[src/trunk]: src/sys/dev/nvmm/x86 VMX: if PAT is not valid, #GP on WRMSR, rat...

[maxv <maxv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/116c9686e135
branches:  trunk
changeset: 840342:116c9686e135
user:      maxv <maxv%NetBSD.org@localhost>
date:      Wed Apr 03 19:10:58 2019 +0000

description:
VMX: if PAT is not valid, #GP on WRMSR, rather than crashing the guest.

diffstat:

 sys/dev/nvmm/x86/nvmm_x86.c     |  20 ++++++++++++++++++--
 sys/dev/nvmm/x86/nvmm_x86.h     |   3 ++-
 sys/dev/nvmm/x86/nvmm_x86_vmx.c |  14 +++++++++++---
 3 files changed, 31 insertions(+), 6 deletions(-)

diffs (97 lines):

diff -r b08c040159af -r 116c9686e135 sys/dev/nvmm/x86/nvmm_x86.c
--- a/sys/dev/nvmm/x86/nvmm_x86.c       Wed Apr 03 18:05:55 2019 +0000
+++ b/sys/dev/nvmm/x86/nvmm_x86.c       Wed Apr 03 19:10:58 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: nvmm_x86.c,v 1.4 2019/04/03 17:32:58 maxv Exp $        */
+/*     $NetBSD: nvmm_x86.c,v 1.5 2019/04/03 19:10:58 maxv Exp $        */
 
 /*
  * Copyright (c) 2018-2019 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: nvmm_x86.c,v 1.4 2019/04/03 17:32:58 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: nvmm_x86.c,v 1.5 2019/04/03 19:10:58 maxv Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -313,3 +313,19 @@
            CPUID_EM64T | CPUID_3DNOW2 |
            CPUID_3DNOW
 };
+
+bool
+nvmm_x86_pat_validate(uint64_t val)
+{
+       uint8_t *pat = (uint8_t *)&val;
+       size_t i;
+
+       for (i = 0; i < 8; i++) {
+               if (__predict_false(pat[i] & ~__BITS(2,0)))
+                       return false;
+               if (__predict_false(pat[i] == 2 || pat[i] == 3))
+                       return false;
+       }
+
+       return true;
+}
diff -r b08c040159af -r 116c9686e135 sys/dev/nvmm/x86/nvmm_x86.h
--- a/sys/dev/nvmm/x86/nvmm_x86.h       Wed Apr 03 18:05:55 2019 +0000
+++ b/sys/dev/nvmm/x86/nvmm_x86.h       Wed Apr 03 19:10:58 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: nvmm_x86.h,v 1.9 2019/04/03 17:32:58 maxv Exp $        */
+/*     $NetBSD: nvmm_x86.h,v 1.10 2019/04/03 19:10:58 maxv Exp $       */
 
 /*
  * Copyright (c) 2018 The NetBSD Foundation, Inc.
@@ -186,6 +186,7 @@
 extern const struct nvmm_x86_cpuid_mask nvmm_cpuid_00000001;
 extern const struct nvmm_x86_cpuid_mask nvmm_cpuid_00000007;
 extern const struct nvmm_x86_cpuid_mask nvmm_cpuid_80000001;
+bool nvmm_x86_pat_validate(uint64_t);
 #endif
 
 #endif /* ASM_NVMM */
diff -r b08c040159af -r 116c9686e135 sys/dev/nvmm/x86/nvmm_x86_vmx.c
--- a/sys/dev/nvmm/x86/nvmm_x86_vmx.c   Wed Apr 03 18:05:55 2019 +0000
+++ b/sys/dev/nvmm/x86/nvmm_x86_vmx.c   Wed Apr 03 19:10:58 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: nvmm_x86_vmx.c,v 1.22 2019/04/03 18:05:55 maxv Exp $   */
+/*     $NetBSD: nvmm_x86_vmx.c,v 1.23 2019/04/03 19:10:58 maxv Exp $   */
 
 /*
  * Copyright (c) 2018 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: nvmm_x86_vmx.c,v 1.22 2019/04/03 18:05:55 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: nvmm_x86_vmx.c,v 1.23 2019/04/03 19:10:58 maxv Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -1502,7 +1502,11 @@
                        goto handled;
                }
                if (exit->u.msr.msr == MSR_CR_PAT) {
-                       vmx_vmwrite(VMCS_GUEST_IA32_PAT, exit->u.msr.val);
+                       val = exit->u.msr.val;
+                       if (__predict_false(!nvmm_x86_pat_validate(val))) {
+                               goto error;
+                       }
+                       vmx_vmwrite(VMCS_GUEST_IA32_PAT, val);
                        goto handled;
                }
                if (exit->u.msr.msr == MSR_MISC_ENABLE) {
@@ -1522,6 +1526,10 @@
 handled:
        vmx_inkernel_advance();
        return true;
+
+error:
+       vmx_inject_gp(mach, vcpu);
+       return true;
 }
 
 static void