lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 11 Mar 2022 03:27:40 +0000 From: Sean Christopherson <seanjc@...gle.com> To: Paolo Bonzini <pbonzini@...hat.com> Cc: Sean Christopherson <seanjc@...gle.com>, Vitaly Kuznetsov <vkuznets@...hat.com>, Wanpeng Li <wanpengli@...cent.com>, Jim Mattson <jmattson@...gle.com>, Joerg Roedel <joro@...tes.org>, kvm@...r.kernel.org, linux-kernel@...r.kernel.org, Oliver Upton <oupton@...gle.com>, Peter Shier <pshier@...gle.com> Subject: [PATCH 00/21] KVM: x86: Event/exception fixes and cleanups The main goal of this series is to fix KVM's longstanding bug of not honoring L1's exception intercepts wants when handling an exception that occurs during delivery of a different exception. E.g. if L0 and L1 are using shadow paging, and L2 hits a #PF, and then hits another #PF while vectoring the first #PF due to _L1_ not having a shadow page for the IDT, KVM needs to check L1's intercepts before morphing the #PF => #PF => #DF so that the #PF is routed to L1, not injected into L2 as a #DF. nVMX has hacked around the bug for years by overriding the #PF injector for shadow paging to go straight to VM-Exit, and nSVM has started doing the same. The hacks mostly work, but they're incomplete, confusing, and lead to other hacky code, e.g. bailing from the emulator because #PF injection forced a VM-Exit and suddenly KVM is back in L1. Everything leading up to that are related fixes and cleanups I encountered along the way; some through code inspection, some through tests (I truly thought this series was finished 10 commits and 3 days ago...). Nothing in here is all that urgent; all bugs tagged for stable have been around for multiple releases (years in most cases). Sean Christopherson (21): KVM: x86: Return immediately from x86_emulate_instruction() on code #DB KVM: nVMX: Unconditionally purge queued/injected events on nested "exit" KVM: VMX: Drop bits 31:16 when shoving exception error code into VMCS KVM: x86: Don't check for code breakpoints when emulating on exception KVM: nVMX: Treat General Detect #DB (DR7.GD=1) as fault-like KVM: nVMX: Prioritize TSS T-flag #DBs over Monitor Trap Flag KVM: x86: Treat #DBs from the emulator as fault-like (code and DR7.GD=1) KVM: x86: Use DR7_GD macro instead of open coding check in emulator KVM: nVMX: Ignore SIPI that arrives in L2 when vCPU is not in WFS KVM: nVMX: Unconditionally clear mtf_pending on nested VM-Exit KVM: VMX: Inject #PF on ENCLS as "emulated" #PF KVM: x86: Rename kvm_x86_ops.queue_exception to inject_exception KVM: x86: Make kvm_queued_exception a properly named, visible struct KVM: x86: Formalize blocking of nested pending exceptions KVM: x86: Use kvm_queue_exception_e() to queue #DF KVM: x86: Hoist nested event checks above event injection logic KVM: x86: Evaluate ability to inject SMI/NMI/IRQ after potential VM-Exit KVM: x86: Morph pending exceptions to pending VM-Exits at queue time KVM: VMX: Update MTF and ICEBP comments to document KVM's subtle behavior KVM: selftests: Use uapi header to get VMX and SVM exit reasons/codes KVM: selftests: Add an x86-only test to verify nested exception queueing arch/x86/include/asm/kvm-x86-ops.h | 2 +- arch/x86/include/asm/kvm_host.h | 33 +- arch/x86/kvm/emulate.c | 3 +- arch/x86/kvm/svm/nested.c | 100 ++--- arch/x86/kvm/svm/svm.c | 18 +- arch/x86/kvm/vmx/nested.c | 322 +++++++++----- arch/x86/kvm/vmx/sgx.c | 2 +- arch/x86/kvm/vmx/vmx.c | 53 ++- arch/x86/kvm/x86.c | 409 ++++++++++++------ arch/x86/kvm/x86.h | 10 +- tools/testing/selftests/kvm/.gitignore | 1 + tools/testing/selftests/kvm/Makefile | 1 + .../selftests/kvm/include/x86_64/svm_util.h | 5 +- .../selftests/kvm/include/x86_64/vmx.h | 51 +-- .../kvm/x86_64/nested_exceptions_test.c | 307 +++++++++++++ 15 files changed, 914 insertions(+), 403 deletions(-) create mode 100644 tools/testing/selftests/kvm/x86_64/nested_exceptions_test.c base-commit: 4a204f7895878363ca8211f50ec610408c8c70aa -- 2.35.1.723.g4982287a31-goog
Powered by blists - more mailing lists