1. Patchew
  2. linux
  3. [PATCH v4 0/4] KVM: x86: allow DEBUGCTL.DEBUGCTLMSR_FREEZE_IN_SMM passthrough
  4. View patch

[PATCH v4 3/4] x86: nVMX: check vmcs12->guest_ia32_debugctl value given by L2

Maxim Levitsky posted 4 patches 7 months ago
There is a newer version of this series
[PATCH v4 3/4] x86: nVMX: check vmcs12->guest_ia32_debugctl value given by L2
Posted by Maxim Levitsky 7 months ago 
Check the vmcs12 guest_ia32_debugctl value before loading it, to avoid L2
being able to load arbitrary values to hardware IA32_DEBUGCTL.

Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
---
 arch/x86/kvm/vmx/nested.c | 4 ++++
 arch/x86/kvm/vmx/vmx.c    | 2 +-
 arch/x86/kvm/vmx/vmx.h    | 2 ++
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index e073e3008b16..0bda6400e30a 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -3193,6 +3193,10 @@ static int nested_vmx_check_guest_state(struct kvm_vcpu *vcpu,
 	     CC((vmcs12->guest_bndcfgs & MSR_IA32_BNDCFGS_RSVD))))
 		return -EINVAL;
 
+	if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS) &&
+	     CC(vmcs12->guest_ia32_debugctl & ~vmx_get_supported_debugctl(vcpu, false)))
+		return -EINVAL;
+
 	if (nested_check_guest_non_reg_state(vmcs12))
 		return -EINVAL;
 
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 9953de0cb32a..9046ee2e9a04 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -2179,7 +2179,7 @@ static u64 nested_vmx_truncate_sysenter_addr(struct kvm_vcpu *vcpu,
 	return (unsigned long)data;
 }
 
-static u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiated)
+u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiated)
 {
 	u64 debugctl = 0;
 
diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h
index 6d1e40ecc024..1b80479505d3 100644
--- a/arch/x86/kvm/vmx/vmx.h
+++ b/arch/x86/kvm/vmx/vmx.h
@@ -413,7 +413,9 @@ static inline void vmx_set_intercept_for_msr(struct kvm_vcpu *vcpu, u32 msr,
 		vmx_disable_intercept_for_msr(vcpu, msr, type);
 }
 
+
 void vmx_update_cpu_dirty_logging(struct kvm_vcpu *vcpu);
+u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiated);
 
 /*
  * Note, early Intel manuals have the write-low and read-high bitmap offsets
-- 
2.46.0
Re: [PATCH v4 3/4] x86: nVMX: check vmcs12->guest_ia32_debugctl value given by L2
Posted by Sean Christopherson 6 months, 4 weeks ago 
"KVM: nVMX:" for the shortlog scope.
Re: [PATCH v4 3/4] x86: nVMX: check vmcs12->guest_ia32_debugctl value given by L2
Posted by Chao Gao 7 months ago 
On Wed, May 14, 2025 at 08:53:52PM -0400, Maxim Levitsky wrote:
>Check the vmcs12 guest_ia32_debugctl value before loading it, to avoid L2
>being able to load arbitrary values to hardware IA32_DEBUGCTL.
>
>Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
>---
> arch/x86/kvm/vmx/nested.c | 4 ++++
> arch/x86/kvm/vmx/vmx.c    | 2 +-
> arch/x86/kvm/vmx/vmx.h    | 2 ++
> 3 files changed, 7 insertions(+), 1 deletion(-)
>
>diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
>index e073e3008b16..0bda6400e30a 100644
>--- a/arch/x86/kvm/vmx/nested.c
>+++ b/arch/x86/kvm/vmx/nested.c
>@@ -3193,6 +3193,10 @@ static int nested_vmx_check_guest_state(struct kvm_vcpu *vcpu,
> 	     CC((vmcs12->guest_bndcfgs & MSR_IA32_BNDCFGS_RSVD))))
> 		return -EINVAL;
> 
>+	if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS) &&
>+	     CC(vmcs12->guest_ia32_debugctl & ~vmx_get_supported_debugctl(vcpu, false)))
>+		return -EINVAL;
>+

How about grouping this check with the one against DR7 a few lines above?

> 	if (nested_check_guest_non_reg_state(vmcs12))
> 		return -EINVAL;
> 
>diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
>index 9953de0cb32a..9046ee2e9a04 100644
>--- a/arch/x86/kvm/vmx/vmx.c
>+++ b/arch/x86/kvm/vmx/vmx.c
>@@ -2179,7 +2179,7 @@ static u64 nested_vmx_truncate_sysenter_addr(struct kvm_vcpu *vcpu,
> 	return (unsigned long)data;
> }
> 
>-static u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiated)
>+u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiated)
> {
> 	u64 debugctl = 0;
> 
>diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h
>index 6d1e40ecc024..1b80479505d3 100644
>--- a/arch/x86/kvm/vmx/vmx.h
>+++ b/arch/x86/kvm/vmx/vmx.h
>@@ -413,7 +413,9 @@ static inline void vmx_set_intercept_for_msr(struct kvm_vcpu *vcpu, u32 msr,
> 		vmx_disable_intercept_for_msr(vcpu, msr, type);
> }
> 
>+

stray newline.

> void vmx_update_cpu_dirty_logging(struct kvm_vcpu *vcpu);
>+u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiated);
> 
> /*
>  * Note, early Intel manuals have the write-low and read-high bitmap offsets
>-- 
>2.46.0
>
>
Re: [PATCH v4 3/4] x86: nVMX: check vmcs12->guest_ia32_debugctl value given by L2
Posted by mlevitsk@redhat.com 7 months ago 
On Fri, 2025-05-16 at 11:31 +0800, Chao Gao wrote:
> On Wed, May 14, 2025 at 08:53:52PM -0400, Maxim Levitsky wrote:
> > Check the vmcs12 guest_ia32_debugctl value before loading it, to avoid L2
> > being able to load arbitrary values to hardware IA32_DEBUGCTL.
> > 
> > Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
> > ---
> > arch/x86/kvm/vmx/nested.c | 4 ++++
> > arch/x86/kvm/vmx/vmx.c    | 2 +-
> > arch/x86/kvm/vmx/vmx.h    | 2 ++
> > 3 files changed, 7 insertions(+), 1 deletion(-)
> > 
> > diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
> > index e073e3008b16..0bda6400e30a 100644
> > --- a/arch/x86/kvm/vmx/nested.c
> > +++ b/arch/x86/kvm/vmx/nested.c
> > @@ -3193,6 +3193,10 @@ static int nested_vmx_check_guest_state(struct kvm_vcpu *vcpu,
> > 	     CC((vmcs12->guest_bndcfgs & MSR_IA32_BNDCFGS_RSVD))))
> > 		return -EINVAL;
> > 
> > +	if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS) &&
> > +	     CC(vmcs12->guest_ia32_debugctl & ~vmx_get_supported_debugctl(vcpu, false)))
> > +		return -EINVAL;
> > +
> 
> How about grouping this check with the one against DR7 a few lines above?

Good idea, will do.
> 
> > 	if (nested_check_guest_non_reg_state(vmcs12))
> > 		return -EINVAL;
> > 
> > diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
> > index 9953de0cb32a..9046ee2e9a04 100644
> > --- a/arch/x86/kvm/vmx/vmx.c
> > +++ b/arch/x86/kvm/vmx/vmx.c
> > @@ -2179,7 +2179,7 @@ static u64 nested_vmx_truncate_sysenter_addr(struct kvm_vcpu *vcpu,
> > 	return (unsigned long)data;
> > }
> > 
> > -static u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiated)
> > +u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiated)
> > {
> > 	u64 debugctl = 0;
> > 
> > diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h
> > index 6d1e40ecc024..1b80479505d3 100644
> > --- a/arch/x86/kvm/vmx/vmx.h
> > +++ b/arch/x86/kvm/vmx/vmx.h
> > @@ -413,7 +413,9 @@ static inline void vmx_set_intercept_for_msr(struct kvm_vcpu *vcpu, u32 msr,
> > 		vmx_disable_intercept_for_msr(vcpu, msr, type);
> > }
> > 
> > +
> 
> stray newline.
> 
> > void vmx_update_cpu_dirty_logging(struct kvm_vcpu *vcpu);
> > +u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiated);
> > 
> > /*
> >  * Note, early Intel manuals have the write-low and read-high bitmap offsets
> > -- 
> > 2.46.0
> > 
> > 
> 

Best regards,
	Maxim Levitsky
Re: [PATCH v4 3/4] x86: nVMX: check vmcs12->guest_ia32_debugctl value given by L2
Posted by mlevitsk@redhat.com 6 months, 4 weeks ago 
On Fri, 2025-05-16 at 10:50 -0400, mlevitsk@redhat.com wrote:
> On Fri, 2025-05-16 at 11:31 +0800, Chao Gao wrote:
> > On Wed, May 14, 2025 at 08:53:52PM -0400, Maxim Levitsky wrote:
> > > Check the vmcs12 guest_ia32_debugctl value before loading it, to avoid L2
> > > being able to load arbitrary values to hardware IA32_DEBUGCTL.
> > > 
> > > Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
> > > ---
> > > arch/x86/kvm/vmx/nested.c | 4 ++++
> > > arch/x86/kvm/vmx/vmx.c    | 2 +-
> > > arch/x86/kvm/vmx/vmx.h    | 2 ++
> > > 3 files changed, 7 insertions(+), 1 deletion(-)
> > > 
> > > diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
> > > index e073e3008b16..0bda6400e30a 100644
> > > --- a/arch/x86/kvm/vmx/nested.c
> > > +++ b/arch/x86/kvm/vmx/nested.c
> > > @@ -3193,6 +3193,10 @@ static int nested_vmx_check_guest_state(struct kvm_vcpu *vcpu,
> > > 	     CC((vmcs12->guest_bndcfgs & MSR_IA32_BNDCFGS_RSVD))))
> > > 		return -EINVAL;
> > > 
> > > +	if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS) &&
> > > +	     CC(vmcs12->guest_ia32_debugctl & ~vmx_get_supported_debugctl(vcpu, false)))
> > > +		return -EINVAL;
> > > +
> > 
> > How about grouping this check with the one against DR7 a few lines above?
> 
> Good idea, will do.

Besides the above change, is there anything else to change in this patchset?
If not I'll sent a new version soon.

Thanks,
Best regards,
	Maxim Levitsky




> > 
> > > 	if (nested_check_guest_non_reg_state(vmcs12))
> > > 		return -EINVAL;
> > > 
> > > diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
> > > index 9953de0cb32a..9046ee2e9a04 100644
> > > --- a/arch/x86/kvm/vmx/vmx.c
> > > +++ b/arch/x86/kvm/vmx/vmx.c
> > > @@ -2179,7 +2179,7 @@ static u64 nested_vmx_truncate_sysenter_addr(struct kvm_vcpu *vcpu,
> > > 	return (unsigned long)data;
> > > }
> > > 
> > > -static u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiated)
> > > +u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiated)
> > > {
> > > 	u64 debugctl = 0;
> > > 
> > > diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h
> > > index 6d1e40ecc024..1b80479505d3 100644
> > > --- a/arch/x86/kvm/vmx/vmx.h
> > > +++ b/arch/x86/kvm/vmx/vmx.h
> > > @@ -413,7 +413,9 @@ static inline void vmx_set_intercept_for_msr(struct kvm_vcpu *vcpu, u32 msr,
> > > 		vmx_disable_intercept_for_msr(vcpu, msr, type);
> > > }
> > > 
> > > +
> > 
> > stray newline.
> > 
> > > void vmx_update_cpu_dirty_logging(struct kvm_vcpu *vcpu);
> > > +u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiated);
> > > 
> > > /*
> > >  * Note, early Intel manuals have the write-low and read-high bitmap offsets
> > > -- 
> > > 2.46.0
> > > 
> > > 
> > 
> 
> Best regards,
> 	Maxim Levitsky
Re: [PATCH v4 3/4] x86: nVMX: check vmcs12->guest_ia32_debugctl value given by L2
Posted by Chao Gao 6 months, 4 weeks ago 
On Tue, May 20, 2025 at 05:48:44PM -0400, mlevitsk@redhat.com wrote:
>On Fri, 2025-05-16 at 10:50 -0400, mlevitsk@redhat.com wrote:
>> On Fri, 2025-05-16 at 11:31 +0800, Chao Gao wrote:
>> > On Wed, May 14, 2025 at 08:53:52PM -0400, Maxim Levitsky wrote:
>> > > Check the vmcs12 guest_ia32_debugctl value before loading it, to avoid L2
>> > > being able to load arbitrary values to hardware IA32_DEBUGCTL.
>> > > 
>> > > Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
>> > > ---
>> > > arch/x86/kvm/vmx/nested.c | 4 ++++
>> > > arch/x86/kvm/vmx/vmx.c    | 2 +-
>> > > arch/x86/kvm/vmx/vmx.h    | 2 ++
>> > > 3 files changed, 7 insertions(+), 1 deletion(-)
>> > > 
>> > > diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
>> > > index e073e3008b16..0bda6400e30a 100644
>> > > --- a/arch/x86/kvm/vmx/nested.c
>> > > +++ b/arch/x86/kvm/vmx/nested.c
>> > > @@ -3193,6 +3193,10 @@ static int nested_vmx_check_guest_state(struct kvm_vcpu *vcpu,
>> > > 	     CC((vmcs12->guest_bndcfgs & MSR_IA32_BNDCFGS_RSVD))))
>> > > 		return -EINVAL;
>> > > 
>> > > +	if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS) &&
>> > > +	     CC(vmcs12->guest_ia32_debugctl & ~vmx_get_supported_debugctl(vcpu, false)))
>> > > +		return -EINVAL;
>> > > +
>> > 
>> > How about grouping this check with the one against DR7 a few lines above?
>> 
>> Good idea, will do.
>
>Besides the above change, is there anything else to change in this patchset?
>If not I'll sent a new version soon.

...

>> > > diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h
>> > > index 6d1e40ecc024..1b80479505d3 100644
>> > > --- a/arch/x86/kvm/vmx/vmx.h
>> > > +++ b/arch/x86/kvm/vmx/vmx.h
>> > > @@ -413,7 +413,9 @@ static inline void vmx_set_intercept_for_msr(struct kvm_vcpu *vcpu, u32 msr,
>> > > 		vmx_disable_intercept_for_msr(vcpu, msr, type);
>> > > }
>> > > 
>> > > +
>> > 
>> > stray newline.

Can you remove this newline? (not sure if you've already noticed this)

Also, the shortlogs for patches 3-4 don't follow the convention. They should be
"KVM: nVMX" and "KVM: VMX". With these fixed,

Reviewed-by: Chao Gao <chao.gao@intel.com>
Re: [PATCH v4 3/4] x86: nVMX: check vmcs12->guest_ia32_debugctl value given by L2
Posted by mlevitsk@redhat.com 6 months, 4 weeks ago 
On Wed, 2025-05-21 at 08:32 +0800, Chao Gao wrote:
> On Tue, May 20, 2025 at 05:48:44PM -0400, mlevitsk@redhat.com wrote:
> > On Fri, 2025-05-16 at 10:50 -0400, mlevitsk@redhat.com wrote:
> > > On Fri, 2025-05-16 at 11:31 +0800, Chao Gao wrote:
> > > > On Wed, May 14, 2025 at 08:53:52PM -0400, Maxim Levitsky wrote:
> > > > > Check the vmcs12 guest_ia32_debugctl value before loading it, to avoid L2
> > > > > being able to load arbitrary values to hardware IA32_DEBUGCTL.
> > > > > 
> > > > > Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
> > > > > ---
> > > > > arch/x86/kvm/vmx/nested.c | 4 ++++
> > > > > arch/x86/kvm/vmx/vmx.c    | 2 +-
> > > > > arch/x86/kvm/vmx/vmx.h    | 2 ++
> > > > > 3 files changed, 7 insertions(+), 1 deletion(-)
> > > > > 
> > > > > diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
> > > > > index e073e3008b16..0bda6400e30a 100644
> > > > > --- a/arch/x86/kvm/vmx/nested.c
> > > > > +++ b/arch/x86/kvm/vmx/nested.c
> > > > > @@ -3193,6 +3193,10 @@ static int nested_vmx_check_guest_state(struct kvm_vcpu *vcpu,
> > > > > 	     CC((vmcs12->guest_bndcfgs & MSR_IA32_BNDCFGS_RSVD))))
> > > > > 		return -EINVAL;
> > > > > 
> > > > > +	if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS) &&
> > > > > +	     CC(vmcs12->guest_ia32_debugctl & ~vmx_get_supported_debugctl(vcpu, false)))
> > > > > +		return -EINVAL;
> > > > > +
> > > > 
> > > > How about grouping this check with the one against DR7 a few lines above?
> > > 
> > > Good idea, will do.
> > 
> > Besides the above change, is there anything else to change in this patchset?
> > If not I'll sent a new version soon.
> 
> ...
> 
> > > > > diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h
> > > > > index 6d1e40ecc024..1b80479505d3 100644
> > > > > --- a/arch/x86/kvm/vmx/vmx.h
> > > > > +++ b/arch/x86/kvm/vmx/vmx.h
> > > > > @@ -413,7 +413,9 @@ static inline void vmx_set_intercept_for_msr(struct kvm_vcpu *vcpu, u32 msr,
> > > > > 		vmx_disable_intercept_for_msr(vcpu, msr, type);
> > > > > }
> > > > > 
> > > > > +
> > > > 
> > > > stray newline.
> 
> Can you remove this newline? (not sure if you've already noticed this)
Sure thing!

> 
> Also, the shortlogs for patches 3-4 don't follow the convention. They should be
> "KVM: nVMX" and "KVM: VMX". With these fixed,

Sure thing - I wish it was more consistent but you are right. 



> 
> Reviewed-by: Chao Gao <chao.gao@intel.com>
> 

Thank you very much!
Best regards,
	Maxim Levitsky

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.