KVM: nSVM: Sanitize TLB_CONTROL field when copying from vmcb12

The APM defines possible values for TLB_CONTROL as 0, 1, 3, and 7 -- all
of which are always allowed for KVM guests as KVM always supports
X86_FEATURE_FLUSHBYASID. Only copy bits 0 to 2 from vmcb12's
TLB_CONTROL, such that no unhandled or reserved bits end up in vmcb02.

Note that TLB_CONTROL in vmcb12 is currently ignored by KVM, as it nukes
the TLB on nested transitions anyway (see
nested_svm_transition_tlb_flush()). However, such sanitization will be
needed once the TODOs there are addressed, and it's minimal churn to add
it now.

Signed-off-by: Yosry Ahmed <yosry@kernel.org>
Link: https://patch.msgid.link/20260303003421.2185681-24-yosry@kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>

diff --git a/arch/x86/include/asm/svm.h b/arch/x86/include/asm/svm.h
index c169256c415fb64151a3824553f3198115045d34..16cf4f435aebd963fbaf03616eb7d1d30cc75949 100644 (file)
--- a/arch/x86/include/asm/svm.h
+++ b/arch/x86/include/asm/svm.h
@@ -182,6 +182,8 @@ struct __attribute__ ((__packed__)) vmcb_control_area {
 #define TLB_CONTROL_FLUSH_ASID 3
 #define TLB_CONTROL_FLUSH_ASID_LOCAL 7
 
+#define TLB_CONTROL_MASK GENMASK(2, 0)
+
 #define ERAP_CONTROL_ALLOW_LARGER_RAP BIT(0)
 #define ERAP_CONTROL_CLEAR_RAP BIT(1)
 

diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
index fd704590494801e67b07f8b3801ef7be23cad4b8..c4680270e54f57bab03d8012a52910aab5e9a79e 100644 (file)
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -485,7 +485,7 @@ void __nested_copy_vmcb_control_to_cache(struct kvm_vcpu *vcpu,
        to->iopm_base_pa        = from->iopm_base_pa & PAGE_MASK;
        to->msrpm_base_pa       = from->msrpm_base_pa & PAGE_MASK;
        to->tsc_offset          = from->tsc_offset;
-       to->tlb_ctl             = from->tlb_ctl;
+       to->tlb_ctl             = from->tlb_ctl & TLB_CONTROL_MASK;
        to->erap_ctl            = from->erap_ctl;
        to->int_ctl             = from->int_ctl;
        to->int_vector          = from->int_vector;