linux-kernel - [Question] some questions about vmx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 6 Feb 2020 07:11:12 +0000
From:   linmiaohe <linmiaohe@...wei.com>
To:     unlisted-recipients:; (no To-header on input)
CC:     "pbonzini@...hat.com" <pbonzini@...hat.com>,
        "rkrcmar@...hat.com" <rkrcmar@...hat.com>,
        "sean.j.christopherson@...el.com" <sean.j.christopherson@...el.com>,
        "vkuznets@...hat.com" <vkuznets@...hat.com>,
        "wanpengli@...cent.com" <wanpengli@...cent.com>,
        "jmattson@...gle.com" <jmattson@...gle.com>,
        "joro@...tes.org" <joro@...tes.org>,
        "tglx@...utronix.de" <tglx@...utronix.de>,
        "mingo@...hat.com" <mingo@...hat.com>,
        "bp@...en8.de" <bp@...en8.de>, "hpa@...or.com" <hpa@...or.com>,
        "kvm@...r.kernel.org" <kvm@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "x86@...nel.org" <x86@...nel.org>
Subject: [Question] some questions about vmx

Hi all:
	I'am investigating the vmx code and encounter some questions. It's very nice of you if you can
help me fix these.

About wbinvd.
1. Which way (ctxt->ops->wbinvd)(ctxt) is called? If cpu_has_vmx_wbinvd_exit(), wbinvd instruction would
be handled by handle_wbinvd and instruction emulate is skipped...

2. What is the purpose of set local cpu into wbinvd_dirty_mask in kvm_emulate_wbinvd_noskip()? It seems
local cpu is ignored in smp_call_function_many(). And so local cpu wbinvd is missed ?

3. Commit (2eec73437487: KVM: x86: Avoid issuing wbinvd twice) said we may call wbinvd twice. Could you
please explain how it could execute it twice in detail ?

About nWMX.
When nested_vmx_handle_enlightened_vmptrld() return 0, it do not inject any exception or set rflags to
Indicate VMLAUNCH instruction failed and skip this instruction. This would cause nested_vmx_run()
return 1 and resume guest and retry this instruction. When the error causing nested_vmx_handle_enlightened_vmptrld()
failed can't be handled, would deadloop ouucr ?

About defer setting of CR2 (see commit (da998b46d244: kvm: x86: Defer setting of CR2 until #PF delivery))
How defer setting of CR2 until #PF delivery works? In inject_pending_event(), the payload of exception is loaded into
vmcs12' exit_qualification without setting CR2 via nested_vmx_check_exception() in kvm_x86_ops-> check_nested_events();
But CR2 is unconditionally set to exception.payload via vmx_queue_exception() before we enter L1.
So CR2 is modified before L1 hypervisor could intercept the fault.

Where's the wrong in my understand? Please help me figure it out. Any answer would be very appreciated.
Thanks in advance! ^_^

Best wishes!