| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <229A00D7-178E-47E4-B596-B467B2C66956@zytor.com>
Date: Tue, 20 Jan 2026 01:19:55 -0800
From: Xin Li <xin@...or.com>
To: Chao Gao <chao.gao@...el.com>
Cc: linux-kernel@...r.kernel.org, kvm@...r.kernel.org,
linux-doc@...r.kernel.org, pbonzini@...hat.com, seanjc@...gle.com,
corbet@....net, tglx@...utronix.de, mingo@...hat.com, bp@...en8.de,
dave.hansen@...ux.intel.com, x86@...nel.org, hpa@...or.com,
luto@...nel.org, peterz@...radead.org, andrew.cooper3@...rix.com,
hch@...radead.org, sohil.mehta@...el.com
Subject: Re: [PATCH v9 20/22] KVM: nVMX: Validate FRED-related VMCS fields
>> @@ -3047,22 +3049,11 @@ static int nested_check_vm_entry_controls(struct kvm_vcpu *vcpu,
>> u8 vector = intr_info & INTR_INFO_VECTOR_MASK;
>> u32 intr_type = intr_info & INTR_INFO_INTR_TYPE_MASK;
>> bool has_error_code = intr_info & INTR_INFO_DELIVER_CODE_MASK;
>> + bool has_nested_exception = vmx->nested.msrs.basic & VMX_BASIC_NESTED_EXCEPTION;
>
> has_error_code reflects whether the to-be-injected event has an error code.
> Using has_nested_exception for CPU capabilities here is a bit confusing.
Looks better to just remove has_error_code.
>
>> bool urg = nested_cpu_has2(vmcs12,
>> SECONDARY_EXEC_UNRESTRICTED_GUEST);
>> bool prot_mode = !urg || vmcs12->guest_cr0 & X86_CR0_PE;
>>
>> - /* VM-entry interruption-info field: interruption type */
>> - if (CC(intr_type == INTR_TYPE_RESERVED) ||
>> - CC(intr_type == INTR_TYPE_OTHER_EVENT &&
>> - !nested_cpu_supports_monitor_trap_flag(vcpu)))
>> - return -EINVAL;
>> -
>> - /* VM-entry interruption-info field: vector */
>> - if (CC(intr_type == INTR_TYPE_NMI_INTR && vector != NMI_VECTOR) ||
>> - CC(intr_type == INTR_TYPE_HARD_EXCEPTION && vector > 31) ||
>> - CC(intr_type == INTR_TYPE_OTHER_EVENT && vector != 0))
>> - return -EINVAL;
>> -
>> /*
>> * Cannot deliver error code in real mode or if the interrupt
>> * type is not hardware exception. For other cases, do the
>> @@ -3086,8 +3077,28 @@ static int nested_check_vm_entry_controls(struct kvm_vcpu *vcpu,
>> if (CC(intr_info & INTR_INFO_RESVD_BITS_MASK))
>> return -EINVAL;
>>
>> - /* VM-entry instruction length */
>> + /*
>> + * When the CPU enumerates VMX nested-exception support, bit 13
>> + * (set to indicate a nested exception) of the intr info field
>> + * may have value 1. Otherwise bit 13 is reserved.
>> + */
>> + if (CC(!(has_nested_exception && intr_type == INTR_TYPE_HARD_EXCEPTION) &&
>> + intr_info & INTR_INFO_NESTED_EXCEPTION_MASK))
>> + return -EINVAL;
>> +
>> switch (intr_type) {
>> + case INTR_TYPE_EXT_INTR:
>> + break;
>
> This can be dropped, as the "default" case will handle it.
We don’t have a default case, as all 8 cases are listed (INTR_INFO_INTR_TYPE_MASK is 0x700).
>
>> + case INTR_TYPE_RESERVED:
>> + return -EINVAL;
>
> I think we need to add a CC() statement to make it easier to correlate a
> VM-entry failure with a specific consistency check.
What do you want me to put in CC()?
CC(intr_type == INTR_TYPE_RESERVED)?
>
>> + case INTR_TYPE_NMI_INTR:
>> + if (CC(vector != NMI_VECTOR))
>> + return -EINVAL;
>> + break;
>> + case INTR_TYPE_HARD_EXCEPTION:
>> + if (CC(vector > 31))
>> + return -EINVAL;
>> + break;
>> case INTR_TYPE_SOFT_EXCEPTION:
>> case INTR_TYPE_SOFT_INTR:
>> case INTR_TYPE_PRIV_SW_EXCEPTION:
>> @@ -3095,6 +3106,24 @@ static int nested_check_vm_entry_controls(struct kvm_vcpu *vcpu,
>> CC(vmcs12->vm_entry_instruction_len == 0 &&
>> CC(!nested_cpu_has_zero_length_injection(vcpu))))
>> return -EINVAL;
>> + break;
>> + case INTR_TYPE_OTHER_EVENT:
>> + switch (vector) {
>> + case 0:
>> + if (CC(!nested_cpu_supports_monitor_trap_flag(vcpu)))
>> + return -EINVAL;
>
> Does this nested_cpu_supports_monitor_trap_flag() check apply to case 1/2?
I did check the spec when writing the code but I will doublecheck.
>
>> + break;
>> + case 1:
>> + case 2:
>> + if (CC(!fred_enabled))
>> + return -EINVAL;
>> + if (CC(vmcs12->vm_entry_instruction_len > X86_MAX_INSTRUCTION_LENGTH))
>> + return -EINVAL;
>> + break;
>> + default:
>> + return -EINVAL;
>
> Again, I think -EINVAL should be accompanied by a CC() statement.
>
>> + }
>> + break;
>> }
>> }
>>
>> @@ -3213,9 +3242,29 @@ static int nested_vmx_check_host_state(struct kvm_vcpu *vcpu,
>> if (ia32e) {
>> if (CC(!(vmcs12->host_cr4 & X86_CR4_PAE)))
>> return -EINVAL;
>> + if (vmcs12->vm_exit_controls & VM_EXIT_ACTIVATE_SECONDARY_CONTROLS &&
>> + vmcs12->secondary_vm_exit_controls & SECONDARY_VM_EXIT_LOAD_IA32_FRED) {
>> + if (CC(vmcs12->host_ia32_fred_config &
>> + (BIT_ULL(11) | GENMASK_ULL(5, 4) | BIT_ULL(2))) ||
>> + CC(vmcs12->host_ia32_fred_rsp1 & GENMASK_ULL(5, 0)) ||
>> + CC(vmcs12->host_ia32_fred_rsp2 & GENMASK_ULL(5, 0)) ||
>> + CC(vmcs12->host_ia32_fred_rsp3 & GENMASK_ULL(5, 0)) ||
>> + CC(vmcs12->host_ia32_fred_ssp1 & GENMASK_ULL(2, 0)) ||
>> + CC(vmcs12->host_ia32_fred_ssp2 & GENMASK_ULL(2, 0)) ||
>> + CC(vmcs12->host_ia32_fred_ssp3 & GENMASK_ULL(2, 0)) ||
>> + CC(is_noncanonical_msr_address(vmcs12->host_ia32_fred_config & PAGE_MASK, vcpu)) ||
>> + CC(is_noncanonical_msr_address(vmcs12->host_ia32_fred_rsp1, vcpu)) ||
>> + CC(is_noncanonical_msr_address(vmcs12->host_ia32_fred_rsp2, vcpu)) ||
>> + CC(is_noncanonical_msr_address(vmcs12->host_ia32_fred_rsp3, vcpu)) ||
>> + CC(is_noncanonical_msr_address(vmcs12->host_ia32_fred_ssp1, vcpu)) ||
>> + CC(is_noncanonical_msr_address(vmcs12->host_ia32_fred_ssp2, vcpu)) ||
>> + CC(is_noncanonical_msr_address(vmcs12->host_ia32_fred_ssp3, vcpu)))
>> + return -EINVAL;
>> + }
>> } else {
>> if (CC(vmcs12->vm_entry_controls & VM_ENTRY_IA32E_MODE) ||
>> CC(vmcs12->host_cr4 & X86_CR4_PCIDE) ||
>> + CC(vmcs12->host_cr4 & X86_CR4_FRED) ||
>> CC((vmcs12->host_rip) >> 32))
>> return -EINVAL;
>> }
>> @@ -3384,6 +3433,48 @@ static int nested_vmx_check_guest_state(struct kvm_vcpu *vcpu,
>> CC((vmcs12->guest_bndcfgs & MSR_IA32_BNDCFGS_RSVD))))
>> return -EINVAL;
>>
>> + if (ia32e) {
>> + if (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_IA32_FRED) {
>> + if (CC(vmcs12->guest_ia32_fred_config &
>> + (BIT_ULL(11) | GENMASK_ULL(5, 4) | BIT_ULL(2))) ||
>> + CC(vmcs12->guest_ia32_fred_rsp1 & GENMASK_ULL(5, 0)) ||
>> + CC(vmcs12->guest_ia32_fred_rsp2 & GENMASK_ULL(5, 0)) ||
>> + CC(vmcs12->guest_ia32_fred_rsp3 & GENMASK_ULL(5, 0)) ||
>> + CC(vmcs12->guest_ia32_fred_ssp1 & GENMASK_ULL(2, 0)) ||
>> + CC(vmcs12->guest_ia32_fred_ssp2 & GENMASK_ULL(2, 0)) ||
>> + CC(vmcs12->guest_ia32_fred_ssp3 & GENMASK_ULL(2, 0)) ||
>> + CC(is_noncanonical_msr_address(vmcs12->guest_ia32_fred_config & PAGE_MASK, vcpu)) ||
>> + CC(is_noncanonical_msr_address(vmcs12->guest_ia32_fred_rsp1, vcpu)) ||
>> + CC(is_noncanonical_msr_address(vmcs12->guest_ia32_fred_rsp2, vcpu)) ||
>> + CC(is_noncanonical_msr_address(vmcs12->guest_ia32_fred_rsp3, vcpu)) ||
>> + CC(is_noncanonical_msr_address(vmcs12->guest_ia32_fred_ssp1, vcpu)) ||
>> + CC(is_noncanonical_msr_address(vmcs12->guest_ia32_fred_ssp2, vcpu)) ||
>> + CC(is_noncanonical_msr_address(vmcs12->guest_ia32_fred_ssp3, vcpu)))
>> + return -EINVAL;
>> + }
>> + if (vmcs12->guest_cr4 & X86_CR4_FRED) {
>> + unsigned int ss_dpl = VMX_AR_DPL(vmcs12->guest_ss_ar_bytes);
>> + switch (ss_dpl) {
>> + case 0:
>> + if (CC(!(vmcs12->guest_cs_ar_bytes & VMX_AR_L_MASK)))
>> + return -EINVAL;
>> + break;
>> + case 1:
>> + case 2:
>> + return -EINVAL;
>
> Ditto.
>
>> + case 3:
>> + if (CC(vmcs12->guest_rflags & X86_EFLAGS_IOPL))
>> + return -EINVAL;
>> + if (CC(vmcs12->guest_interruptibility_info & GUEST_INTR_STATE_STI))
>> + return -EINVAL;
>> + break;
>> + }
>> + }
>> + } else {
>> + if (CC(vmcs12->guest_cr4 & X86_CR4_FRED))
>> + return -EINVAL;
>> + }
>> +
>> if (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_CET_STATE) {
>> if (nested_vmx_check_cet_state_common(vcpu, vmcs12->guest_s_cet,
>> vmcs12->guest_ssp,
>> --
>> 2.51.0
Powered by blists - more mailing lists