[PATCH v2 0/2] KVM: nVMX: eVMCS consistency check fixes

[PATCH v2 0/2] KVM: nVMX: eVMCS consistency check fixes

[Sean Christopherson]

Fix two benign-for-real-guests bugs where KVM incorrectly performs eVMCS
consistency checks on VMCS fields that are supposed to be ignored.

v2: Properly guard the checks instead of simply deleting the WARN.

v1: https://lore.kernel.org/all/f1f39118-2e1b-476b-9a84-ef7d56412bdc@tum.de

Sean Christopherson (2):
  KVM: nVMX: Do eVMCS consistency check on secondary controls iff
    they're enable
  KVM: nVMX: Do eVMCS consistency check on VMFUNC controls iff they're
    enable

 arch/x86/kvm/vmx/hyperv.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)


base-commit: d21eef2084a9af87ac2a783bc7c2b175ba114e4e
-- 
2.56.0.567.gdb80ae8cd5-goog

[PATCH v2 1/2] KVM: nVMX: Do eVMCS consistency check on secondary controls iff they're enable

[Sean Christopherson]

Check that the secondary execution controls are actually enabled before
performing eVMCS-specific consistency checks, as the secondary controls are
supposed to be completely ignored if they're not enabled.  Per the SDM:

  If the "activate secondary controls" primary processor-based VM-execution
  control is 0 (or if the processor does not support the 1-setting of that
  control), no checks are performed on the secondary processor-based
  VM-execution controls. The logical processor operates as if all the
  secondary processor-based VM-execution controls were 0.

Fixes: a83502314ce3 ("x86/kvm/hyper-v: don't allow to turn on unsupported VMX controls for nested guests")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 arch/x86/kvm/vmx/hyperv.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kvm/vmx/hyperv.c b/arch/x86/kvm/vmx/hyperv.c
index fa41d036acd4..2b40ac32ff06 100644
--- a/arch/x86/kvm/vmx/hyperv.c
+++ b/arch/x86/kvm/vmx/hyperv.c
@@ -169,7 +169,8 @@ int nested_evmcs_check_controls(struct vmcs12 *vmcs12)
 					       vmcs12->cpu_based_vm_exec_control)))
 		return -EINVAL;
 
-	if (CC(!nested_evmcs_is_valid_controls(EVMCS_2NDEXEC,
+	if (nested_cpu_has(vmcs12, CPU_BASED_ACTIVATE_SECONDARY_CONTROLS) &&
+	    CC(!nested_evmcs_is_valid_controls(EVMCS_2NDEXEC,
 					       vmcs12->secondary_vm_exec_control)))
 		return -EINVAL;
 
-- 
2.56.0.567.gdb80ae8cd5-goog

[PATCH v2 2/2] KVM: nVMX: Do eVMCS consistency check on VMFUNC controls iff they're enable

[Sean Christopherson]

Check that the VM-function controls are actually enabled before performing
eVMCS-specific consistency checks, as the VMFUNC controls are supposed to
be completely ignored if they're not enabled.  Per the SDM:

  If the "enable VM functions" processor-based VM-execution control is 0,
  no checks are performed on the VM-function controls.

Fixes: 3ff8a13d41b2 ("KVM: nVMX: WARN once and fail VM-Enter if eVMCS sees VMFUNC[63:32] != 0")
Fixes: a83502314ce3 ("x86/kvm/hyper-v: don't allow to turn on unsupported VMX controls for nested guests")
Cc: stable@vger.kernel.org
Reported-by: Manuel Andreas <manuel.andreas@tum.de>
Closes: https://lore.kernel.org/all/f1f39118-2e1b-476b-9a84-ef7d56412bdc@tum.de
Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 arch/x86/kvm/vmx/hyperv.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/arch/x86/kvm/vmx/hyperv.c b/arch/x86/kvm/vmx/hyperv.c
index 2b40ac32ff06..a1daf8f2ec5a 100644
--- a/arch/x86/kvm/vmx/hyperv.c
+++ b/arch/x86/kvm/vmx/hyperv.c
@@ -187,11 +187,10 @@ int nested_evmcs_check_controls(struct vmcs12 *vmcs12)
 	 * controls in bits 63:32, i.e. dropping those bits on the consistency
 	 * check is intentional.
 	 */
-	if (WARN_ON_ONCE(vmcs12->vm_function_control >> 32))
-		return -EINVAL;
-
-	if (CC(!nested_evmcs_is_valid_controls(EVMCS_VMFUNC,
-					       vmcs12->vm_function_control)))
+	if (nested_cpu_has_vmfunc(vmcs12) &&
+	    (WARN_ON_ONCE(vmcs12->vm_function_control >> 32) ||
+	     CC(!nested_evmcs_is_valid_controls(EVMCS_VMFUNC,
+						vmcs12->vm_function_control))))
 		return -EINVAL;
 
 	return 0;
-- 
2.56.0.567.gdb80ae8cd5-goog