linux-kernel - Re: [PATCH] KVM: nVMX: Disallow access to vmcs12 fields that aren't supported by "hardware"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aULATi4uMa-5z08k@google.com>
Date: Wed, 17 Dec 2025 06:38:06 -0800
From: Sean Christopherson <seanjc@...gle.com>
To: Chao Gao <chao.gao@...el.com>
Cc: Paolo Bonzini <pbonzini@...hat.com>, kvm@...r.kernel.org, linux-kernel@...r.kernel.org, 
	Yosry Ahmed <yosry.ahmed@...ux.dev>
Subject: Re: [PATCH] KVM: nVMX: Disallow access to vmcs12 fields that aren't
 supported by "hardware"

On Wed, Dec 17, 2025, Chao Gao wrote:
> >+static __init bool cpu_has_vmcs12_field(unsigned int idx)
> >+{
> >+	switch (VMCS12_IDX_TO_ENC(idx)) {
> >+	case VIRTUAL_PROCESSOR_ID: return cpu_has_vmx_vpid();
> >+	case POSTED_INTR_NV: return cpu_has_vmx_posted_intr();
> >+	VMCS12_CASE64(TSC_MULTIPLIER): return cpu_has_vmx_tsc_scaling();
> >+	VMCS12_CASE64(VIRTUAL_APIC_PAGE_ADDR): return cpu_has_vmx_tpr_shadow();
> >+	VMCS12_CASE64(APIC_ACCESS_ADDR): return cpu_has_vmx_virtualize_apic_accesses();
> >+	VMCS12_CASE64(POSTED_INTR_DESC_ADDR): return cpu_has_vmx_posted_intr();
> >+	VMCS12_CASE64(VM_FUNCTION_CONTROL): return cpu_has_vmx_vmfunc();
> >+	VMCS12_CASE64(EPT_POINTER): return cpu_has_vmx_ept();
> >+	VMCS12_CASE64(EPTP_LIST_ADDRESS): return cpu_has_vmx_vmfunc();
> >+	VMCS12_CASE64(XSS_EXIT_BITMAP): return cpu_has_vmx_xsaves();
> >+	VMCS12_CASE64(ENCLS_EXITING_BITMAP): return cpu_has_vmx_encls_vmexit();
> >+	VMCS12_CASE64(GUEST_IA32_PERF_GLOBAL_CTRL): return cpu_has_load_perf_global_ctrl();
> >+	VMCS12_CASE64(HOST_IA32_PERF_GLOBAL_CTRL): return cpu_has_load_perf_global_ctrl();
> >+	case TPR_THRESHOLD: return cpu_has_vmx_tpr_shadow();
> >+	case SECONDARY_VM_EXEC_CONTROL: return cpu_has_secondary_exec_ctrls();
> >+	case GUEST_S_CET: return cpu_has_load_cet_ctrl();
> >+	case GUEST_SSP: return cpu_has_load_cet_ctrl();
> >+	case GUEST_INTR_SSP_TABLE: return cpu_has_load_cet_ctrl();
> >+	case HOST_S_CET: return cpu_has_load_cet_ctrl();
> >+	case HOST_SSP: return cpu_has_load_cet_ctrl();
> >+	case HOST_INTR_SSP_TABLE: return cpu_has_load_cet_ctrl();
> 
> Most fields here are not shadowed, e.g., CET-related fields. So, the plan is
> that new fields should be added here regardless of whether they are shadowed or
> not, right?

Yep.  It'll be mildly annoying to keep up-to-date, but I hopefully having an
"unconditional" rule will be less confusing than limiting the checks to fields
that are allowed to hit the shadow VMCS.

> And GUEST_INTR_STATUS is missing here. It depends on APICv and is handled
> explicitly in init_vmcs_shadow_fields().

Gah, I had that one on my todo list, but got sidetracked for a week and completely
forgot about it.

Thank you!