A group of semi-related fixes, cleanups, and hardening patches for nSVM.
The series is essentially a group of related mini-series stitched
together for syntactic and semantic dependencies. The first 22 patches
(except patch 3) are all optimistically CC'd to stable as they are fixes
or refactoring leading up to bug fixes. Although I am not sure how much
of that will actually apply to stable trees.
Patches 1-3 here are v2 of the last 3 patches in the LBRV fixes series
[1]. The first 3 patches of [1] are already upstream.
Patches 4-17 are fixes for failure handling in the nested VMRUN and
#VMEXIT code paths, ending with a nice unified code path for handling
VMRUN failures as suggested by Sean. Within this block, patches 7-12 are
refactoring needed for patches 13-14.
Patches 18-22 are fixes for missing or made-up consistency checks.
Patches 23-24 are renames and cleanups.
Patches 25-30 add hardening to reading the VMCB12, caching all used
fields in the save area to prevent theoritical TOC-TOU bugs, sanitizing
used fields in the control area, and restricting accesses to the VMCB12
through guest memory.
Finally, patch 31 is a selftest for nested VMRUN and #VMEXIT failures
due to failing to map vmcb12.
v5 -> v6:
- Set VMCB_LBR dirty when setting LBR registers [Yosry].
- Fix state leakage in LBR save/restore test [Kevin Cheng].
- Do not abort nested #VMEXIT flow if mapping vmcb12 or restoring L1 CR3
fails [Sean].
- Break down the patch sanitizing control fields from vmcb12 and drop
the ASID comment change [Sean].
- Add a selftest for VMRUN and #VMEXIT with unmappable vmcb12 [Yosry].
v5: https://lore.kernel.org/kvm/20260206190851.860662-1-yosry.ahmed@linux.dev/
Yosry Ahmed (31):
KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12
KVM: SVM: Switch svm_copy_lbrs() to a macro
KVM: SVM: Add missing save/restore handling of LBR MSRs
KVM: selftests: Add a test for LBR save/restore (ft. nested)
KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN
KVM: nSVM: Refactor checking LBRV enablement in vmcb12 into a helper
KVM: nSVM: Refactor writing vmcb12 on nested #VMEXIT as a helper
KVM: nSVM: Triple fault if mapping VMCB12 fails on nested #VMEXIT
KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT
KVM: nSVM: Drop nested_vmcb_check_{save/control}() wrappers
KVM: nSVM: Call enter_guest_mode() before switching to VMCB02
KVM: nSVM: Make nested_svm_merge_msrpm() return an errno
KVM: nSVM: Call nested_svm_merge_msrpm() from enter_svm_guest_mode()
KVM: nSVM: Call nested_svm_init_mmu_context() before switching to
VMCB02
KVM: nSVM: Refactor minimal #VMEXIT handling out of
nested_svm_vmexit()
KVM: nSVM: Unify handling of VMRUN failures with proper cleanup
KVM: nSVM: Clear EVENTINJ field in VMCB12 on nested #VMEXIT
KVM: nSVM: Drop the non-architectural consistency check for NP_ENABLE
KVM: nSVM: Add missing consistency check for nCR3 validity
KVM: nSVM: Add missing consistency check for hCR0.PG and NP_ENABLE
KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS
KVM: nSVM: Add missing consistency check for EVENTINJ
KVM: SVM: Rename vmcb->nested_ctl to vmcb->misc_ctl
KVM: SVM: Rename vmcb->virt_ext to vmcb->misc_ctl2
KVM: nSVM: Cache all used fields from VMCB12
KVM: nSVM: Restrict mapping VMCB12 on nested VMRUN
KVM: nSVM: Use PAGE_MASK to drop lower bits of bitmap GPAs from vmcb12
KVM: nSVM: Sanitize TLB_CONTROL field when copying from vmcb12
KVM: nSVM: Sanitize INT/EVENTINJ fields when copying from vmcb12
KVM: nSVM: Only copy SVM_MISC_ENABLE_NP from VMCB01's misc_ctl
KVM: selftest: Add a selftest for VMRUN/#VMEXIT with unmappable vmcb12
arch/x86/include/asm/svm.h | 20 +-
arch/x86/kvm/svm/nested.c | 570 +++++++++++-------
arch/x86/kvm/svm/sev.c | 4 +-
arch/x86/kvm/svm/svm.c | 68 ++-
arch/x86/kvm/svm/svm.h | 50 +-
arch/x86/kvm/x86.c | 3 +
tools/testing/selftests/kvm/Makefile.kvm | 2 +
.../selftests/kvm/include/x86/processor.h | 5 +
tools/testing/selftests/kvm/include/x86/svm.h | 14 +-
tools/testing/selftests/kvm/lib/x86/svm.c | 2 +-
.../kvm/x86/nested_vmsave_vmload_test.c | 16 +-
.../selftests/kvm/x86/svm_lbr_nested_state.c | 145 +++++
.../kvm/x86/svm_nested_invalid_vmcb12_gpa.c | 95 +++
13 files changed, 711 insertions(+), 283 deletions(-)
create mode 100644 tools/testing/selftests/kvm/x86/svm_lbr_nested_state.c
create mode 100644 tools/testing/selftests/kvm/x86/svm_nested_invalid_vmcb12_gpa.c
base-commit: 183bb0ce8c77b0fd1fb25874112bc8751a461e49
--
2.53.0.414.gf7e9f6c205-goog