KVM: SEV: snapshot the GHCB before accessing it
authorPaolo Bonzini <pbonzini@redhat.com>
Fri, 4 Aug 2023 16:42:45 +0000 (12:42 -0400)
committerPaolo Bonzini <pbonzini@redhat.com>
Fri, 4 Aug 2023 17:33:06 +0000 (13:33 -0400)
commit4e15a0ddc3ff40e8ea84032213976ecf774d7f77
tree950e2a1a88cb352c9ad87800dec88ab997778e32
parent5a7591176c47cce363c1eed704241e5d1c42c5a6
KVM: SEV: snapshot the GHCB before accessing it

Validation of the GHCB is susceptible to time-of-check/time-of-use vulnerabilities.
To avoid them, we would like to always snapshot the fields that are read in
sev_es_validate_vmgexit(), and not use the GHCB anymore after it returns.

This means:

- invoking sev_es_sync_from_ghcb() before any GHCB access, including before
  sev_es_validate_vmgexit()

- snapshotting all fields including the valid bitmap and the sw_scratch field,
  which are currently not caching anywhere.

The valid bitmap is the first thing to be copied out of the GHCB; then,
further accesses will use the copy in svm->sev_es.

Fixes: 291bd20d5d88 ("KVM: SVM: Add initial support for a VMGEXIT VMEXIT")
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
arch/x86/kvm/svm/sev.c
arch/x86/kvm/svm/svm.h