[v2] KVM: nSVM: Disallow bad L1 EFER for KVM_SET_NESTED_STATE

[PATCH v2 0/5] KVM: nSVM: Disallow bad L1 EFER for KVM_SET_NESTED_STATE

Posted by Sean Christopherson 3 weeks, 2 days ago

Fix a bug where KVM allows userspace to set an impossible EFER for L1 via
KVM_SET_NESTED_STATE, which ultimately can lead to KVM misconfiguring L2's
MMU (yay, NPT!) and overflowing the guest_walker arrays.  Then, harden the
MMU against similar bugs (hopefully it works this time; nVMX also had a
similar bug, but the "NPT uses L1's EFER/CR4" wrinkle rendered the existing
hardening useless).

v2:
 - Check walker->max_level, not w->cpu_role.base.level, to play nice with PAE
   paging on 32-bit hosts. [Sashiko]
 - Force EFER.LMA=0 in nested_vmcb02_prepare_save() if EFER.LME=0 to avoid
   confusing MMU code.

v1: https://lore.kernel.org/all/20260826211844.884951-2-seanjc@google.com

Sean Christopherson (5):
  KVM: nSVM: Reject KVM_SET_NESTED_STATE if L1 has EFER.LMA=1 &&
    EFER.LME=0
  KVM: nSVM: Ignore EFER.LMA if EFER.LME=0 when preparing L2 state
  KVM: x86/mmu: Bug the VM if KVM attempts to walk more levels than the
    MMU has
  KVM: x86/mmu: Bug the VM if KVM calcs a CPU role with EFER.LMA=1 &&
    CR4.PAE=0
  KVM: x86/mmu: Convert MMU walker's bounds check from BUG_ON() to
    KVM_BUG_ON()

 arch/x86/kvm/mmu/mmu.c         |  3 +++
 arch/x86/kvm/mmu/paging_tmpl.h | 17 ++++++++++-------
 arch/x86/kvm/svm/nested.c      |  5 +++++
 3 files changed, 18 insertions(+), 7 deletions(-)


base-commit: 76671054f9a1ff6abb976583cd8da37650acdc97
-- 
2.55.0.970.g62bdec98f9-goog

Re: [PATCH v2 0/5] KVM: nSVM: Disallow bad L1 EFER for KVM_SET_NESTED_STATE

Posted by Sean Christopherson 4 days, 18 hours ago

On Wed, 02 Sep 2026 16:20:23 -0700, Sean Christopherson wrote:
> Fix a bug where KVM allows userspace to set an impossible EFER for L1 via
> KVM_SET_NESTED_STATE, which ultimately can lead to KVM misconfiguring L2's
> MMU (yay, NPT!) and overflowing the guest_walker arrays.  Then, harden the
> MMU against similar bugs (hopefully it works this time; nVMX also had a
> similar bug, but the "NPT uses L1's EFER/CR4" wrinkle rendered the existing
> hardening useless).
> 
> [...]

Applied to kvm-x86 misc, thanks!

[1/5] KVM: nSVM: Reject KVM_SET_NESTED_STATE if L1 has EFER.LMA=1 && EFER.LME=0
      https://github.com/kvm-x86/linux/commit/5dc500a354cc
[2/5] KVM: nSVM: Ignore EFER.LMA if EFER.LME=0 when preparing L2 state
      https://github.com/kvm-x86/linux/commit/1c4c84a643b7
[3/5] KVM: x86/mmu: Bug the VM if KVM attempts to walk more levels than the MMU has
      https://github.com/kvm-x86/linux/commit/115f9405a2ed
[4/5] KVM: x86/mmu: Bug the VM if KVM calcs a CPU role with EFER.LMA=1 && CR4.PAE=0
      https://github.com/kvm-x86/linux/commit/34dacbe7ae93
[5/5] KVM: x86/mmu: Convert MMU walker's bounds check from BUG_ON() to KVM_BUG_ON()
      https://github.com/kvm-x86/linux/commit/47b437b2d903

--
https://github.com/kvm-x86/linux/tree/next