[PATCH v2] x86/nSVM: Ignore bits 11:0 of MSRPM_BASE_PA in L1's VMCB for L2

[Stephen Cheng <stephen.cheng@xxxxxxxxxx>]

VMRUN ignores bits 11:0 of MSRPM_BASE_PA (APM volume 2, 24593 Rev. 3.44,
section 15.11 "MSR Intercepts").  On L1's VMRUN of L2,
nsvm_vmrun_permissionmap() copies the MSR permission map which L1 set up
for L2 from MSRPM_BASE_PA exactly as L1 wrote it.  With any of those bits
set, the copy starts at the wrong offset, so both the map L0 runs L2 with
and the intercept check on #VMEXIT use the wrong bits: L1 can miss
intercepts it set or see ones it didn't, and the copy may run into the
following page, giving a spurious VMEXIT_INVALID if that isn't RAM.

Mask the address before copying.

Fixes: 9a779e4fc161 ("Implement SVM specific part for Nested Virtualization")
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Stephen Cheng <stephen.cheng@xxxxxxxxxx>
Reviewed-by: Ross Lagerwall <ross.lagerwall@xxxxxxxxxx>
Acked-by: Jan Beulich <jbeulich@xxxxxxxx>
---

Notes:
    v2:
     - Say which permission map: the one L1 sets up for L2 (Ross).
     - Add the APM section title (Jan).

 xen/arch/x86/hvm/svm/nestedsvm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/xen/arch/x86/hvm/svm/nestedsvm.c b/xen/arch/x86/hvm/svm/nestedsvm.c
index 2b998e26bc..56d0f0fa4d 100644
--- a/xen/arch/x86/hvm/svm/nestedsvm.c
+++ b/xen/arch/x86/hvm/svm/nestedsvm.c
@@ -309,8 +309,10 @@ static int nsvm_vmrun_permissionmap(struct vcpu *v)
 
     ns_msrpm_ptr = (unsigned long *)svm->ns_cached_msrpm;
 
+    /* VMRUN ignores bits 11:0 of MSRPM_BASE_PA. */
     ret = hvm_copy_from_guest_phys(svm->ns_cached_msrpm,
-                                   ns_vmcb->_msrpm_base_pa, MSRPM_SIZE);
+                                   ns_vmcb->_msrpm_base_pa & PAGE_MASK,
+                                   MSRPM_SIZE);
     if ( ret != HVMTRANS_okay )
     {
         gdprintk(XENLOG_ERR, "hvm_copy_from_guest_phys msrpm %u\n", ret);

base-commit: 4e3c0eeac5761c505f8229e82d265eb29957ca5c
-- 
2.49.0