linux-kernel - [PATCH v2 1/2] KVM: VMX: Do not trap VMFUNC instructions for L1 guests.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20221109075413.1405803-2-yu.c.zhang@linux.intel.com>
Date:   Wed,  9 Nov 2022 15:54:12 +0800
From:   Yu Zhang <yu.c.zhang@...ux.intel.com>
To:     pbonzini@...hat.com, seanjc@...gle.com, kvm@...r.kernel.org
Cc:     linux-kernel@...r.kernel.org
Subject: [PATCH v2 1/2] KVM: VMX: Do not trap VMFUNC instructions for L1 guests.

Currently, although KVM does not support VMFUNC for L1 guests,
it still traps the VMFUNC instructions. This is done by setting
SECONDARY_EXEC_ENABLE_VMFUNC in the VM-execution control and 0
to VM-function control. And then in the VM exit handler, a #UD
is injected to L1 guest.

But for non-nested, KVM do not need to trap VMFUNC at all. According
to Intel SDM Volume3 25.5.6.2, "General Operation of the VMFUNC
Instruction", The VMFUNC instruction causes an invalid-opcode
exception (#UD) if the “enable VM functions” VM-execution controls
is 0.

So just disable SECONDARY_EXEC_ENABLE_VMFUNC in VM-execution
control for L1 guests.

Signed-off-by: Sean Christopherson <seanjc@...gle.com>
Signed-off-by: Yu Zhang <yu.c.zhang@...ux.intel.com>
---
 arch/x86/kvm/vmx/nested.c | 12 +++++-------
 arch/x86/kvm/vmx/vmx.c    |  7 ++++++-
 2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 0c62352dda6a..1acb81c2be11 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -5793,14 +5793,12 @@ static int handle_vmfunc(struct kvm_vcpu *vcpu)
 	u32 function = kvm_rax_read(vcpu);
 
 	/*
-	 * VMFUNC is only supported for nested guests, but we always enable the
-	 * secondary control for simplicity; for non-nested mode, fake that we
-	 * didn't by injecting #UD.
+	 * VMFUNC is only supported for nested guests. Executing VMFUNC
+	 * in non-nested guests shall receive #UD directly, instead of
+	 * trigerring a VM-Exit.
 	 */
-	if (!is_guest_mode(vcpu)) {
-		kvm_queue_exception(vcpu, UD_VECTOR);
-		return 1;
-	}
+	if (KVM_BUG_ON(!is_guest_mode(vcpu), vcpu->kvm))
+		return -EIO;
 
 	vmcs12 = get_vmcs12(vcpu);
 
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 63247c57c72c..5a66c3c16c2d 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -4487,6 +4487,12 @@ static u32 vmx_secondary_exec_control(struct vcpu_vmx *vmx)
 				  SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY);
 	exec_control &= ~SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE;
 
+	/*
+	 * KVM doesn't support VMFUNC for L1, but the control is set in KVM's
+	 * base configuration as KVM emulates VMFUNC[EPTP_SWITCHING] for L2.
+	 */
+	exec_control &= ~SECONDARY_EXEC_ENABLE_VMFUNC;
+
 	/* SECONDARY_EXEC_DESC is enabled/disabled on writes to CR4.UMIP,
 	 * in vmx_set_cr4.  */
 	exec_control &= ~SECONDARY_EXEC_DESC;
@@ -6004,7 +6010,6 @@ static int (*kvm_vmx_exit_handlers[])(struct kvm_vcpu *vcpu) = {
 	[EXIT_REASON_RDSEED]                  = kvm_handle_invalid_op,
 	[EXIT_REASON_PML_FULL]		      = handle_pml_full,
 	[EXIT_REASON_INVPCID]                 = handle_invpcid,
-	[EXIT_REASON_VMFUNC]		      = handle_vmx_instruction,
 	[EXIT_REASON_PREEMPTION_TIMER]	      = handle_preemption_timer,
 	[EXIT_REASON_ENCLS]		      = handle_encls,
 	[EXIT_REASON_BUS_LOCK]                = handle_bus_lock_vmexit,
-- 
2.17.1