lkml.org 
[lkml]   [2022]   [Aug]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 014/545] KVM: nVMX: Snapshot pre-VM-Enter BNDCFGS for !nested_run_pending case
    Date
    From: Sean Christopherson <seanjc@google.com>

    commit fa578398a0ba2c079fa1170da21fa5baae0cedb2 upstream.

    If a nested run isn't pending, snapshot vmcs01.GUEST_BNDCFGS irrespective
    of whether or not VM_ENTRY_LOAD_BNDCFGS is set in vmcs12. When restoring
    nested state, e.g. after migration, without a nested run pending,
    prepare_vmcs02() will propagate nested.vmcs01_guest_bndcfgs to vmcs02,
    i.e. will load garbage/zeros into vmcs02.GUEST_BNDCFGS.

    If userspace restores nested state before MSRs, then loading garbage is a
    non-issue as loading BNDCFGS will also update vmcs02. But if usersepace
    restores MSRs first, then KVM is responsible for propagating L2's value,
    which is actually thrown into vmcs01, into vmcs02.

    Restoring L2 MSRs into vmcs01, i.e. loading all MSRs before nested state
    is all kinds of bizarre and ideally would not be supported. Sadly, some
    VMMs do exactly that and rely on KVM to make things work.

    Note, there's still a lurking SMM bug, as propagating vmcs01.GUEST_BNDFGS
    to vmcs02 across RSM may corrupt L2's BNDCFGS. But KVM's entire VMX+SMM
    emulation is flawed as SMI+RSM should not toouch _any_ VMCS when use the
    "default treatment of SMIs", i.e. when not using an SMI Transfer Monitor.

    Link: https://lore.kernel.org/all/Yobt1XwOfb5M6Dfa@google.com
    Fixes: 62cf9bd8118c ("KVM: nVMX: Fix emulation of VM_ENTRY_LOAD_BNDCFGS")
    Cc: stable@vger.kernel.org
    Cc: Lei Wang <lei4.wang@intel.com>
    Signed-off-by: Sean Christopherson <seanjc@google.com>
    Message-Id: <20220614215831.3762138-2-seanjc@google.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    arch/x86/kvm/vmx/nested.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    --- a/arch/x86/kvm/vmx/nested.c
    +++ b/arch/x86/kvm/vmx/nested.c
    @@ -3340,7 +3340,8 @@ enum nvmx_vmentry_status nested_vmx_ente
    if (!(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS))
    vmx->nested.vmcs01_debugctl = vmcs_read64(GUEST_IA32_DEBUGCTL);
    if (kvm_mpx_supported() &&
    - !(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_BNDCFGS))
    + (!vmx->nested.nested_run_pending ||
    + !(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_BNDCFGS)))
    vmx->nested.vmcs01_guest_bndcfgs = vmcs_read64(GUEST_BNDCFGS);

    /*

    \
     
     \ /
      Last update: 2022-08-19 17:47    [W:4.088 / U:0.328 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site