From nobody Fri Dec 19 12:28:39 2025 Received: from out-189.mta0.migadu.com (out-189.mta0.migadu.com [91.218.175.189]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 796DF3002DF for ; Tue, 4 Nov 2025 20:00:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.189 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762286425; cv=none; b=AAUxiUezAjVjKGMxjECtucK2nfMWB3Ry2Dy5GWVrMsDWTr0undGTJxTxbMpXKcaFiEMrh73HExr6tZsXsAS9TlT/MPDTo7GL7/W6kUamd1+VIBiQtewW+Li0VOAu46DanJWzgdtKKwK4JOX/eIDdEvLDdJl/5iT0KHeS2+egU8g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762286425; c=relaxed/simple; bh=1iz/wfIOnrGoI4T/LYuSh2kNTKOiBkvYwHQ63PG6rW0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=PaFaZvwN1Y1Fprz7JsbTIhxGU8kiGtHxhmOf8daGEWYni6WiXC8s4LqmJmkv7DkMKVVyOHJ3r5tyxzKDm5i9/eZQn056PRYhdGYQKriYYVcY5CpptZ/SYs61HVfv+QgA2VKcHcyRPFvomtAe//TYHJZhES5+acQ5vBxjqSUZCPo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=W8XREZvu; arc=none smtp.client-ip=91.218.175.189 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="W8XREZvu" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1762286419; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Ud0O6WO/i+2mt2AsVx42pR3Yn1Qyh4ZT9ZTHkz5AX3s=; b=W8XREZvuW2ylSWm0YzPH7r7JiU9+UtMEWNOrH/5vFfIH2lOJ4Af/IsbvzPqqMVRuZsBwG0 DQZ2e5netaZGYUyVJHxsJXZbfQDy+pQFHT0q38Wk9tK6PJpuNyFIG3c1jQddf+VZphuGsr kUMJdePwDnlguJfwwJ2xNqee8sTvBm8= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , Jim Mattson , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed Subject: [PATCH 08/11] KVM: nSVM: Restrict mapping VMCB12 on nested VMRUN Date: Tue, 4 Nov 2025 19:59:46 +0000 Message-ID: <20251104195949.3528411-9-yosry.ahmed@linux.dev> In-Reply-To: <20251104195949.3528411-1-yosry.ahmed@linux.dev> References: <20251104195949.3528411-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" All accesses to the VMCB12 in the guest memory are limited to nested_svm_vmrun(). However, the VMCB12 remains mapped until the end of the function execution. Unmapping right after the consistency checks is possible, but it becomes easy-ish to introduce bugs where 'vmcb12' is used after being unmapped. Move all accesses to the VMCB12 into a new helper, nested_svm_vmrun_read_vmcb12(), that maps the VMCB12, caches the needed fields, performs consistency checks, and unmaps it. This limits the scope of the VMCB12 mapping appropriately. It also slightly simplifies the cleanup path of nested_svm_vmrun(). nested_svm_vmrun_read_vmcb12() returns -1 if the consistency checks fail, maintaining the current behavior of skipping the instructions and unmapping the VMCB12 (although in the opposite order). Signed-off-by: Yosry Ahmed --- arch/x86/kvm/svm/nested.c | 59 ++++++++++++++++++++++----------------- 1 file changed, 34 insertions(+), 25 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 901f6dc12b09f..8d5165df52f57 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -1012,12 +1012,39 @@ int enter_svm_guest_mode(struct kvm_vcpu *vcpu, u64= vmcb12_gpa, bool from_vmrun) return 0; } =20 +static int nested_svm_vmrun_read_vmcb12(struct kvm_vcpu *vcpu, u64 vmcb12_= gpa) +{ + struct vcpu_svm *svm =3D to_svm(vcpu); + struct kvm_host_map map; + struct vmcb *vmcb12; + int ret; + + ret =3D kvm_vcpu_map(vcpu, gpa_to_gfn(vmcb12_gpa), &map); + if (ret) + return ret; + + vmcb12 =3D map.hva; + + nested_copy_vmcb_control_to_cache(svm, &vmcb12->control); + nested_copy_vmcb_save_to_cache(svm, &vmcb12->save); + + if (!nested_vmcb_check_save(vcpu) || + !nested_vmcb_check_controls(vcpu)) { + vmcb12->control.exit_code =3D SVM_EXIT_ERR; + vmcb12->control.exit_code_hi =3D 0; + vmcb12->control.exit_info_1 =3D 0; + vmcb12->control.exit_info_2 =3D 0; + ret =3D -1; + } + + kvm_vcpu_unmap(vcpu, &map); + return ret; +} + int nested_svm_vmrun(struct kvm_vcpu *vcpu) { struct vcpu_svm *svm =3D to_svm(vcpu); int ret; - struct vmcb *vmcb12; - struct kvm_host_map map; u64 vmcb12_gpa; struct vmcb *vmcb01 =3D svm->vmcb01.ptr; =20 @@ -1038,8 +1065,11 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu) return ret; } =20 + if (WARN_ON_ONCE(!svm->nested.initialized)) + return -EINVAL; + vmcb12_gpa =3D svm->vmcb->save.rax; - ret =3D kvm_vcpu_map(vcpu, gpa_to_gfn(vmcb12_gpa), &map); + ret =3D nested_svm_vmrun_read_vmcb12(vcpu, vmcb12_gpa); if (ret =3D=3D -EINVAL) { kvm_inject_gp(vcpu, 0); return 1; @@ -1049,23 +1079,6 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu) =20 ret =3D kvm_skip_emulated_instruction(vcpu); =20 - vmcb12 =3D map.hva; - - if (WARN_ON_ONCE(!svm->nested.initialized)) - return -EINVAL; - - nested_copy_vmcb_control_to_cache(svm, &vmcb12->control); - nested_copy_vmcb_save_to_cache(svm, &vmcb12->save); - - if (!nested_vmcb_check_save(vcpu) || - !nested_vmcb_check_controls(vcpu)) { - vmcb12->control.exit_code =3D SVM_EXIT_ERR; - vmcb12->control.exit_code_hi =3D 0; - vmcb12->control.exit_info_1 =3D 0; - vmcb12->control.exit_info_2 =3D 0; - goto out; - } - /* * Since vmcb01 is not in use, we can use it to store some of the L1 * state. @@ -1085,7 +1098,7 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu) goto out_exit_err; =20 if (nested_svm_merge_msrpm(vcpu)) - goto out; + return ret; =20 out_exit_err: svm->nested.nested_run_pending =3D 0; @@ -1098,10 +1111,6 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu) svm->vmcb->control.exit_info_2 =3D 0; =20 nested_svm_vmexit(svm); - -out: - kvm_vcpu_unmap(vcpu, &map); - return ret; } =20 --=20 2.51.2.1026.g39e6a42477-goog