From nobody Mon Sep 29 20:18:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C137CC00140 for ; Mon, 15 Aug 2022 21:53:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347244AbiHOVx1 (ORCPT ); Mon, 15 Aug 2022 17:53:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42958 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349217AbiHOVu2 (ORCPT ); Mon, 15 Aug 2022 17:50:28 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 601B3DEB4B; Mon, 15 Aug 2022 12:32:19 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4A41EB81128; Mon, 15 Aug 2022 19:32:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 91E67C433C1; Mon, 15 Aug 2022 19:32:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1660591936; bh=nywY7KH+TPVVkeRIr3RwmxMktYN+oLCnQqH0fdDXb4w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=o1DpCskZmXMSFCHq+TNceB2uC8bnGb4eEOC8FgGFyxHPGVPd2b5gslOpXU3Al60dR 3kbrpc4cvkJwixQAwZidvWQv8ngB+4jwNXS5rnKwJyW2WLL1IZ4xf6qzhvhtkZ8ioh PtMHslhBhsV1coxkQt8g11AZw5+gu3Vc/1s8SGK4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Matlack , Sean Christopherson , Paolo Bonzini Subject: [PATCH 5.19 0033/1157] KVM: nVMX: Let userspace set nVMX MSR to any _host_ supported value Date: Mon, 15 Aug 2022 19:49:49 +0200 Message-Id: <20220815180440.761822478@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220815180439.416659447@linuxfoundation.org> References: <20220815180439.416659447@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sean Christopherson commit f8ae08f9789ad59d318ea75b570caa454aceda81 upstream. Restrict the nVMX MSRs based on KVM's config, not based on the guest's current config. Using the guest's config to audit the new config prevents userspace from restoring the original config (KVM's config) if at any point in the past the guest's config was restricted in any way. Fixes: 62cc6b9dc61e ("KVM: nVMX: support restore of VMX capability MSRs") Cc: stable@vger.kernel.org Cc: David Matlack Signed-off-by: Sean Christopherson Message-Id: <20220607213604.3346000-6-seanjc@google.com> Signed-off-by: Paolo Bonzini Signed-off-by: Greg Kroah-Hartman --- arch/x86/kvm/vmx/nested.c | 70 ++++++++++++++++++++++++-----------------= ----- 1 file changed, 37 insertions(+), 33 deletions(-) --- a/arch/x86/kvm/vmx/nested.c +++ b/arch/x86/kvm/vmx/nested.c @@ -1223,7 +1223,7 @@ static int vmx_restore_vmx_basic(struct BIT_ULL(49) | BIT_ULL(54) | BIT_ULL(55) | /* reserved */ BIT_ULL(31) | GENMASK_ULL(47, 45) | GENMASK_ULL(63, 56); - u64 vmx_basic =3D vmx->nested.msrs.basic; + u64 vmx_basic =3D vmcs_config.nested.basic; =20 if (!is_bitwise_subset(vmx_basic, data, feature_and_reserved)) return -EINVAL; @@ -1246,36 +1246,42 @@ static int vmx_restore_vmx_basic(struct return 0; } =20 -static int -vmx_restore_control_msr(struct vcpu_vmx *vmx, u32 msr_index, u64 data) +static void vmx_get_control_msr(struct nested_vmx_msrs *msrs, u32 msr_inde= x, + u32 **low, u32 **high) { - u64 supported; - u32 *lowp, *highp; - switch (msr_index) { case MSR_IA32_VMX_TRUE_PINBASED_CTLS: - lowp =3D &vmx->nested.msrs.pinbased_ctls_low; - highp =3D &vmx->nested.msrs.pinbased_ctls_high; + *low =3D &msrs->pinbased_ctls_low; + *high =3D &msrs->pinbased_ctls_high; break; case MSR_IA32_VMX_TRUE_PROCBASED_CTLS: - lowp =3D &vmx->nested.msrs.procbased_ctls_low; - highp =3D &vmx->nested.msrs.procbased_ctls_high; + *low =3D &msrs->procbased_ctls_low; + *high =3D &msrs->procbased_ctls_high; break; case MSR_IA32_VMX_TRUE_EXIT_CTLS: - lowp =3D &vmx->nested.msrs.exit_ctls_low; - highp =3D &vmx->nested.msrs.exit_ctls_high; + *low =3D &msrs->exit_ctls_low; + *high =3D &msrs->exit_ctls_high; break; case MSR_IA32_VMX_TRUE_ENTRY_CTLS: - lowp =3D &vmx->nested.msrs.entry_ctls_low; - highp =3D &vmx->nested.msrs.entry_ctls_high; + *low =3D &msrs->entry_ctls_low; + *high =3D &msrs->entry_ctls_high; break; case MSR_IA32_VMX_PROCBASED_CTLS2: - lowp =3D &vmx->nested.msrs.secondary_ctls_low; - highp =3D &vmx->nested.msrs.secondary_ctls_high; + *low =3D &msrs->secondary_ctls_low; + *high =3D &msrs->secondary_ctls_high; break; default: BUG(); } +} + +static int +vmx_restore_control_msr(struct vcpu_vmx *vmx, u32 msr_index, u64 data) +{ + u32 *lowp, *highp; + u64 supported; + + vmx_get_control_msr(&vmcs_config.nested, msr_index, &lowp, &highp); =20 supported =3D vmx_control_msr(*lowp, *highp); =20 @@ -1287,6 +1293,7 @@ vmx_restore_control_msr(struct vcpu_vmx if (!is_bitwise_subset(supported, data, GENMASK_ULL(63, 32))) return -EINVAL; =20 + vmx_get_control_msr(&vmx->nested.msrs, msr_index, &lowp, &highp); *lowp =3D data; *highp =3D data >> 32; return 0; @@ -1300,10 +1307,8 @@ static int vmx_restore_vmx_misc(struct v BIT_ULL(28) | BIT_ULL(29) | BIT_ULL(30) | /* reserved */ GENMASK_ULL(13, 9) | BIT_ULL(31); - u64 vmx_misc; - - vmx_misc =3D vmx_control_msr(vmx->nested.msrs.misc_low, - vmx->nested.msrs.misc_high); + u64 vmx_misc =3D vmx_control_msr(vmcs_config.nested.misc_low, + vmcs_config.nested.misc_high); =20 if (!is_bitwise_subset(vmx_misc, data, feature_and_reserved_bits)) return -EINVAL; @@ -1331,10 +1336,8 @@ static int vmx_restore_vmx_misc(struct v =20 static int vmx_restore_vmx_ept_vpid_cap(struct vcpu_vmx *vmx, u64 data) { - u64 vmx_ept_vpid_cap; - - vmx_ept_vpid_cap =3D vmx_control_msr(vmx->nested.msrs.ept_caps, - vmx->nested.msrs.vpid_caps); + u64 vmx_ept_vpid_cap =3D vmx_control_msr(vmcs_config.nested.ept_caps, + vmcs_config.nested.vpid_caps); =20 /* Every bit is either reserved or a feature bit. */ if (!is_bitwise_subset(vmx_ept_vpid_cap, data, -1ULL)) @@ -1345,20 +1348,21 @@ static int vmx_restore_vmx_ept_vpid_cap( return 0; } =20 -static int vmx_restore_fixed0_msr(struct vcpu_vmx *vmx, u32 msr_index, u64= data) +static u64 *vmx_get_fixed0_msr(struct nested_vmx_msrs *msrs, u32 msr_index) { - u64 *msr; - switch (msr_index) { case MSR_IA32_VMX_CR0_FIXED0: - msr =3D &vmx->nested.msrs.cr0_fixed0; - break; + return &msrs->cr0_fixed0; case MSR_IA32_VMX_CR4_FIXED0: - msr =3D &vmx->nested.msrs.cr4_fixed0; - break; + return &msrs->cr4_fixed0; default: BUG(); } +} + +static int vmx_restore_fixed0_msr(struct vcpu_vmx *vmx, u32 msr_index, u64= data) +{ + const u64 *msr =3D vmx_get_fixed0_msr(&vmcs_config.nested, msr_index); =20 /* * 1 bits (which indicates bits which "must-be-1" during VMX operation) @@ -1367,7 +1371,7 @@ static int vmx_restore_fixed0_msr(struct if (!is_bitwise_subset(data, *msr, -1ULL)) return -EINVAL; =20 - *msr =3D data; + *vmx_get_fixed0_msr(&vmx->nested.msrs, msr_index) =3D data; return 0; } =20 @@ -1428,7 +1432,7 @@ int vmx_set_vmx_msr(struct kvm_vcpu *vcp vmx->nested.msrs.vmcs_enum =3D data; return 0; case MSR_IA32_VMX_VMFUNC: - if (data & ~vmx->nested.msrs.vmfunc_controls) + if (data & ~vmcs_config.nested.vmfunc_controls) return -EINVAL; vmx->nested.msrs.vmfunc_controls =3D data; return 0;