Commit 72d12715 authored by Sean Christopherson's avatar Sean Christopherson
Browse files

KVM: SVM: Refuse to attempt VRMUN if an SEV-ES+ guest has an invalid VMSA 



Explicitly reject KVM_RUN with KVM_EXIT_FAIL_ENTRY if userspace "coerces"
KVM into running an SEV-ES+ guest with an invalid VMSA, e.g. by modifying
a vCPU's mp_state to be RUNNABLE after an SNP vCPU has undergone a Destroy
event.  On Destroy or failed Create, KVM marks the vCPU HALTED so that
*KVM* doesn't run the vCPU, but nothing prevents a misbehaving VMM from
manually making the vCPU RUNNABLE via KVM_SET_MP_STATE.

Attempting VMRUN with an invalid VMSA should be harmless, but knowingly
executing VMRUN with bad control state is at best dodgy.

Fixes: e366f92e ("KVM: SEV: Support SEV-SNP AP Creation NAE event")
Reviewed-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
Reviewed-by: default avatarPankaj Gupta <pankaj.gupta@amd.com>
Link: https://lore.kernel.org/r/20250227012541.3234589-4-seanjc@google.com


Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
parent d4b69c3d

arch/x86/kvm/svm/sev.c

+13 −3
Original line number Diff line number Diff line
@@ -3451,10 +3451,19 @@ void sev_es_unmap_ghcb(struct vcpu_svm *svm) 
	svm->sev_es.ghcb = NULL;

}



void pre_sev_run(struct vcpu_svm *svm, int cpu)

int pre_sev_run(struct vcpu_svm *svm, int cpu)

{

	struct svm_cpu_data *sd = per_cpu_ptr(&svm_data, cpu);

	unsigned int asid = sev_get_asid(svm->vcpu.kvm);

	struct kvm *kvm = svm->vcpu.kvm;

	unsigned int asid = sev_get_asid(kvm);



	/*

	 * Reject KVM_RUN if userspace attempts to run the vCPU with an invalid

	 * VMSA, e.g. if userspace forces the vCPU to be RUNNABLE after an SNP

	 * AP Destroy event.

	 */

	if (sev_es_guest(kvm) && !VALID_PAGE(svm->vmcb->control.vmsa_pa))

		return -EINVAL;



	/* Assign the asid allocated with this SEV guest */

	svm->asid = asid;
@@ -3467,11 +3476,12 @@ void pre_sev_run(struct vcpu_svm *svm, int cpu) 
	 */

	if (sd->sev_vmcbs[asid] == svm->vmcb &&

	    svm->vcpu.arch.last_vmentry_cpu == cpu)

		return;

		return 0;



	sd->sev_vmcbs[asid] = svm->vmcb;

	svm->vmcb->control.tlb_ctl = TLB_CONTROL_FLUSH_ASID;

	vmcb_mark_dirty(svm->vmcb, VMCB_ASID);

	return 0;

}



#define GHCB_SCRATCH_AREA_LIMIT		(16ULL * PAGE_SIZE)

arch/x86/kvm/svm/svm.c

+9 −2
Original line number Diff line number Diff line
@@ -3599,7 +3599,7 @@ static int svm_handle_exit(struct kvm_vcpu *vcpu, fastpath_t exit_fastpath) 
	return svm_invoke_exit_handler(vcpu, exit_code);

}



static void pre_svm_run(struct kvm_vcpu *vcpu)

static int pre_svm_run(struct kvm_vcpu *vcpu)

{

	struct svm_cpu_data *sd = per_cpu_ptr(&svm_data, vcpu->cpu);

	struct vcpu_svm *svm = to_svm(vcpu);
@@ -3621,6 +3621,8 @@ static void pre_svm_run(struct kvm_vcpu *vcpu) 
	/* FIXME: handle wraparound of asid_generation */

	if (svm->current_vmcb->asid_generation != sd->asid_generation)

		new_asid(svm, sd);



	return 0;

}



static void svm_inject_nmi(struct kvm_vcpu *vcpu)
@@ -4243,7 +4245,12 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu, 
	if (force_immediate_exit)

		smp_send_reschedule(vcpu->cpu);



	pre_svm_run(vcpu);

	if (pre_svm_run(vcpu)) {

		vcpu->run->exit_reason = KVM_EXIT_FAIL_ENTRY;

		vcpu->run->fail_entry.hardware_entry_failure_reason = SVM_EXIT_ERR;

		vcpu->run->fail_entry.cpu = vcpu->cpu;

		return EXIT_FASTPATH_EXIT_USERSPACE;

	}



	sync_lapic_to_cr8(vcpu);

arch/x86/kvm/svm/svm.h

+1 −1
Original line number Diff line number Diff line
@@ -742,7 +742,7 @@ void avic_refresh_virtual_apic_mode(struct kvm_vcpu *vcpu); 


/* sev.c */



void pre_sev_run(struct vcpu_svm *svm, int cpu);

int pre_sev_run(struct vcpu_svm *svm, int cpu);

void sev_init_vmcb(struct vcpu_svm *svm);

void sev_vcpu_after_set_cpuid(struct vcpu_svm *svm);

int sev_es_string_io(struct vcpu_svm *svm, int size, unsigned int port, int in);