Re: [PATCH v7 17/26] KVM: nSVM: Add missing consistency check for EVENTINJ

[Sean Christopherson]

On Mon, Aug 03, 2026, Abdelkareem Abdelsaamad wrote:
> Hey,
> I am currently working on hardening the Xen hypervisor's nested SVM
> implementation to add the VMRUN consistency checks for injected events,
> see the Xen patch discussion thread in [1].
> 
> While reviewing KVM's logic in nested_svm_event_inj_valid_exept(), I
> can see that BR_VECTOR (5) and OF_VECTOR (4) are treated as
> unconditionally valid. The referenced AMD APM Vol 2, Section 15.20
> explicitly state otherwise:
> "If the VMM attempts to inject an event that is impossible for the
> guest mode (e.g., a #BR exception when the guest is in 64-bit mode),
> the event injection will fail... VMRUN will immediately exit with
> VMEXIT_INVALID."
> "Injecting an exception (TYPE = 3) with vectors 3 or 4 behaves like
> a trap raised by INT3 and INTO instructions, respectively"
> 
> Also, the APM volume 3 chapter 3 (INTO instruction), states that the
> #OF triggering instruction, INTO, is Invalid in 64-bit mode.

LOL, _that's_ what SVM decides is worthy of a consistency check?

> I attempted testing the injection with Xen-Testing-Framework (XTF)
> bare-minimum testing setup. I injected an exception (TYPE=3) with the
> named vectors (BR_VECTOR (5) and OF_VECTOR (4)) on Genoa host. They
> both caused VMEXIT_INVALID.
> 
> I think the check in nested_svm_event_inj_valid_exept() needs to be
> gated on a condition that only allows Type 3 exception injections for
> OF_VECTOR (4) and BR_VECTOR (5) when the guest is not in 64-bit mode.

It'd probably require a dedicated check in nested_svm_check_cached_vmcb12(),
because the consistency check involves both control state and save state.  Given
that event injection validaton on SVM is inherently flawed due to hardware behavior
being microarchitecture specific, addressing this is very low down on the priority
list.  If someone wants to tackle it, by all means, but realistically I doubt this
will get fixed anytime soon.

> Please, could you have a look and share your insights on the
> implemented logic?
> 
> [1] https://lists.xenproject.org/archives/html/xen-devel/2026-07/msg00808.html
> 
> --Abdelkareem