On Fri, 2025-05-16 at 10:50 -0400, mlevitsk@xxxxxxxxxx wrote:
> On Fri, 2025-05-16 at 11:31 +0800, Chao Gao wrote:
> > On Wed, May 14, 2025 at 08:53:52PM -0400, Maxim Levitsky wrote:
> > > Check the vmcs12 guest_ia32_debugctl value before loading it, to avoid L2
> > > being able to load arbitrary values to hardware IA32_DEBUGCTL.
> > >
> > > Signed-off-by: Maxim Levitsky <mlevitsk@xxxxxxxxxx>
> > > ---
> > > arch/x86/kvm/vmx/nested.c | 4 ++++
> > > arch/x86/kvm/vmx/vmx.c | 2 +-
> > > arch/x86/kvm/vmx/vmx.h | 2 ++
> > > 3 files changed, 7 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
> > > index e073e3008b16..0bda6400e30a 100644
> > > --- a/arch/x86/kvm/vmx/nested.c
> > > +++ b/arch/x86/kvm/vmx/nested.c
> > > @@ -3193,6 +3193,10 @@ static int nested_vmx_check_guest_state(struct kvm_vcpu *vcpu,
> > > CC((vmcs12->guest_bndcfgs & MSR_IA32_BNDCFGS_RSVD))))
> > > return -EINVAL;
> > >
> > > + if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS) &&
> > > + CC(vmcs12->guest_ia32_debugctl & ~vmx_get_supported_debugctl(vcpu, false)))
> > > + return -EINVAL;
> > > +
> >
> > How about grouping this check with the one against DR7 a few lines above?
>
> Good idea, will do.
Besides the above change, is there anything else to change in this patchset?
If not I'll sent a new version soon.
Thanks,
Best regards,
Maxim Levitsky
> >
> > > if (nested_check_guest_non_reg_state(vmcs12))
> > > return -EINVAL;
> > >
> > > diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
> > > index 9953de0cb32a..9046ee2e9a04 100644
> > > --- a/arch/x86/kvm/vmx/vmx.c
> > > +++ b/arch/x86/kvm/vmx/vmx.c
> > > @@ -2179,7 +2179,7 @@ static u64 nested_vmx_truncate_sysenter_addr(struct kvm_vcpu *vcpu,
> > > return (unsigned long)data;
> > > }
> > >
> > > -static u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiated)
> > > +u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiated)
> > > {
> > > u64 debugctl = 0;
> > >
> > > diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h
> > > index 6d1e40ecc024..1b80479505d3 100644
> > > --- a/arch/x86/kvm/vmx/vmx.h
> > > +++ b/arch/x86/kvm/vmx/vmx.h
> > > @@ -413,7 +413,9 @@ static inline void vmx_set_intercept_for_msr(struct kvm_vcpu *vcpu, u32 msr,
> > > vmx_disable_intercept_for_msr(vcpu, msr, type);
> > > }
> > >
> > > +
> >
> > stray newline.
> >
> > > void vmx_update_cpu_dirty_logging(struct kvm_vcpu *vcpu);
> > > +u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiated);
> > >
> > > /*
> > > * Note, early Intel manuals have the write-low and read-high bitmap offsets
> > > --
> > > 2.46.0
> > >
> > >
> >
>
> Best regards,
> Maxim Levitsky
