linux-kernel - [PATCH 00/11] Nested SVM fixes, cleanups, and hardening

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251104195949.3528411-1-yosry.ahmed@linux.dev>
Date: Tue,  4 Nov 2025 19:59:38 +0000
From: Yosry Ahmed <yosry.ahmed@...ux.dev>
To: Sean Christopherson <seanjc@...gle.com>
Cc: Paolo Bonzini <pbonzini@...hat.com>,
	Jim Mattson <jmattson@...gle.com>,
	kvm@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Yosry Ahmed <yosry.ahmed@...ux.dev>
Subject: [PATCH 00/11] Nested SVM fixes, cleanups, and hardening

A group of semi-related fixes, cleanups, and hardening patches for nSVM.

Patches 1-3 fix or add missing consistency checks.

Patches 4-5 are renames to clarify some VMCB fields.

Patches 6-10 add hardening to reading the VMCB12, caching all used
fields in the save area to prevent theoritical TOC-TOU bugs, sanitizing
used fields in the control area, and restricting accesses to the VMCB12
through guest memory.

Patch 11 further restricts fields copied from VMCB01 to VMCB12.

Yosry Ahmed (11):
  KVM: nSVM: Fix consistency checks for NP_ENABLE
  KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS
  KVM: nSVM: Add missing consistency check for event_inj
  KVM: SVM: Rename vmcb->nested_ctl to vmcb->misc_ctl
  KVM: SVM: Rename vmcb->virt_ext to vmcb->misc_ctl2
  KVM: SVM: switch svm_copy_lbrs() to a macro
  KVM: nSVM: Cache all used fields from VMCB12
  KVM: nSVM: Restrict mapping VMCB12 on nested VMRUN
  KVM: nSVM: Simplify nested_svm_vmrun()
  KVM: nSVM: Sanitize control fields copied from VMCB12
  KVM: nSVM: Only copy NP_ENABLE from VMCB01's nested_ctl

 arch/x86/include/asm/svm.h                    |  31 +-
 arch/x86/kvm/svm/nested.c                     | 335 +++++++++++-------
 arch/x86/kvm/svm/sev.c                        |   4 +-
 arch/x86/kvm/svm/svm.c                        |  51 ++-
 arch/x86/kvm/svm/svm.h                        |  46 ++-
 tools/testing/selftests/kvm/include/x86/svm.h |  14 +-
 6 files changed, 302 insertions(+), 179 deletions(-)

-- 
2.51.2.1026.g39e6a42477-goog