From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f201.google.com (mail-pl1-f201.google.com [209.85.214.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3A7121D5141 for ; Fri, 9 Jan 2026 15:17:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767971861; cv=none; b=tRIZwx5cFUUNqYMK5u/aaDT2RWnYaDlJjR8pNZdj7MQFlKEM2cpj0UBmH2b8hVNLQ66tWanp7AMagum8wBsL07aHwL3ze7jDEbmeiZ/0iGjSuBYseVyLcxoXti9CIv5524ISIqYTgFSR8ycvDvAyoRLXWxDk3dEmemwj8/TudWo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767971861; c=relaxed/simple; bh=wraOIqhYG3It7LWinmFmn10g9mlV4E8u7FXmBpUTuh4=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=diAPFjytwHmNHzAVZHOY4tpNHPpeG49Mzq/rDKBzIifpCVvG3u21oyGzScvzdCoBxsvXbevXq3Qs1IxVW5+fiw77mJDQW93+d6OummEPfBVYR11jMdL9cLOGJ4NO5UKAC/u0oksyx3NpLq4NoeWKHILslrYFo2Ltn+tepz51nL4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=m7RvdlQO; arc=none smtp.client-ip=209.85.214.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="m7RvdlQO" Received: by mail-pl1-f201.google.com with SMTP id d9443c01a7336-2a090819ed1so32150895ad.2 for ; Fri, 09 Jan 2026 07:17:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1767971859; x=1768576659; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=aO7iUZVQjQuKnzat9kLZMX8yqUCa/gNx/w0Y51hMWjA=; b=m7RvdlQOSrkY4GrDcKCcPhL5b9brZuTaG/kJrkT8dYLwyatEfHavcF+snZkUHMCh9h gz/NuX5fwRaSHlb9s8f7SM9BZVgc85usIPlqTzXW+5/ryqB/dvsnzBd57fayl70zrywX XRyCZ0ZAS2sPuqlBF67JvanSUs/RmSe393PT2S0tf0QOY4tLSnT2To2AZXBmwl0MwyZ0 DUzZB9WyaVFvuvaYz89zEcMyIyxJOgAUVxKxu66Jhz1zOUSIS9RRG358PaGQyuWbrTS6 mwvZWoEC/TVPZ4/d3BQY/i4oD8RiDm4a24o1cgp00s6yUkdI4tBKtyfmyzu4Ledkz/se VUcg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1767971859; x=1768576659; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=aO7iUZVQjQuKnzat9kLZMX8yqUCa/gNx/w0Y51hMWjA=; b=Dib2dYciBkNOmay9NiWUyhtHpRXMJbMBwFveVCS3dn59adq/lGSSGAwoHcNDLK0ZFL MFcDhtZWqPAPIbONyaiyGhry7naSbYFVXo1npUIq7RHKMyJ4DrPeNMKOiwIsHEAi8Jm5 V44jFUZKkIXqeX2LaJz81CmGPdevLXWsUf+ZxsDe+jogIlqG3R6f3DWbsjitEzT3Pl9z a6ZN+/6P6yCvG1ybk/dTXcwZ44ZJ8TLnOtkevrGuw/5f86j2KfyzWwtSOCsmKE/iUxbn YAoJ3rQbF8JV4N4q7RQo9hM32+b/AVCBNohMK2NpufrmUYAUAH/sPCyhPrdjn4t1L68D FF4g== X-Forwarded-Encrypted: i=1; AJvYcCULU/xQv/+56fzc2u8e/U5Jib9CAqTlN3KqFKAFDx8fK0kED7xjKt6KvIclwfn0nxOAvfwXIZDgfXazA3s=@vger.kernel.org X-Gm-Message-State: AOJu0Yz9OnsbS/wzkhpSSK47MBOCLlXWQW29Z3IyAMm+ThY2y8h+B0BH XHo4zQLW2xBPZTSO6x5ihIvX+zH8DNv4isRwSUKnSsFmgyZU5Fkqw4LlobrcSh9N0Ldc2SDGLob 7myxCKQ== X-Google-Smtp-Source: AGHT+IHXK1XZ8Pzy5GRMUTozSG8PjfpmZMqxorybDQYnOat3uci8qN9buauGuTt7twFjSq4i86KKQ++6Puc= X-Received: from pjbgb18.prod.google.com ([2002:a17:90b:612:b0:343:af64:f654]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:4acb:b0:349:7f0a:381b with SMTP id 98e67ed59e1d1-34f68b4c603mr10033722a91.8.1767971859584; Fri, 09 Jan 2026 07:17:39 -0800 (PST) Date: Fri, 9 Jan 2026 07:17:37 -0800 In-Reply-To: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260109041523.1027323-1-seanjc@google.com> <20260109041523.1027323-4-seanjc@google.com> <288eaa68-7d4d-4c1b-ae70-419554d1d8f2@intel.com> Message-ID: Subject: Re: [PATCH v3 3/4] KVM: nVMX: Disallow access to vmcs12 fields that aren't supported by "hardware" From: Sean Christopherson To: Xiaoyao Li Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Chao Gao , Xin Li , Yosry Ahmed Content-Type: text/plain; charset="us-ascii" On Fri, Jan 09, 2026, Sean Christopherson wrote: > On Fri, Jan 09, 2026, Xiaoyao Li wrote: > > On 1/9/2026 12:15 PM, Sean Christopherson wrote: > > > diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c > > > index 61113ead3d7b..ac7a17560c8f 100644 > > > --- a/arch/x86/kvm/vmx/nested.c > > > +++ b/arch/x86/kvm/vmx/nested.c > > > @@ -111,6 +111,9 @@ static void init_vmcs_shadow_fields(void) > > > field <= GUEST_TR_AR_BYTES, > > > "Update vmcs12_write_any() to drop reserved bits from AR_BYTES"); > > > + if (get_vmcs12_field_offset(field) < 0) > > > + continue; > > > + > > > > why shadow_read_only_fields[] doesn't need such guard? > > > > IIUC, copy_vmcs12_to_shadow() will VMWRITE shadowed readonly field even if > > it doesn't exist on the hardware? > > Because I fixated on the existing checks and didn't look at the first for-loop. > > This time around I'll test by hacking in shadowed fields arbitrary shadow fields. And with the RO fields handled, the below doesn't explode (I verified there failures aplenty if either of the RO or RW checks are commented out). diff --git a/arch/x86/include/asm/vmx.h b/arch/x86/include/asm/vmx.h index c85c50019523..7d9bedd06afd 100644 --- a/arch/x86/include/asm/vmx.h +++ b/arch/x86/include/asm/vmx.h @@ -262,8 +262,12 @@ enum vmcs_field { SHARED_EPT_POINTER = 0x0000203C, PID_POINTER_TABLE = 0x00002042, PID_POINTER_TABLE_HIGH = 0x00002043, + INJECTED_EVENT_DATA = 0x00002052, + INJECTED_EVENT_DATA_HIGH = 0x00002053, GUEST_PHYSICAL_ADDRESS = 0x00002400, GUEST_PHYSICAL_ADDRESS_HIGH = 0x00002401, + ORIGINAL_EVENT_DATA = 0x00002404, + ORIGINAL_EVENT_DATA_HIGH = 0x00002405, VMCS_LINK_POINTER = 0x00002800, VMCS_LINK_POINTER_HIGH = 0x00002801, GUEST_IA32_DEBUGCTL = 0x00002802, diff --git a/arch/x86/kvm/vmx/vmcs12.c b/arch/x86/kvm/vmx/vmcs12.c index 1ebe67c384ad..7952d58fb2d8 100644 --- a/arch/x86/kvm/vmx/vmcs12.c +++ b/arch/x86/kvm/vmx/vmcs12.c @@ -157,6 +157,8 @@ static const u16 kvm_supported_vmcs12_field_offsets[] __initconst = { FIELD(HOST_S_CET, host_s_cet), FIELD(HOST_SSP, host_ssp), FIELD(HOST_INTR_SSP_TABLE, host_ssp_tbl), + FIELD64(INJECTED_EVENT_DATA, injected_event_data), + FIELD64(ORIGINAL_EVENT_DATA, original_event_data), }; u16 vmcs12_field_offsets[ARRAY_SIZE(kvm_supported_vmcs12_field_offsets)] __ro_after_init; @@ -204,6 +206,12 @@ static __init bool cpu_has_vmcs12_field(unsigned int idx) case HOST_INTR_SSP_TABLE: return cpu_has_load_cet_ctrl(); + case ORIGINAL_EVENT_DATA: + case ORIGINAL_EVENT_DATA_HIGH: + case INJECTED_EVENT_DATA: + case INJECTED_EVENT_DATA_HIGH: + return false; + /* KVM always emulates PML and the VMX preemption timer in software. */ case GUEST_PML_INDEX: case VMX_PREEMPTION_TIMER_VALUE: diff --git a/arch/x86/kvm/vmx/vmcs12.h b/arch/x86/kvm/vmx/vmcs12.h index 21cd1b75e4fd..56565722f527 100644 --- a/arch/x86/kvm/vmx/vmcs12.h +++ b/arch/x86/kvm/vmx/vmcs12.h @@ -191,6 +191,9 @@ struct __packed vmcs12 { u16 host_gs_selector; u16 host_tr_selector; u16 guest_pml_index; + + u64 injected_event_data; + u64 original_event_data; }; /* diff --git a/arch/x86/kvm/vmx/vmcs_shadow_fields.h b/arch/x86/kvm/vmx/vmcs_shadow_fields.h index cad128d1657b..d23ffedaf25b 100644 --- a/arch/x86/kvm/vmx/vmcs_shadow_fields.h +++ b/arch/x86/kvm/vmx/vmcs_shadow_fields.h @@ -75,5 +75,10 @@ SHADOW_FIELD_RW(HOST_GS_BASE, host_gs_base) SHADOW_FIELD_RO(GUEST_PHYSICAL_ADDRESS, guest_physical_address) SHADOW_FIELD_RO(GUEST_PHYSICAL_ADDRESS_HIGH, guest_physical_address) +SHADOW_FIELD_RO(ORIGINAL_EVENT_DATA, original_event_data) +SHADOW_FIELD_RO(ORIGINAL_EVENT_DATA_HIGH, original_event_data) +SHADOW_FIELD_RW(INJECTED_EVENT_DATA, injected_event_data) +SHADOW_FIELD_RW(INJECTED_EVENT_DATA_HIGH, injected_event_data) + #undef SHADOW_FIELD_RO #undef SHADOW_FIELD_RW