ /* Check if guest gpa doesn't exceed physical memory limits */
+ if (gpa >= (1ull << cpuid_maxphyaddr(vcpu))) {
+ kvm_inject_rsvd_bits_pf(vcpu, gpa);
+ return 1;
+ }
+
if (!is_guest_mode(vcpu) &&
!kvm_io_bus_write(vcpu, KVM_FAST_MMIO_BUS, gpa, 0, NULL)) {
trace_kvm_fast_mmio(gpa);
--
2.21.1
