From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 51BF43E92BE for ; Tue, 10 Mar 2026 20:24:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773174262; cv=none; b=iDmrzvsTg+buHp+NIJIYRQcCL1CRK3a61E6RvxuNjpqK+WtajcJA5Ev/RHH7wjP0TMf5/V1tjRbpnQhKvu/mJpwquP9gs781av7CW1Y50v2HntK9nF2lvOVMkRMkwubwUehnnbfRWpH5220RA3/eflkB+Q0Mf/rzOkpVq8AqCLM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773174262; c=relaxed/simple; bh=gi4vXovfy353ltXptWp6oxrDr/O9AdriHG1iPUCC2gI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=bs7Urjf3dXzu+VlOj8RKhSQkwqRTcODplUVYJhVz4GCaA6ojVEB8MYsrNGH/ABXEpMKowqjVCHc1fU08GLTtxqp8wrryGTUf4kkKmCBP8yIfhjnscV1i/kSWxPoNQq2ROqZvRz5yCkG7pbtE3SsKIYt1zL16KNGH+irbW3IHIBg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=QZLh8dEa; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=OiF4qK7k; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="QZLh8dEa"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="OiF4qK7k" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1773174260; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=pv3ata0kOEeNqFcrcQ8GDlYqMPsQTKXZ6uyNDxDUgnk=; b=QZLh8dEaCS3IEzkyacQ2HW53yvpkqi7X1DCxmY3sAroJanHx8rcS4PhBrE07gm0Hpw0kbC WlQ+Dl2uWNAJbnZWpdLJw0PZ+JGjoRuh+fUHAditd7VBminA2S095FhzAi0QIDIwVzHE2E Ct0AGhQWBfOGRXHesE+APqASC01xMyo= Received: from mail-wm1-f71.google.com (mail-wm1-f71.google.com [209.85.128.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-456-EgpDr-bsNyyGc5dn384hgg-1; Tue, 10 Mar 2026 16:24:18 -0400 X-MC-Unique: EgpDr-bsNyyGc5dn384hgg-1 X-Mimecast-MFC-AGG-ID: EgpDr-bsNyyGc5dn384hgg_1773174258 Received: by mail-wm1-f71.google.com with SMTP id 5b1f17b1804b1-48378df3469so1548085e9.1 for ; Tue, 10 Mar 2026 13:24:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1773174256; x=1773779056; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=pv3ata0kOEeNqFcrcQ8GDlYqMPsQTKXZ6uyNDxDUgnk=; b=OiF4qK7kcxrqYn8nFhe7yaM/H110heB5Yn5jFmes9C/Avqt26b0r8pqKiULaKc2e+1 gS9VFt30CQbaOCjOqUR3gU1f7bvqoQYWuHboGbNLPg3xKiT+kNiIIhJKnqCQ6mTo5Q8P J4wTsYluXCCxrXO9fXYm6GmGfoAI+o8Zbdza1v9EMkijDes8CK0V/Mgka4OfKFEoS9bY xE1kTdd1cUHXBj6mTyNZniaTJFKPS4m1pghvXnq9brRGF+wxayrgIc2SgthmWakmopID 0lySTNm9EE9Kdci0oiGSmAJbMJ4oFloHnbIUMdaDy7sLXC4ghVOad4n2zHsBMea9e0kr hLEQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1773174256; x=1773779056; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=pv3ata0kOEeNqFcrcQ8GDlYqMPsQTKXZ6uyNDxDUgnk=; b=Xr3d9kt1t74RtsrP/0lXqYMQKBzWm+Pplq5vXRF81nk2DU+89SkUL7EpmAJWdcs64J 5IbR2NVHCCPSesxTyKAhNFOoP6cxTIU/rkRN6jOEJsAk31iRJmfDxfuSHvKVFMV20TWq n+EaF7+FWz3AqABzEHjgRUL5+yadIyyU6euA+fTC1lrd7IvcNyz4ffZCSqh/Lx7svmE9 YYdEyR0CFnri39WYFaKwqn+xYjHmLm3TaU3cq9tcrOICoaKAh/w4BU5LWp9EwY4/LJgD ZgadAmB37QuI9jiozjPBfQerzt2ySDau3MyDpg7SbmUm/ZeVHZpn2IOxwxtz6vJH9JQ6 4pyw== X-Gm-Message-State: AOJu0YzLeq1luYypwBqLwBQZ3DQK4rnZ4HK5etH+8yJi8mxTDv+PaebJ Y73x/Vs8zz1FZN+CP55i/nlqPODyefENf8rXKmd7RTfelnaav2hgvAxNdozqkETN8LzUfdg8cCJ +CBZBNJ+nqgNh/nv6aQHEcAURF2SVr+vIYvJsLHEOg3/3PrwmjvFzvPzmldlLZPy4NdQyHCn5mb gl/RuDD4u+rufWRnGCqFCSkd2iduXImJfYE4op4QvNZozVWbA1Ew== X-Gm-Gg: ATEYQzx0/ABVPHksOQ0gX5mwrSz+8f1spvHEF80JsKwJcDy2EwnfZwmxKGbWQohQJyY Dft0K31cHslkBy3GP1n8JI/Ov9XJeq5MVOcK1nacDhclzaxj6wVa60pN1nKvkDjp8lvwgSVzZgu ICgmzHPUk/wk0v/2VmR2UGK5K7vIRbU2zmSw3cawNnda/dGAA5orWCJJs25vyPfoYlAkR3nRmmy HONVsUQSCt5vF2riBGXbBun5OCi6oulZ99+ClOVA2JEp9dFBM63J9ez0saFNgmbXYAF+tipACUc A2K3Xx7RuTrmi58TsYHD6zhrodIZ6O9UbTeVNZP33gMBM3DVRGIYKb8Wuhslp5WNd8rMjCVJU84 8ViDrAygsH0YrW4FugR6HJWiVlHLLedIhAqCrx89vUZehWTZDFcUGcdSNHV63B5u4wAs/8atkRl hLqkEnzgWMFnDKMSSiOR1oENbB6HU= X-Received: by 2002:a05:600c:3b23:b0:485:3989:b3e4 with SMTP id 5b1f17b1804b1-4854b24aff3mr568245e9.6.1773174256368; Tue, 10 Mar 2026 13:24:16 -0700 (PDT) X-Received: by 2002:a05:600c:3b23:b0:485:3989:b3e4 with SMTP id 5b1f17b1804b1-4854b24aff3mr567725e9.6.1773174255920; Tue, 10 Mar 2026 13:24:15 -0700 (PDT) Received: from [192.168.10.48] ([151.95.144.138]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48541b6f708sm140403735e9.11.2026.03.10.13.24.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 10 Mar 2026 13:24:15 -0700 (PDT) From: Paolo Bonzini To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: seanjc@google.com, xinyang@anthropic.com Subject: [PATCH 0/5] KVM: x86: check validity of nested state when returning from SMM Date: Tue, 10 Mar 2026 21:24:09 +0100 Message-ID: <20260310202414.406078-1-pbonzini@redhat.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The VMCS/VMCB state for a suspended L2 guest can become invalid while the L1 guest is in SMM, for example via changes to the eVMCS or to the in-memory image of the VMCB. On Intel systems this can also happen via KVM_SET_NESTED_STATE with KVM_STATE_NESTED_SMM_GUEST_MODE and a corrupted VMCS12 image (kvm-amd.ko stores the flag in memory rather than out of band, so it's not affected). Because of this, nested state has to be checked for validity when RSM is executed and would re-enter L2. The existing checks already exist as part of KVM_SET_NESTED_STATE (the other "not your usual VMLAUNCH/VMRESUME/VMRUN" path that performs a nested vmentry), so extract them to new functions and move them to the leave_smm callback. Paolo Paolo Bonzini (5): KVM: VMX: check validity of VMCS controls when returning from SMM KVM: SVM: check validity of VMCB when returning from SMM selftests: kvm: extract common functionality out of smm_test.c selftests: kvm: add a test that VMX validates controls on RSM KVM: x86: clarify leave_smm() return value arch/x86/kvm/svm/nested.c | 12 +- arch/x86/kvm/svm/svm.c | 8 +- arch/x86/kvm/svm/svm.h | 1 + arch/x86/kvm/vmx/nested.c | 39 +++-- arch/x86/kvm/vmx/nested.h | 1 + arch/x86/kvm/vmx/vmx.c | 8 +- tools/testing/selftests/kvm/Makefile.kvm | 1 + tools/testing/selftests/kvm/include/x86/smm.h | 17 ++ .../testing/selftests/kvm/lib/x86/processor.c | 26 +++ .../kvm/x86/evmcs_smm_controls_test.c | 150 ++++++++++++++++++ tools/testing/selftests/kvm/x86/smm_test.c | 27 +--- 11 files changed, 247 insertions(+), 43 deletions(-) create mode 100644 tools/testing/selftests/kvm/include/x86/smm.h create mode 100644 tools/testing/selftests/kvm/x86/evmcs_smm_controls_test.c -- 2.53.0