[PATCH] x86/nSVM: Validate the L1 MSRPM physical address range

[Lin Liu <lin.liu01@xxxxxxxxxx>]

8c36d5a500 ("x86/nSVM: Validate the L1 IOPM physical address range") added
this check for the IOPM.  The MSRPM requires a check as well.

"The MSR or IOIO intercept tables extend to a physical address that is
greater than or equal to the maximum supported physical address" is illegal
VMCB state.  Refer to APM vol.2 15.5.

Assisted-by: Claude:claude-opus-5
Signed-off-by: Lin Liu <lin.liu01@xxxxxxxxxx>
---
 xen/arch/x86/hvm/svm/nestedsvm.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/xen/arch/x86/hvm/svm/nestedsvm.c b/xen/arch/x86/hvm/svm/nestedsvm.c
index 5adb1bd72c..3614473702 100644
--- a/xen/arch/x86/hvm/svm/nestedsvm.c
+++ b/xen/arch/x86/hvm/svm/nestedsvm.c
@@ -283,6 +283,12 @@ static int nsvm_vcpu_hostrestore(struct vcpu *v, struct 
cpu_user_regs *regs)
     return 0;
 }
 
+static bool nsvm_perm_map_valid(const struct vcpu *v, uint64_t base,
+                                unsigned int last)
+{
+    return gfn_valid(v->domain, gfn_add(gaddr_to_gfn(base), PFN_DOWN(last)));
+}
+
 static int nsvm_vmrun_permissionmap(struct vcpu *v)
 {
     struct svm_vcpu *arch_svm = &v->arch.hvm.svm;
@@ -295,18 +301,22 @@ static int nsvm_vmrun_permissionmap(struct vcpu *v)
     enum hvm_translation_result ret;
     unsigned long *ns_viomap;
     bool ioport_80 = true, ioport_ed = true;
-    /* IOPM is structured as a linear array of 64K+3 bits. */
-    gfn_t ns_iopm_end =
-        gfn_add(gaddr_to_gfn(ns_vmcb->_iopm_base_pa),
-                PFN_DOWN((0x10000 + 3) / 8));
 
-    if ( !gfn_valid(v->domain, ns_iopm_end) )
+    /* IOPM is structured as a linear array of 64K+3 bits. */
+    if ( !nsvm_perm_map_valid(v, ns_vmcb->_iopm_base_pa, (0x10000 + 3) / 8) )
     {
         gdprintk(XENLOG_ERR, "%s invalid _iopm_base_pa address (%#"PRIx64")\n",
                  __func__, ns_vmcb->_iopm_base_pa);
         return NSVM_ERROR_VVMCB;
     }
 
+    if ( !nsvm_perm_map_valid(v, ns_vmcb->_msrpm_base_pa, MSRPM_SIZE - 1) )
+    {
+        gdprintk(XENLOG_ERR, "%s invalid _msrpm_base_pa address 
(%#"PRIx64")\n",
+                 __func__, ns_vmcb->_msrpm_base_pa);
+        return NSVM_ERROR_VVMCB;
+    }
+
     ns_msrpm_ptr = (unsigned long *)svm->ns_cached_msrpm;
 
     ret = hvm_copy_from_guest_phys(svm->ns_cached_msrpm,
-- 
2.52.0