linux-kernel - Re: [PATCH v4 3/4] x86: nVMX: check vmcs12->guest_ia32

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <dfd52ae3c91f28d31ef1aa176a1aee4a4b596df2.camel@redhat.com>
Date: Wed, 21 May 2025 12:50:48 -0400
From: mlevitsk@...hat.com
To: Chao Gao <chao.gao@...el.com>
Cc: kvm@...r.kernel.org, Thomas Gleixner <tglx@...utronix.de>, Sean
 Christopherson <seanjc@...gle.com>, Borislav Petkov <bp@...en8.de>,
 x86@...nel.org, Ingo Molnar <mingo@...hat.com>, 
 linux-kernel@...r.kernel.org, "H. Peter Anvin" <hpa@...or.com>, Paolo
 Bonzini <pbonzini@...hat.com>, Dave Hansen <dave.hansen@...ux.intel.com>
Subject: Re: [PATCH v4 3/4] x86: nVMX: check vmcs12->guest_ia32_debugctl
 value given by L2

On Wed, 2025-05-21 at 08:32 +0800, Chao Gao wrote:
> On Tue, May 20, 2025 at 05:48:44PM -0400, mlevitsk@...hat.com wrote:
> > On Fri, 2025-05-16 at 10:50 -0400, mlevitsk@...hat.com wrote:
> > > On Fri, 2025-05-16 at 11:31 +0800, Chao Gao wrote:
> > > > On Wed, May 14, 2025 at 08:53:52PM -0400, Maxim Levitsky wrote:
> > > > > Check the vmcs12 guest_ia32_debugctl value before loading it, to avoid L2
> > > > > being able to load arbitrary values to hardware IA32_DEBUGCTL.
> > > > > 
> > > > > Signed-off-by: Maxim Levitsky <mlevitsk@...hat.com>
> > > > > ---
> > > > > arch/x86/kvm/vmx/nested.c | 4 ++++
> > > > > arch/x86/kvm/vmx/vmx.c    | 2 +-
> > > > > arch/x86/kvm/vmx/vmx.h    | 2 ++
> > > > > 3 files changed, 7 insertions(+), 1 deletion(-)
> > > > > 
> > > > > diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
> > > > > index e073e3008b16..0bda6400e30a 100644
> > > > > --- a/arch/x86/kvm/vmx/nested.c
> > > > > +++ b/arch/x86/kvm/vmx/nested.c
> > > > > @@ -3193,6 +3193,10 @@ static int nested_vmx_check_guest_state(struct kvm_vcpu *vcpu,
> > > > > 	     CC((vmcs12->guest_bndcfgs & MSR_IA32_BNDCFGS_RSVD))))
> > > > > 		return -EINVAL;
> > > > > 
> > > > > +	if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS) &&
> > > > > +	     CC(vmcs12->guest_ia32_debugctl & ~vmx_get_supported_debugctl(vcpu, false)))
> > > > > +		return -EINVAL;
> > > > > +
> > > > 
> > > > How about grouping this check with the one against DR7 a few lines above?
> > > 
> > > Good idea, will do.
> > 
> > Besides the above change, is there anything else to change in this patchset?
> > If not I'll sent a new version soon.
> 
> ...
> 
> > > > > diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h
> > > > > index 6d1e40ecc024..1b80479505d3 100644
> > > > > --- a/arch/x86/kvm/vmx/vmx.h
> > > > > +++ b/arch/x86/kvm/vmx/vmx.h
> > > > > @@ -413,7 +413,9 @@ static inline void vmx_set_intercept_for_msr(struct kvm_vcpu *vcpu, u32 msr,
> > > > > 		vmx_disable_intercept_for_msr(vcpu, msr, type);
> > > > > }
> > > > > 
> > > > > +
> > > > 
> > > > stray newline.
> 
> Can you remove this newline? (not sure if you've already noticed this)
Sure thing!

> 
> Also, the shortlogs for patches 3-4 don't follow the convention. They should be
> "KVM: nVMX" and "KVM: VMX". With these fixed,

Sure thing - I wish it was more consistent but you are right. 



> 
> Reviewed-by: Chao Gao <chao.gao@...el.com>
> 

Thank you very much!
Best regards,
	Maxim Levitsky