Re: [PATCH v2] x86/nSVM: Check the L1 IOPM_BASE and MSRPM_BASE assigned physical addresses

On 29.07.2026 16:38, Abdelkareem Abdelsaamad wrote:
> @@ -294,6 +296,24 @@ static int nsvm_vmrun_permissionmap(struct vcpu *v, bool viopm)
>      enum hvm_translation_result ret;
>      unsigned long *ns_viomap;
>      bool ioport_80 = true, ioport_ed = true;
> +    gfn_t ns_iopm_end =
> +        gfn_add(gaddr_to_gfn(ns_vmcb->_iopm_base_pa), (IOPM_PAGES_COUNT - 1));
> +    gfn_t ns_msrpm_end =
> +        gfn_add(gaddr_to_gfn(ns_vmcb->_msrpm_base_pa), (MSRPM_PAGES_COUNT - 1));

Nit: Why the excess parentheses around the 2nd arguments each? Without them
the 2nd instance also more obviously stays within line length limits.

> +    if ( gfn_x(ns_iopm_end) > domain_get_maximum_gpfn(v->domain) )

I don't think using domain_get_maximum_gpfn() is correct here. Imo you want
to merely check against what the guest is told in CPUID. Everything else
ought to be properly covered by hvm_copy_from_guest_phys() /
hvm_map_guest_frame_ro() already. In fact for the MSR bitmap I thus can't
see why further checking would be needed. And for the I/O bitmap it looks
to be a matter of better error handling, rather than introducing extra
checking.

> +    {
> +        gdprintk(XENLOG_ERR, "%s invalid _iopm_base_pa address (%#"PRIx64")\n",
> +                 __func__, ns_vmcb->_iopm_base_pa);
> +        return 1;

Why literal 1? Yes, there is another such return in the function, but no, we
don't want to extend that. Aiui NSVM_ERROR_VVMCB is meant here.

Jan