From the APM Volume #2, 15.25.3 (24593—Rev. 3.42—March 2024):
If VMRUN is executed with hCR0.PG cleared to zero and NP_ENABLE set to 1 , VMRUN terminates with #VMEXIT(VMEXIT_INVALID).
Add the consistency check by plumbing L1's CR0 to nested_vmcb_check_controls().
Fixes: 4b16184c1cca ("KVM: SVM: Initialize Nested Nested MMU context on VMRUN") Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed yosry.ahmed@linux.dev --- arch/x86/kvm/svm/nested.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index cac61d65efc7..5184e5ae8ccf 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -327,7 +327,8 @@ static bool nested_svm_check_bitmap_pa(struct kvm_vcpu *vcpu, u64 pa, u32 size) }
static bool nested_vmcb_check_controls(struct kvm_vcpu *vcpu, - struct vmcb_ctrl_area_cached *control) + struct vmcb_ctrl_area_cached *control, + unsigned long l1_cr0) { if (CC(!vmcb12_is_intercept(control, INTERCEPT_VMRUN))) return false; @@ -338,6 +339,8 @@ static bool nested_vmcb_check_controls(struct kvm_vcpu *vcpu, if (nested_npt_enabled(to_svm(vcpu))) { if (CC(!kvm_vcpu_is_legal_gpa(vcpu, control->nested_cr3))) return false; + if (CC(!(l1_cr0 & X86_CR0_PG))) + return false; }
if (CC(!nested_svm_check_bitmap_pa(vcpu, control->msrpm_base_pa, @@ -902,7 +905,8 @@ int enter_svm_guest_mode(struct kvm_vcpu *vcpu, u64 vmcb12_gpa, enter_guest_mode(vcpu);
if (!nested_vmcb_check_save(vcpu, &svm->nested.save) || - !nested_vmcb_check_controls(vcpu, &svm->nested.ctl)) + !nested_vmcb_check_controls(vcpu, &svm->nested.ctl, + svm->vmcb01.ptr->save.cr0)) return -EINVAL;
if (nested_npt_enabled(svm)) @@ -1823,7 +1827,8 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu,
ret = -EINVAL; __nested_copy_vmcb_control_to_cache(vcpu, &ctl_cached, ctl); - if (!nested_vmcb_check_controls(vcpu, &ctl_cached)) + /* 'save' contains L1 state saved from before VMRUN */ + if (!nested_vmcb_check_controls(vcpu, &ctl_cached, save->cr0)) goto out_free;
/*