Re: [PATCH v1 25/28] KVM: nSVM: Flush L2's ASID when emulating INVLPGA

[Yosry Ahmed]

> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> index e4bda43238654..d7b20941b1fee 100644
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
> @@ -2425,17 +2425,51 @@ static int clgi_interception(struct kvm_vcpu *vcpu)
>
>  static int invlpga_interception(struct kvm_vcpu *vcpu)
>  {
> +       struct vcpu_svm *svm = to_svm(vcpu);
>         /* FIXME: Handle an address size prefix. */
>         gva_t gva = kvm_rax_read(vcpu);
>         u32 asid = kvm_ecx_read(vcpu);
> +       int cpu;
>
>         if (nested_svm_check_permissions(vcpu))
>                 return 1;
>
>         trace_kvm_invlpga(to_svm(vcpu)->vmcb->save.rip, asid, gva);
>
> -       /* Let's treat INVLPGA the same as INVLPG (can be optimized!) */
> -       kvm_mmu_invlpg(vcpu, gva);
> +       /*
> +        * INVLPG on a non-canonical address is a NOP according to the SDM,
> +        * assumethe same behavior from INVLPGA since the APM doesn't specify.
> +        */
> +       if (is_noncanonical_invlpg_address(gva, vcpu))
> +               return kvm_skip_emulated_instruction(vcpu);

>From internal Sashiko:
---
This is a pre-existing issue and was not introduced by the patch under review,
but if L1 is configured for 4-level paging and L2 is configured for 5-level
paging, could this drop valid INVLPGA TLB flushes for L2?

Since vcpu represents L1, the check is_noncanonical_invlpg_address(gva, vcpu)
uses L1's canonical boundaries. If L1 executes INVLPGA to flush a valid 57-bit
virtual address for the L2 guest, will KVM incorrectly deem the L2 address as
non-canonical and silently skip emulation?

Bypassing both the hardware TLB flush and shadow page table synchronization
could allow L2 to continue accessing memory through old translations,
potentially leading to memory corruption or security boundary bypass
inside L2.
---

I need to take a closer look here, but if this is indeed an issue,
even if pre-existing, it would only matter with this series. Before
this series, even if INVLPGA is ignored we flush everything before
running L2 anyway.