From nobody Fri Sep 25 20:46:58 2026 Received: from mail-pj1-f42.google.com (mail-pj1-f42.google.com [209.85.216.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D77E257F726 for ; Tue, 8 Sep 2026 16:04:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.42 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788883501; cv=none; b=e3TBBmQdshK/vhG26ryQfTeq7Vo9yAzX3z3Vdia2HGK4CZLUBheQp6f0MHDpTm6wp4gLGiB7Q85LGQ6BDIp07XBGssW6lpLPw2Pgg7SltA5BqPoqQHsECE9pmdpXe8CLodsdMoHBOGIY0NlED80TKIKe7B+z7DiEw9x2k8FYg34= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788883501; c=relaxed/simple; bh=PoIZefIYgemK9yZJ4YbXFzvrGW+3EnfGu14JP84JhVo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=lE1yYJmqR14/WT3SXhvoMHzlimfm0v/+2fzfbw2BLnm+GGLQm1ELKwKAfXZ2RF8ZWrNTJxnN2Z90R5dOCtfrFbEfodnMa4HuHdZnC4Vws7G9dURsdwI3rwR3vhnEHdcaZYM//AznQpwISfu57cnot8hoL+XUAfOQiE0a/GsWO74= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=HQh8aQiS; arc=none smtp.client-ip=209.85.216.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="HQh8aQiS" Received: by mail-pj1-f42.google.com with SMTP id 98e67ed59e1d1-39b2ad862bdso5201914a91.2 for ; Tue, 08 Sep 2026 09:04:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788883498; x=1789488298; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=udEwa8n9rLXAHa2zU6AruMqakZJAsEvaZhfj1mlF4oU=; b=HQh8aQiS275IMskl2futVye8miZjnPRPVcRHRjpN4m5eJFvEwFl26e3iBdFbtw7MMf 89fGFLmhqKrmoWEfTHIEBokyCNC6ZYFWPOUZ7i0y0ilBtHQxHE/jtsAdKMO2uCMBudrt 0wOmWbYugf8iIoTg9tsVq0+UIX32zop3iRkM27MZ31xVpqwRyNoXmfR8y53SuQbdkO69 vqrbFq9M6rEKiRPS+stKofqdU9sftr5kAs37PDINL7z93bs4gyI/BRtVGa2kUuefJ2ur 13lEFjI6+nY1VCIig76dg/wMiymXN9RJyUxcS3+WVr5OvYGmTcNjnZAcVJFW+j4ISVDh QMbQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788883498; x=1789488298; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=udEwa8n9rLXAHa2zU6AruMqakZJAsEvaZhfj1mlF4oU=; b=WHlqQfaV15HHz8YyLS5Wktpp79XgrPcuR6vOW/pBu2LPSjWN6MTDmDAyFxtWj6OgUD 0dgKw3OuABs0yEvpoIZqDg2w0nCS1N9YRvZQAtd0LjBxdm/SSbspQlQNOcYwT3izyvKm oyE8NBIU+9yBZOnzzh8FO97Kv4kqjjEJF6SXPl/odJoFhJwTsdqbF8wUjZR/UFRX8xA7 9G6c8ParO+HS0CfvjzUMShRTQ5rguST9KT5kwqPFdJhZyYEOXiKif78hZ4cP4QRXej8q 5ycvptDUAnw+DXVQXvS5n+SWDfGGykbzBNkgVDKDn7gjXS7SkNFm3A7FO6yjuyI/WtnL X5uw== X-Forwarded-Encrypted: i=1; AKwUvBwTRzVCWlWweZgk5h5/Aaez3n26TCavAGeuRcof/7dqv+wvSTsM3PM3k2Ph93zkEKtZ84NGkhA5FTLDnyw=@vger.kernel.org X-Gm-Message-State: AFuF++lpP4s7ZGuCYVs9gubbkkDWWcdFjAo1fJP2mC30VSa4g+HoOYkO gm+xub0ZSSsw23/f7Gq3uRan16nrhNwepGz307s2hFXLJf0SP/qP/onA X-Gm-Gg: AYBFou1YW8i72QHxeLNSsakZRae0iskNiBeDkdMDWIwhAXgjsH2ZdGCSVNGIaBSqIMx COCbO1T2bjVG3OxEElqyCa4jEnjL+AAAyMHmeydrZL/qptjlOrDh9FoB9qX7TswAuj6M3BO+PbQ vVuUWoIEO8ncY5k8RMJdCvNz3/1fXZQ+X8NrgWo/uHTCjUmDp/yV/PpDqe/VNsH88v9gAkD+h91 wWB74BN7IT8kNi10mzRTK4xEUoPQ6NcYldZWYNiBbuTDsvwhOi8soYudBMznKbwq1e7oO7pswPd 9IU7VF4feKm+ACpuacpfKGE1pgfbKDygQ7PaWxL6jhAX4g/iIeividgVSNiigqIoucpO0/N3Zyn TJHjFxSsfrPdJE2eTEqTmGhdnpznJgP2NF7BOFAIpZwYAwtmnaxRp4Ogte4jQGpPIGdG5CQb2+t MnUniVt4C101scZJ3/BZ53M0XOt1IXqNvdbHWOo5popWrzCCA5QDZD9T+tPyHXVuzeh1AlTSrxr 0GZ9qlvJy5J X-Received: by 2002:a17:90a:ec8d:b0:38e:67e1:15b with SMTP id 98e67ed59e1d1-39b261002f5mr41870407a91.6.1788883497638; Tue, 08 Sep 2026 09:04:57 -0700 (PDT) Received: from x1c ([2405:9800:b670:b64b:3ef4:ec38:7826:6c9b]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-33825669695sm14204525eec.3.2026.09.08.09.04.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 08 Sep 2026 09:04:57 -0700 (PDT) From: Tharit Tangkijwanichakul To: seanjc@google.com, pbonzini@redhat.com, tglx@kernel.org, mingo@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, x86@kernel.org, shuah@kernel.org Cc: hpa@zytor.com, binbin.wu@linux.intel.com, kai.huang@intel.com, kvm@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-kernel-mentees@lists.linux.dev, skhan@linuxfoundation.org, me@brighamcampbell.com, jkoolstra@xs4all.nl, Tharit Tangkijwanichakul Subject: [PATCH v1 1/2] KVM: x86: Reject reserved CR8 bits in KVM_SET_SREGS Date: Tue, 8 Sep 2026 23:04:25 +0700 Message-ID: <20260908160426.6547-2-tharitt97@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260908160426.6547-1-tharitt97@gmail.com> References: <20260908160426.6547-1-tharitt97@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" kvm_is_valid_sregs() validates the incoming CR0, CR4, and efer values but never checks CR8. When userspace passes a CR8 value with any of the reserved bits [63:4] set, __set_sregs_common() forwards it to kvm_set_cr8(), which rejects the reserved bits and returns early. That return value is not checked, so the ioctl reports success while the requested value is silently dropped. A subsequent KVM_GET_SREGS then returns a CR8 different from the one userspace believed it had written. Factor the reserved-bit check out into kvm_is_valid_cr8() and use it both in kvm_set_cr8() and in kvm_is_valid_sregs(). Fixes: 2f5bb3fe5835 ("KVM: x86: Move the bulk of register specific code fro= m x86.c to regs.c") Signed-off-by: Tharit Tangkijwanichakul --- arch/x86/kvm/regs.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/regs.c b/arch/x86/kvm/regs.c index 8f66438989e4..fad31b59c622 100644 --- a/arch/x86/kvm/regs.c +++ b/arch/x86/kvm/regs.c @@ -440,9 +440,14 @@ int kvm_set_cr4(struct kvm_vcpu *vcpu, unsigned long c= r4) } EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_set_cr4); =20 +static bool kvm_is_valid_cr8(unsigned long cr8) +{ + return !(cr8 & CR8_RESERVED_BITS); +} + int kvm_set_cr8(struct kvm_vcpu *vcpu, unsigned long cr8) { - if (cr8 & CR8_RESERVED_BITS) + if (!kvm_is_valid_cr8(cr8)) return 1; if (lapic_in_kernel(vcpu)) kvm_lapic_set_tpr(vcpu, cr8); @@ -565,6 +570,7 @@ static bool kvm_is_valid_sregs(struct kvm_vcpu *vcpu, s= truct kvm_sregs *sregs) =20 return kvm_is_valid_cr4(vcpu, sregs->cr4) && kvm_is_valid_cr0(vcpu, sregs->cr0) && + kvm_is_valid_cr8(sregs->cr8) && kvm_valid_efer(vcpu, sregs->efer); } =20 --=20 2.53.0 From nobody Fri Sep 25 20:46:58 2026 Received: from mail-pz2-f12.google.com (mail-pz2-f12.google.com [74.125.228.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3494658039E for ; Tue, 8 Sep 2026 16:05:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.228.12 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788883509; cv=none; b=mYb8lQDc24nIvwlqU0iTlCUDrAuTIBZfKoJexz+AmG7eJd26fZPfH+grcDaq8IsP0FRl3pKghY1oLPp7PqFtRYJPQaaFZYPVlbTta0EqDAFHgIDKV9/v2b9c+L8AnYQqIJUioRQTLMIs/JwNUWujFj3Tlm1juLovlJ7oRLsz/0k= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788883509; c=relaxed/simple; bh=sK1b5nDQtrjVKFr+o/6GwxhEgYwKp92RT5diVPkBA+U=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=FTo5Eo5Z/HiC3XTKgNTE1uPvREpEsSYgKqCOcuDP4BNdD2mZqrNL0oPJZrW8ykZNny5LH1z/mUP5R5uJf3inTVKCeJW6k9fPzY3q/BOSNH30dCNRjphIrB0l4nbAS55tWuNI7miCdVWKeyEuHFZMSUewxPNjLbKvzKNvQU90ivk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ZfKObwWj; arc=none smtp.client-ip=74.125.228.12 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ZfKObwWj" Received: by mail-pz2-f12.google.com with SMTP id d2e1a72fcca58-85469b2e1d5so89089b3a.1 for ; Tue, 08 Sep 2026 09:05:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788883507; x=1789488307; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=SSdpcNES+qMXGVTc/+WrAnmCz5JB/CaNe97EdcfztrE=; b=ZfKObwWjNK7L05K1IvN9ICzOvstr1NZlsrbwloYMwlijiL/KhwcaIn8KXaD08mxM5M p4BocJTIUF+LtbE4jvCDeA0pLStRxVf9nAKzYbKg7LRzeSylufcSUXRi5AjrLu2YgV1B iZV9DoDUI1Qu/DJHf4nyG5SPoqMzFi7gO4mdr3jF+DcNEMLUhjFG7qRvxztAngXy0AKj uDI7YDXbVVb3UwFZHwKdCaOAAXGLKqYcZS70YG8twwIk/HaZU9gJMoiutRp8E7e1kyMa eh+M+sIpHd0CAhbXoJrzcWdLZkY6HiNB2syr77wTymo05XcGSb75S6JotjPKhhZCRR5H 0Zaw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788883507; x=1789488307; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=SSdpcNES+qMXGVTc/+WrAnmCz5JB/CaNe97EdcfztrE=; b=qMD0MhHavQFM3KQYMyXlZZ/lM7j+4fxC5CsuFcWjSGydcDtEEfCM7u11Mzcrak3mnU fnDjXWZ5yxXRBoDgA+afbQDFCp7HA33rqvAvbHL8fFQ/5Od9XfJYkfuWZtXpxuLI0kJX QF6MZjY+MovB5NngbMZ/ZPLG4+hu6KpbcOSFJs0Ul3hB4oScH+mFvsMsBqnfjbM/rumF NEJWwa/Rah059G2JZ7RYKZC5qU2tFuFhFODyhmsMVHgKYawncuGXKvC7LpJJb3yiP4ZV +QdGfBY7s9dy8zKnMjMTp4wRo+gG6O9JmXHH3Y6dE4QRuDzRD+ZM2ioac6KPpwojdH8N JZxQ== X-Forwarded-Encrypted: i=1; AKwUvByNVTh07+Ijp7k1lqu50GKFCuf7/xLpV9wx+yRI7aFIurUWW5T8wohOQxRt1bSNDKFLfOB/ztCKaY6Sq0Q=@vger.kernel.org X-Gm-Message-State: AFuF++l9r/LA7uN4U8qaJsiJyx+Y6qkKmDdvKPB3E2Lowkx9x0ZAzsZD hcic+F1Sh9Gvd0M3FcteDhFkaG/QGVQNBywHhjPXBIhhjp87ChNro/Mb X-Gm-Gg: AYBFou07QTME1Cml9/A8z6NcVs7QW/8oQ7VCT5olMFRTSMfN7n/x7j1dAhqJlefR1oe ljDhZMl9ogBlVM1FhcWePWS28519rVCBNLOIlUsBmlAU0nzqo1bYbRGOIRYsdWhjUC7jPYrSUs3 wDLCllNF65cNJK+fM8SRdU3UWntNcsq6YPfy0uT70wwzQB3Y3ecaZ6xtwXLVjIkgj3ezES4Rgmj 7lwd0c0Dxl7UP8e+S9+9kMsC0pO0T9Su845+lh2kynLeLsfRS+dnqxZSFxKbWMBuiQbxwfCgilD UhLGSTAZbaKTiudwaEqvl9gY8f97MhEu2+nnT0LD8Jokq8JMv6dQauudjPOmAmhMGalyfwNF7+V tx1RcFiwDnVgAvnGmHz8n08ZaAYxemRiRKdMoUGv9WyBPmZa1zEsu8Kk7TIstkEqIrOpIaDYjdf BsGeG6meJi6BzrbP9dNI+udr6AsbdGJEVnlg5tS0Bf607l3z3nCUN0DX6UPuesB2fG/Att384nr RCFs0bMTXxP X-Received: by 2002:a05:6a20:2d22:b0:3d0:f57d:c87a with SMTP id adf61e73a8af0-3dabab860f3mr994786637.0.1788883506463; Tue, 08 Sep 2026 09:05:06 -0700 (PDT) Received: from x1c ([2405:9800:b670:b64b:3ef4:ec38:7826:6c9b]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-33825669695sm14204525eec.3.2026.09.08.09.05.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 08 Sep 2026 09:05:06 -0700 (PDT) From: Tharit Tangkijwanichakul To: seanjc@google.com, pbonzini@redhat.com, tglx@kernel.org, mingo@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, x86@kernel.org, shuah@kernel.org Cc: hpa@zytor.com, binbin.wu@linux.intel.com, kai.huang@intel.com, kvm@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-kernel-mentees@lists.linux.dev, skhan@linuxfoundation.org, me@brighamcampbell.com, jkoolstra@xs4all.nl, Tharit Tangkijwanichakul Subject: [PATCH v1 2/2] KVM: selftests: Add CR8 reserved-bit checks to set_sregs_test Date: Tue, 8 Sep 2026 23:04:26 +0700 Message-ID: <20260908160426.6547-3-tharitt97@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260908160426.6547-1-tharitt97@gmail.com> References: <20260908160426.6547-1-tharitt97@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Extend set_sregs_test to cover CR8. Verify that the architecturally allowed bits [3:0] can be set and read back, that every reserved bit [63:4] is rejected by KVM_SET_SREGS, and that a successful set is observable via KVM_GET_SREGS. Without the accompanying fix to kvm_is_valid_sregs(), setting a reserved CR8 bit is silently accepted and the read-back value diverges from the value written, so this test fails on an unpatched kernel and passes once the fix is applied. Signed-off-by: Tharit Tangkijwanichakul --- tools/testing/selftests/kvm/x86/set_sregs_test.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/tools/testing/selftests/kvm/x86/set_sregs_test.c b/tools/testi= ng/selftests/kvm/x86/set_sregs_test.c index 603226ffe437..4e7c35179438 100644 --- a/tools/testing/selftests/kvm/x86/set_sregs_test.c +++ b/tools/testing/selftests/kvm/x86/set_sregs_test.c @@ -135,6 +135,18 @@ static void test_cr_bits(struct kvm_vcpu *vcpu, u64 cr= 4) /* NW without CD is illegal, as is PG without PE. */ TEST_INVALID_SREG_BIT(vcpu, cr0, sregs, X86_CR0_NW); TEST_INVALID_SREG_BIT(vcpu, cr0, sregs, X86_CR0_PG); + + /* CR8 bits 3:0 are writable; bits 63:4 are reserved. */ + vcpu_sregs_get(vcpu, &sregs); + sregs.cr8 =3D 0xf; + rc =3D _vcpu_sregs_set(vcpu, &sregs); + TEST_ASSERT(!rc, "Failed to set valid CR8 value 0xf"); + + vcpu_sregs_get(vcpu, &sregs); + TEST_ASSERT_EQ(sregs.cr8, 0xf); + + for (i =3D 4; i < 64; i++) + TEST_INVALID_SREG_BIT(vcpu, cr8, sregs, BIT_ULL(i)); } =20 static void test_efer_bits(struct kvm_vcpu *vcpu, u64 efer) --=20 2.53.0