linux-kernel - Re: [PATCH v4 3/4] x86: nVMX: check vmcs12->guest_ia32

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aCaxlS+juu1Rl7Mv@intel.com>
Date: Fri, 16 May 2025 11:31:33 +0800
From: Chao Gao <chao.gao@...el.com>
To: Maxim Levitsky <mlevitsk@...hat.com>
CC: <kvm@...r.kernel.org>, Thomas Gleixner <tglx@...utronix.de>, "Sean
 Christopherson" <seanjc@...gle.com>, Borislav Petkov <bp@...en8.de>,
	<x86@...nel.org>, Ingo Molnar <mingo@...hat.com>,
	<linux-kernel@...r.kernel.org>, "H. Peter Anvin" <hpa@...or.com>, "Paolo
 Bonzini" <pbonzini@...hat.com>, Dave Hansen <dave.hansen@...ux.intel.com>
Subject: Re: [PATCH v4 3/4] x86: nVMX: check vmcs12->guest_ia32_debugctl
 value given by L2

On Wed, May 14, 2025 at 08:53:52PM -0400, Maxim Levitsky wrote:
>Check the vmcs12 guest_ia32_debugctl value before loading it, to avoid L2
>being able to load arbitrary values to hardware IA32_DEBUGCTL.
>
>Signed-off-by: Maxim Levitsky <mlevitsk@...hat.com>
>---
> arch/x86/kvm/vmx/nested.c | 4 ++++
> arch/x86/kvm/vmx/vmx.c    | 2 +-
> arch/x86/kvm/vmx/vmx.h    | 2 ++
> 3 files changed, 7 insertions(+), 1 deletion(-)
>
>diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
>index e073e3008b16..0bda6400e30a 100644
>--- a/arch/x86/kvm/vmx/nested.c
>+++ b/arch/x86/kvm/vmx/nested.c
>@@ -3193,6 +3193,10 @@ static int nested_vmx_check_guest_state(struct kvm_vcpu *vcpu,
> 	     CC((vmcs12->guest_bndcfgs & MSR_IA32_BNDCFGS_RSVD))))
> 		return -EINVAL;
> 
>+	if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS) &&
>+	     CC(vmcs12->guest_ia32_debugctl & ~vmx_get_supported_debugctl(vcpu, false)))
>+		return -EINVAL;
>+

How about grouping this check with the one against DR7 a few lines above?

> 	if (nested_check_guest_non_reg_state(vmcs12))
> 		return -EINVAL;
> 
>diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
>index 9953de0cb32a..9046ee2e9a04 100644
>--- a/arch/x86/kvm/vmx/vmx.c
>+++ b/arch/x86/kvm/vmx/vmx.c
>@@ -2179,7 +2179,7 @@ static u64 nested_vmx_truncate_sysenter_addr(struct kvm_vcpu *vcpu,
> 	return (unsigned long)data;
> }
> 
>-static u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiated)
>+u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiated)
> {
> 	u64 debugctl = 0;
> 
>diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h
>index 6d1e40ecc024..1b80479505d3 100644
>--- a/arch/x86/kvm/vmx/vmx.h
>+++ b/arch/x86/kvm/vmx/vmx.h
>@@ -413,7 +413,9 @@ static inline void vmx_set_intercept_for_msr(struct kvm_vcpu *vcpu, u32 msr,
> 		vmx_disable_intercept_for_msr(vcpu, msr, type);
> }
> 
>+

stray newline.

> void vmx_update_cpu_dirty_logging(struct kvm_vcpu *vcpu);
>+u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiated);
> 
> /*
>  * Note, early Intel manuals have the write-low and read-high bitmap offsets
>-- 
>2.46.0
>
>