archives/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-03-08 03:04:51 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

KVM: nVMX: Disallow access to vmcs12 fields that aren't supported by "hardware"

Browse source 
Disallow access (VMREAD/VMWRITE), both emulated and via a shadow VMCS, to
VMCS fields that the loaded incarnation of KVM doesn't support, e.g. due
to lack of hardware support, as a middle ground between allowing access to
any vmcs12 field defined by KVM (current behavior) and gating access based
on the userspace-defined vCPU model (the most functionally correct, but
very costly, implementation).

Disallowing access to unsupported fields helps a tiny bit in terms of
closing the virtualization hole (see below), but the main motivation is to
avoid having to weed out unsupported fields when synchronizing between
vmcs12 and a shadow VMCS.  Because shadow VMCS accesses are done via
VMREAD and VMWRITE, KVM _must_ filter out unsupported fields (or eat
VMREAD/VMWRITE failures), and filtering out just shadow VMCS fields is
about the same amount of effort, and arguably much more confusing.

As a bonus, this also fixes a KVM-Unit-Test failure bug when running on
_hardware_ without support for TSC Scaling, which fails with the same
signature as the bug fixed by commit ba1f82456b ("KVM: nVMX: Dynamically
compute max VMCS index for vmcs12"):

  FAIL: VMX_VMCS_ENUM.MAX_INDEX expected: 19, actual: 17

Dynamically computing the max VMCS index only resolved the issue where KVM
was hardcoding max index, but for CPUs with TSC Scaling, that was "good
enough".

Reviewed-by: Chao Gao <chao.gao@intel.com>
Reviewed-by: Xin Li <xin@zytor.com>
Cc: Xiaoyao Li <xiaoyao.li@intel.com>
Cc: Yosry Ahmed <yosry.ahmed@linux.dev>
Link: https://lore.kernel.org/all/20251026201911.505204-22-xin@zytor.com
Link: https://lore.kernel.org/all/YR2Tf9WPNEzrE7Xg@google.com
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://patch.msgid.link/20260115173427.716021-4-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
This commit is contained in:
Sean Christopherson 2026-01-15 09:34:26 -08:00
parent c68feb605c
commit 5fdf86e735
4 changed files with 92 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

18
arch/x86/kvm/vmx/nested.c
View file

@ -86,6 +86,9 @@ static void init_vmcs_shadow_fields(void)
pr_err("Missing field from shadow_read_only_field %x\n",
field + 1);
if (get_vmcs12_field_offset(field) < 0)
continue;
clear_bit(field, vmx_vmread_bitmap);
if (field & 1)
#ifdef CONFIG_X86_64
@ -111,6 +114,9 @@ static void init_vmcs_shadow_fields(void)
field <= GUEST_TR_AR_BYTES,
"Update vmcs12_write_any() to drop reserved bits from AR_BYTES");
if (get_vmcs12_field_offset(field) < 0)
continue;
/*
* PML and the preemption timer can be emulated, but the
* processor cannot vmwrite to fields that don't exist
@ -7074,12 +7080,6 @@ void nested_vmx_set_vmcs_shadowing_bitmap(void)
}
}
/*
* Indexing into the vmcs12 uses the VMCS encoding rotated left by 6. Undo
* that madness to get the encoding for comparison.
*/
#define VMCS12_IDX_TO_ENC(idx) ((u16)(((u16)(idx) >> 6) | ((u16)(idx) << 10)))
static u64 nested_vmx_calc_vmcs_enum_msr(void)
{
/*
@ -7407,6 +7407,12 @@ __init int nested_vmx_hardware_setup(int (*exit_handlers[])(struct kvm_vcpu *))
{
int i;
/*
* Note! The set of supported vmcs12 fields is consumed by both VMX
* MSR and shadow VMCS setup.
*/
nested_vmx_setup_vmcs12_fields();
nested_vmx_setup_ctls_msrs(&vmcs_config, vmx_capability.ept);
if (!cpu_has_vmx_shadow_vmcs())

8
arch/x86/kvm/vmx/vmcs.h
View file

@ -11,7 +11,15 @@
#include "capabilities.h"
/*
* Indexing into the vmcs12 uses the VMCS encoding rotated left by 6 as a very
* rudimentary compression of the range of indices. The compression ratio is
* good enough to allow KVM to use a (very sparsely populated) array without
* wasting too much memory, while the "algorithm" is fast enough to be used to
* lookup vmcs12 fields on-demand, e.g. for emulation.
*/
#define ROL16(val, n) ((u16)(((u16)(val) << (n)) | ((u16)(val) >> (16 - (n)))))
#define VMCS12_IDX_TO_ENC(idx) ROL16(idx, 10)
#define ENC_TO_VMCS12_IDX(enc) ROL16(enc, 6)
struct vmcs_hdr {

70
arch/x86/kvm/vmx/vmcs12.c
View file

@ -9,7 +9,7 @@
FIELD(number, name), \
[ENC_TO_VMCS12_IDX(number##_HIGH)] = VMCS12_OFFSET(name) + sizeof(u32)
const unsigned short vmcs12_field_offsets[] = {
static const u16 kvm_supported_vmcs12_field_offsets[] __initconst = {
FIELD(VIRTUAL_PROCESSOR_ID, virtual_processor_id),
FIELD(POSTED_INTR_NV, posted_intr_nv),
FIELD(GUEST_ES_SELECTOR, guest_es_selector),
@ -158,4 +158,70 @@ const unsigned short vmcs12_field_offsets[] = {
FIELD(HOST_SSP, host_ssp),
FIELD(HOST_INTR_SSP_TABLE, host_ssp_tbl),
};
const unsigned int nr_vmcs12_fields = ARRAY_SIZE(vmcs12_field_offsets);
u16 vmcs12_field_offsets[ARRAY_SIZE(kvm_supported_vmcs12_field_offsets)] __ro_after_init;
unsigned int nr_vmcs12_fields __ro_after_init;
#define VMCS12_CASE64(enc) case enc##_HIGH: case enc
static __init bool cpu_has_vmcs12_field(unsigned int idx)
{
switch (VMCS12_IDX_TO_ENC(idx)) {
case VIRTUAL_PROCESSOR_ID:
return cpu_has_vmx_vpid();
case POSTED_INTR_NV:
return cpu_has_vmx_posted_intr();
VMCS12_CASE64(TSC_MULTIPLIER):
return cpu_has_vmx_tsc_scaling();
case TPR_THRESHOLD:
VMCS12_CASE64(VIRTUAL_APIC_PAGE_ADDR):
return cpu_has_vmx_tpr_shadow();
VMCS12_CASE64(APIC_ACCESS_ADDR):
return cpu_has_vmx_virtualize_apic_accesses();
VMCS12_CASE64(POSTED_INTR_DESC_ADDR):
return cpu_has_vmx_posted_intr();
case GUEST_INTR_STATUS:
return cpu_has_vmx_virtual_intr_delivery();
VMCS12_CASE64(VM_FUNCTION_CONTROL):
VMCS12_CASE64(EPTP_LIST_ADDRESS):
return cpu_has_vmx_vmfunc();
VMCS12_CASE64(EPT_POINTER):
return cpu_has_vmx_ept();
VMCS12_CASE64(XSS_EXIT_BITMAP):
return cpu_has_vmx_xsaves();
VMCS12_CASE64(ENCLS_EXITING_BITMAP):
return cpu_has_vmx_encls_vmexit();
VMCS12_CASE64(GUEST_IA32_PERF_GLOBAL_CTRL):
VMCS12_CASE64(HOST_IA32_PERF_GLOBAL_CTRL):
return cpu_has_load_perf_global_ctrl();
case SECONDARY_VM_EXEC_CONTROL:
return cpu_has_secondary_exec_ctrls();
case GUEST_S_CET:
case GUEST_SSP:
case GUEST_INTR_SSP_TABLE:
case HOST_S_CET:
case HOST_SSP:
case HOST_INTR_SSP_TABLE:
return cpu_has_load_cet_ctrl();
/* KVM always emulates PML and the VMX preemption timer in software. */
case GUEST_PML_INDEX:
case VMX_PREEMPTION_TIMER_VALUE:
default:
return true;
}
}
void __init nested_vmx_setup_vmcs12_fields(void)
{
unsigned int i;
for (i = 0; i < ARRAY_SIZE(kvm_supported_vmcs12_field_offsets); i++) {
if (!kvm_supported_vmcs12_field_offsets[i] ||
!cpu_has_vmcs12_field(i))
continue;
vmcs12_field_offsets[i] = kvm_supported_vmcs12_field_offsets[i];
nr_vmcs12_fields = i + 1;
}
}

6
arch/x86/kvm/vmx/vmcs12.h
View file

@ -374,8 +374,10 @@ static inline void vmx_check_vmcs12_offsets(void)
CHECK_OFFSET(guest_pml_index, 996);
}
extern const unsigned short vmcs12_field_offsets[];
extern const unsigned int nr_vmcs12_fields;
extern u16 vmcs12_field_offsets[] __ro_after_init;
extern unsigned int nr_vmcs12_fields __ro_after_init;
void __init nested_vmx_setup_vmcs12_fields(void);
static inline short get_vmcs12_field_offset(unsigned long field)
{