On Wed, 2025-05-21 at 08:32 +0800, Chao Gao wrote: > On Tue, May 20, 2025 at 05:48:44PM -0400, mlevitsk@xxxxxxxxxx wrote: > > On Fri, 2025-05-16 at 10:50 -0400, mlevitsk@xxxxxxxxxx wrote: > > > On Fri, 2025-05-16 at 11:31 +0800, Chao Gao wrote: > > > > On Wed, May 14, 2025 at 08:53:52PM -0400, Maxim Levitsky wrote: > > > > > Check the vmcs12 guest_ia32_debugctl value before loading it, to avoid L2 > > > > > being able to load arbitrary values to hardware IA32_DEBUGCTL. > > > > > > > > > > Signed-off-by: Maxim Levitsky <mlevitsk@xxxxxxxxxx> > > > > > --- > > > > > arch/x86/kvm/vmx/nested.c | 4 ++++ > > > > > arch/x86/kvm/vmx/vmx.c | 2 +- > > > > > arch/x86/kvm/vmx/vmx.h | 2 ++ > > > > > 3 files changed, 7 insertions(+), 1 deletion(-) > > > > > > > > > > diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c > > > > > index e073e3008b16..0bda6400e30a 100644 > > > > > --- a/arch/x86/kvm/vmx/nested.c > > > > > +++ b/arch/x86/kvm/vmx/nested.c > > > > > @@ -3193,6 +3193,10 @@ static int nested_vmx_check_guest_state(struct kvm_vcpu *vcpu, > > > > > CC((vmcs12->guest_bndcfgs & MSR_IA32_BNDCFGS_RSVD)))) > > > > > return -EINVAL; > > > > > > > > > > + if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS) && > > > > > + CC(vmcs12->guest_ia32_debugctl & ~vmx_get_supported_debugctl(vcpu, false))) > > > > > + return -EINVAL; > > > > > + > > > > > > > > How about grouping this check with the one against DR7 a few lines above? > > > > > > Good idea, will do. > > > > Besides the above change, is there anything else to change in this patchset? > > If not I'll sent a new version soon. > > ... > > > > > > diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h > > > > > index 6d1e40ecc024..1b80479505d3 100644 > > > > > --- a/arch/x86/kvm/vmx/vmx.h > > > > > +++ b/arch/x86/kvm/vmx/vmx.h > > > > > @@ -413,7 +413,9 @@ static inline void vmx_set_intercept_for_msr(struct kvm_vcpu *vcpu, u32 msr, > > > > > vmx_disable_intercept_for_msr(vcpu, msr, type); > > > > > } > > > > > > > > > > + > > > > > > > > stray newline. > > Can you remove this newline? (not sure if you've already noticed this) Sure thing! > > Also, the shortlogs for patches 3-4 don't follow the convention. They should be > "KVM: nVMX" and "KVM: VMX". With these fixed, Sure thing - I wish it was more consistent but you are right. > > Reviewed-by: Chao Gao <chao.gao@xxxxxxxxx> > Thank you very much! Best regards, Maxim Levitsky
