linux-kernel - Re: [PATCH] KVM: SVM: Don't intercept IRET when injecting NMI and vNMI is enabled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sat, 14 Oct 2023 20:19:52 +0530
From:   Santosh Shukla <santosh.shukla@....com>
To:     Sean Christopherson <seanjc@...gle.com>,
        Maxim Levitsky <mlevitsk@...hat.com>
Cc:     Paolo Bonzini <pbonzini@...hat.com>, kvm@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] KVM: SVM: Don't intercept IRET when injecting NMI and
 vNMI is enabled



On 10/14/2023 3:46 PM, Santosh Shukla wrote:
> 
> 
> On 10/10/2023 8:16 PM, Sean Christopherson wrote:
>> On Tue, Oct 10, 2023, Maxim Levitsky wrote:
>>> У пн, 2023-10-09 у 14:29 -0700, Sean Christopherson пише:
>>>> Note, per the APM, hardware sets the BLOCKING flag when software directly
>>>> directly injects an NMI:
>>>>
>>>>   If Event Injection is used to inject an NMI when NMI Virtualization is
>>>>   enabled, VMRUN sets V_NMI_MASK in the guest state.
>>>
>>> I think that this comment is not needed in the commit message. It describes
>>> a different unrelated concern and can be put somewhere in the code but
>>> not in the commit message.
>>
>> I strongly disagree, this blurb in the APM directly affects the patch.  If hardware
>> didn't set V_NMI_MASK, then the patch would need to be at least this:
>>
HW sets the V_NMI_MASK.

>> --
>> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
>> index b7472ad183b9..d34ee3b8293e 100644
>> --- a/arch/x86/kvm/svm/svm.c
>> +++ b/arch/x86/kvm/svm/svm.c
>> @@ -3569,8 +3569,12 @@ static void svm_inject_nmi(struct kvm_vcpu *vcpu)
>>  	if (svm->nmi_l1_to_l2)
>>  		return;
>>  
>> -	svm->nmi_masked = true;
>> -	svm_set_iret_intercept(svm);
>> +	if (is_vnmi_enabled(svm)) {
>> +		svm->vmcb->control.int_ctl |= V_NMI_BLOCKING_MASK;
>> +	} else {
>> +		svm->nmi_masked = true;
>> +		svm_set_iret_intercept(svm);
>> +	}
>>  	++vcpu->stat.nmi_injections;
>>  }
>>  
>>
> 
> quick testing worked fine, KUT test ran fine and tested for non-nested mode so far.
> Will do more nested testing and share the feedback.
> 

Sean - I have tested original patch[1] for nested and KUT, worked fine.

Thanks,
Santosh 

[1] https://lore.kernel.org/r/20231009212919.221810-1-seanjc@google.com 

> Thanks,
> Santosh
> 
>> base-commit: 86701e115030e020a052216baa942e8547e0b487
>