KVM: x86: Add checks for reserved-to-zero Hyper-V hypercall fields

Add checks for the three fields in Hyper-V's hypercall params that must
be zero.  Per the TLFS, HV_STATUS_INVALID_HYPERCALL_INPUT is returned if
"A reserved bit in the specified hypercall input value is non-zero."

Note, some versions of the TLFS have an off-by-one bug for the last
reserved field, and define it as being bits 64:60.  See
https://github.com/MicrosoftDocs/Virtualization-Documentation/pull/1682.

Signed-off-by: Sean Christopherson <seanjc@google.com>
Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Message-Id: <20211207220926.718794-9-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c
index acabe9d898cf99817971f61ff73b0f39e27ff276..dac41784f2b8796f9b7c7b89cc8673e975b364fd 100644 (file)
--- a/arch/x86/kvm/hyperv.c
+++ b/arch/x86/kvm/hyperv.c
@@ -2240,6 +2240,11 @@ int kvm_hv_hypercall(struct kvm_vcpu *vcpu)
                goto hypercall_complete;
        }
 
+       if (unlikely(hc.param & HV_HYPERCALL_RSVD_MASK)) {
+               ret = HV_STATUS_INVALID_HYPERCALL_INPUT;
+               goto hypercall_complete;
+       }
+
        if (hc.fast && is_xmm_fast_hypercall(&hc)) {
                if (unlikely(hv_vcpu->enforce_cpuid &&
                             !(hv_vcpu->cpuid_cache.features_edx &

diff --git a/include/asm-generic/hyperv-tlfs.h b/include/asm-generic/hyperv-tlfs.h
index b8babc4d3fe439a47357705de0b5d3b1712abcb9..fdce7a4cfc6ffca0115bb08053dd2961c0fea50b 100644 (file)
--- a/include/asm-generic/hyperv-tlfs.h
+++ b/include/asm-generic/hyperv-tlfs.h
@@ -184,11 +184,17 @@ enum HV_GENERIC_SET_FORMAT {
 #define HV_HYPERCALL_FAST_BIT          BIT(16)
 #define HV_HYPERCALL_VARHEAD_OFFSET    17
 #define HV_HYPERCALL_VARHEAD_MASK      GENMASK_ULL(26, 17)
+#define HV_HYPERCALL_RSVD0_MASK                GENMASK_ULL(31, 27)
 #define HV_HYPERCALL_REP_COMP_OFFSET   32
 #define HV_HYPERCALL_REP_COMP_1                BIT_ULL(32)
 #define HV_HYPERCALL_REP_COMP_MASK     GENMASK_ULL(43, 32)
+#define HV_HYPERCALL_RSVD1_MASK                GENMASK_ULL(47, 44)
 #define HV_HYPERCALL_REP_START_OFFSET  48
 #define HV_HYPERCALL_REP_START_MASK    GENMASK_ULL(59, 48)
+#define HV_HYPERCALL_RSVD2_MASK                GENMASK_ULL(63, 60)
+#define HV_HYPERCALL_RSVD_MASK         (HV_HYPERCALL_RSVD0_MASK | \
+                                        HV_HYPERCALL_RSVD1_MASK | \
+                                        HV_HYPERCALL_RSVD2_MASK)
 
 /* hypercall status code */
 #define HV_STATUS_SUCCESS                      0