Re: [PATCH v7 17/26] KVM: nSVM: Add missing consistency check for EVENTINJ

Hey,
I am currently working on hardening the Xen hypervisor's nested SVM
implementation to add the VMRUN consistency checks for injected events,
see the Xen patch discussion thread in [1].

While reviewing KVM's logic in nested_svm_event_inj_valid_exept(), I
can see that BR_VECTOR (5) and OF_VECTOR (4) are treated as
unconditionally valid. The referenced AMD APM Vol 2, Section 15.20
explicitly state otherwise:
"If the VMM attempts to inject an event that is impossible for the
guest mode (e.g., a #BR exception when the guest is in 64-bit mode),
the event injection will fail... VMRUN will immediately exit with
VMEXIT_INVALID."
"Injecting an exception (TYPE = 3) with vectors 3 or 4 behaves like
a trap raised by INT3 and INTO instructions, respectively"

Also, the APM volume 3 chapter 3 (INTO instruction), states that the
#OF triggering instruction, INTO, is Invalid in 64-bit mode.

I attempted testing the injection with Xen-Testing-Framework (XTF)
bare-minimum testing setup. I injected an exception (TYPE=3) with the
named vectors (BR_VECTOR (5) and OF_VECTOR (4)) on Genoa host. They
both caused VMEXIT_INVALID.

I think the check in nested_svm_event_inj_valid_exept() needs to be
gated on a condition that only allows Type 3 exception injections for
OF_VECTOR (4) and BR_VECTOR (5) when the guest is not in 64-bit mode.

Please, could you have a look and share your insights on the
implemented logic?

[1] https://lists.xenproject.org/archives/html/xen-devel/2026-07/msg00808.html

--Abdelkareem