Commit dbdd096a authored by Sean Christopherson's avatar Sean Christopherson Committed by Paolo Bonzini
Browse files

KVM: VMX: Intercept FS/GS_BASE MSR accesses for 32-bit KVM 



Disable pass-through of the FS and GS base MSRs for 32-bit KVM.  Intel's
SDM unequivocally states that the MSRs exist if and only if the CPU
supports x86-64.  FS_BASE and GS_BASE are mostly a non-issue; a clever
guest could opportunistically use the MSRs without issue.  KERNEL_GS_BASE
is a bigger problem, as a clever guest would subtly be broken if it were
migrated, as KVM disallows software access to the MSRs, and unlike the
direct variants, KERNEL_GS_BASE needs to be explicitly migrated as it's
not captured in the VMCS.

Fixes: 25c5f225 ("KVM: VMX: Enable MSR Bitmap feature")
Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
Message-Id: <20210422023831.3473491-1-seanjc@google.com>
[*NOT* for stable kernels. - Paolo]
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent 844d69c2

arch/x86/kvm/vmx/nested.c

+2 −0
Original line number Diff line number Diff line
@@ -614,6 +614,7 @@ static inline bool nested_vmx_prepare_msr_bitmap(struct kvm_vcpu *vcpu, 
	}



	/* KVM unconditionally exposes the FS/GS base MSRs to L1. */

#ifdef CONFIG_X86_64

	nested_vmx_disable_intercept_for_msr(msr_bitmap_l1, msr_bitmap_l0,

					     MSR_FS_BASE, MSR_TYPE_RW);
@@ -622,6 +623,7 @@ static inline bool nested_vmx_prepare_msr_bitmap(struct kvm_vcpu *vcpu, 


	nested_vmx_disable_intercept_for_msr(msr_bitmap_l1, msr_bitmap_l0,

					     MSR_KERNEL_GS_BASE, MSR_TYPE_RW);

#endif



	/*

	 * Checking the L0->L1 bitmap is trying to verify two things:

arch/x86/kvm/vmx/vmx.c

+4 −0
Original line number Diff line number Diff line
@@ -157,9 +157,11 @@ static u32 vmx_possible_passthrough_msrs[MAX_POSSIBLE_PASSTHROUGH_MSRS] = { 
	MSR_IA32_SPEC_CTRL,

	MSR_IA32_PRED_CMD,

	MSR_IA32_TSC,

#ifdef CONFIG_X86_64

	MSR_FS_BASE,

	MSR_GS_BASE,

	MSR_KERNEL_GS_BASE,

#endif

	MSR_IA32_SYSENTER_CS,

	MSR_IA32_SYSENTER_ESP,

	MSR_IA32_SYSENTER_EIP,
@@ -6956,9 +6958,11 @@ static int vmx_create_vcpu(struct kvm_vcpu *vcpu) 
	bitmap_fill(vmx->shadow_msr_intercept.write, MAX_POSSIBLE_PASSTHROUGH_MSRS);



	vmx_disable_intercept_for_msr(vcpu, MSR_IA32_TSC, MSR_TYPE_R);

#ifdef CONFIG_X86_64

	vmx_disable_intercept_for_msr(vcpu, MSR_FS_BASE, MSR_TYPE_RW);

	vmx_disable_intercept_for_msr(vcpu, MSR_GS_BASE, MSR_TYPE_RW);

	vmx_disable_intercept_for_msr(vcpu, MSR_KERNEL_GS_BASE, MSR_TYPE_RW);

#endif

	vmx_disable_intercept_for_msr(vcpu, MSR_IA32_SYSENTER_CS, MSR_TYPE_RW);

	vmx_disable_intercept_for_msr(vcpu, MSR_IA32_SYSENTER_ESP, MSR_TYPE_RW);

	vmx_disable_intercept_for_msr(vcpu, MSR_IA32_SYSENTER_EIP, MSR_TYPE_RW);