linux-kernel - [PATCH v3 00/11] KVM: nVMX: Fixes for nested state migration when eVMCS is in use

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20210526132026.270394-1-vkuznets@redhat.com>
Date:   Wed, 26 May 2021 15:20:15 +0200
From:   Vitaly Kuznetsov <vkuznets@...hat.com>
To:     kvm@...r.kernel.org, Paolo Bonzini <pbonzini@...hat.com>
Cc:     Sean Christopherson <seanjc@...gle.com>,
        Wanpeng Li <wanpengli@...cent.com>,
        Jim Mattson <jmattson@...gle.com>,
        Maxim Levitsky <mlevitsk@...hat.com>,
        linux-kernel@...r.kernel.org
Subject: [PATCH v3 00/11] KVM: nVMX: Fixes for nested state migration when eVMCS is in use

Changes since v2:
- 'KVM: nVMX: Use '-1' in 'hv_evmcs_vmptr' to indicate that eVMCS is not in
 use'/ 'KVM: nVMX: Introduce 'EVMPTR_MAP_PENDING' post-migration state'
 patches instead of 'KVM: nVMX: Introduce nested_evmcs_is_used()' [Paolo]
- 'KVM: nVMX: Don't set 'dirty_vmcs12' flag on enlightened VMPTRLD' patch
 added [Max]
- 'KVM: nVMX: Release eVMCS when enlightened VMENTRY was disabled' patch
  added.
- 'KVM: nVMX: Make copy_vmcs12_to_enlightened()/copy_enlightened_to_vmcs12()
 return 'void'' patch added [Paolo]
- R-b tags added [Max]

Original description:

Commit f5c7e8425f18 ("KVM: nVMX: Always make an attempt to map eVMCS after
migration") fixed the most obvious reason why Hyper-V on KVM (e.g. Win10
 + WSL2) was crashing immediately after migration. It was also reported
that we have more issues to fix as, while the failure rate was lowered 
signifincatly, it was still possible to observe crashes after several
dozens of migration. Turns out, the issue arises when we manage to issue
KVM_GET_NESTED_STATE right after L2->L2 VMEXIT but before L1 gets a chance
to run. This state is tracked with 'need_vmcs12_to_shadow_sync' flag but
the flag itself is not part of saved nested state. A few other less 
significant issues are fixed along the way.

While there's no proof this series fixes all eVMCS related problems,
Win10+WSL2 was able to survive 3333 (thanks, Max!) migrations without
crashing in testing.

Patches are based on the current kvm/next tree.

Vitaly Kuznetsov (11):
  KVM: nVMX: Use '-1' in 'hv_evmcs_vmptr' to indicate that eVMCS is not
    in use
  KVM: nVMX: Don't set 'dirty_vmcs12' flag on enlightened VMPTRLD
  KVM: nVMX: Release eVMCS when enlightened VMENTRY was disabled
  KVM: nVMX: Make
    copy_vmcs12_to_enlightened()/copy_enlightened_to_vmcs12() return
    'void'
  KVM: nVMX: Introduce 'EVMPTR_MAP_PENDING' post-migration state
  KVM: nVMX: Release enlightened VMCS on VMCLEAR
  KVM: nVMX: Ignore 'hv_clean_fields' data when eVMCS data is copied in
    vmx_get_nested_state()
  KVM: nVMX: Force enlightened VMCS sync from nested_vmx_failValid()
  KVM: nVMX: Reset eVMCS clean fields data from prepare_vmcs02()
  KVM: nVMX: Request to sync eVMCS from VMCS12 after migration
  KVM: selftests: evmcs_test: Test that KVM_STATE_NESTED_EVMCS is never
    lost

 arch/x86/kvm/vmx/evmcs.c                      |   3 +
 arch/x86/kvm/vmx/evmcs.h                      |   8 +
 arch/x86/kvm/vmx/nested.c                     | 144 +++++++++++-------
 arch/x86/kvm/vmx/nested.h                     |  11 +-
 arch/x86/kvm/vmx/vmx.c                        |   1 +
 .../testing/selftests/kvm/x86_64/evmcs_test.c |  64 ++++----
 6 files changed, 140 insertions(+), 91 deletions(-)

-- 
2.31.1