public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
From: Maxim Levitsky <mlevitsk@redhat.com>
To: kvm@vger.kernel.org
Cc: Tony Luck <tony.luck@intel.com>,
	"Chang S. Bae" <chang.seok.bae@intel.com>,
	Thomas Gleixner <tglx@linutronix.de>,
	Wanpeng Li <wanpengli@tencent.com>,
	Ingo Molnar <mingo@redhat.com>,
	Vitaly Kuznetsov <vkuznets@redhat.com>,
	Pawan Gupta <pawan.kumar.gupta@linux.intel.com>,
	Dave Hansen <dave.hansen@linux.intel.com>,
	Paolo Bonzini <pbonzini@redhat.com>,
	linux-kernel@vger.kernel.org,
	Rodrigo Vivi <rodrigo.vivi@intel.com>,
	"H. Peter Anvin" <hpa@zytor.com>,
	intel-gvt-dev@lists.freedesktop.org,
	Joonas Lahtinen <joonas.lahtinen@linux.intel.com>,
	Joerg Roedel <joro@8bytes.org>,
	Sean Christopherson <seanjc@google.com>,
	David Airlie <airlied@linux.ie>, Zhi Wang <zhi.a.wang@intel.com>,
	Brijesh Singh <brijesh.singh@amd.com>,
	Jim Mattson <jmattson@google.com>,
	x86@kernel.org, Daniel Vetter <daniel@ffwll.ch>,
	Borislav Petkov <bp@alien8.de>,
	Zhenyu Wang <zhenyuw@linux.intel.com>,
	Kan Liang <kan.liang@linux.intel.com>,
	Jani Nikula <jani.nikula@linux.intel.com>,
	Maxim Levitsky <mlevitsk@redhat.com>,
	stable@vger.kernel.org
Subject: [PATCH RESEND 03/30] KVM: x86: nSVM: mark vmcb01 as dirty when restoring SMM saved state
Date: Mon,  7 Feb 2022 17:54:20 +0200	[thread overview]
Message-ID: <20220207155447.840194-4-mlevitsk@redhat.com> (raw)
In-Reply-To: <20220207155447.840194-1-mlevitsk@redhat.com>

While usually, restoring the smm state makes the KVM enter
the nested guest thus a different vmcb (vmcb02 vs vmcb01),
KVM should still mark it as dirty, since hardware
can in theory cache multiple vmcbs.

Failure to do so, combined with lack of setting the
nested_run_pending (which is fixed in the next patch),
might make KVM re-enter vmcb01, which was just exited from,
with completely different set of guest state registers
(SMM vs non SMM) and without proper dirty bits set,
which results in the CPU reusing stale IDTR pointer
which leads to a guest shutdown on any interrupt.

On the real hardware this usually doesn't happen,
but when running nested, L0's KVM does check and
honour few dirty bits, causing this issue to happen.

This patch fixes boot of hyperv and SMM enabled
windows VM running nested on KVM.

Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
Cc: stable@vger.kernel.org
---
 arch/x86/kvm/svm/svm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 995c203a62fd9..3f1d11e652123 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -4267,6 +4267,8 @@ static int svm_leave_smm(struct kvm_vcpu *vcpu, const char *smstate)
 	 * Enter the nested guest now
 	 */
 
+	vmcb_mark_all_dirty(svm->vmcb01.ptr);
+
 	vmcb12 = map.hva;
 	nested_copy_vmcb_control_to_cache(svm, &vmcb12->control);
 	nested_copy_vmcb_save_to_cache(svm, &vmcb12->save);
-- 
2.26.3


  parent reply	other threads:[~2022-02-07 16:01 UTC|newest]

Thread overview: 36+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-02-07 15:54 [PATCH RESEND 00/30] My patch queue Maxim Levitsky
2022-02-07 15:54 ` [PATCH RESEND 01/30] KVM: x86: SVM: don't passthrough SMAP/SMEP/PKE bits in !NPT && !gCR0.PG case Maxim Levitsky
2022-02-07 15:54 ` [PATCH RESEND 02/30] KVM: x86: nSVM: fix potential NULL derefernce on nested migration Maxim Levitsky
2022-02-07 15:54 ` Maxim Levitsky [this message]
2022-02-07 15:54 ` [PATCH RESEND 04/30] KVM: x86: nSVM/nVMX: set nested_run_pending on VM entry which is a result of RSM Maxim Levitsky
2022-02-07 15:54 ` [PATCH RESEND 05/30] KVM: x86: nSVM: expose clean bit support to the guest Maxim Levitsky
2022-02-07 15:54 ` [PATCH RESEND 06/30] KVM: x86: mark syntethic SMM vmexit as SVM_EXIT_SW Maxim Levitsky
2022-02-07 15:54 ` [PATCH RESEND 07/30] KVM: x86: nSVM: deal with L1 hypervisor that intercepts interrupts but lets L2 control them Maxim Levitsky
2022-02-08 11:33   ` Paolo Bonzini
2022-02-08 11:55     ` Maxim Levitsky
2022-02-08 12:24       ` Maxim Levitsky
2022-02-07 15:54 ` [PATCH RESEND 08/30] KVM: x86: lapic: don't touch irr_pending in kvm_apic_update_apicv when inhibiting it Maxim Levitsky
2022-02-07 15:54 ` [PATCH RESEND 09/30] KVM: x86: SVM: move avic definitions from AMD's spec to svm.h Maxim Levitsky
2022-02-07 15:54 ` [PATCH RESEND 10/30] KVM: x86: SVM: fix race between interrupt delivery and AVIC inhibition Maxim Levitsky
2022-02-07 15:54 ` [PATCH RESEND 11/30] KVM: x86: SVM: use vmcb01 in avic_init_vmcb Maxim Levitsky
2022-02-07 15:54 ` [PATCH RESEND 12/30] KVM: x86: SVM: allow AVIC to co-exist with a nested guest running Maxim Levitsky
2022-02-07 15:54 ` [PATCH RESEND 13/30] KVM: x86: lapic: don't allow to change APIC ID when apic acceleration is enabled Maxim Levitsky
2022-02-07 15:54 ` [PATCH RESEND 14/30] KVM: x86: lapic: don't allow to change local apic id when using older x2apic api Maxim Levitsky
2022-02-07 15:54 ` [PATCH RESEND 15/30] KVM: x86: SVM: remove avic's broken code that updated APIC ID Maxim Levitsky
2022-02-07 15:54 ` [PATCH RESEND 16/30] KVM: x86: SVM: allow to force AVIC to be enabled Maxim Levitsky
2022-02-07 15:54 ` [PATCH RESEND 17/30] KVM: x86: mmu: trace kvm_mmu_set_spte after the new SPTE was set Maxim Levitsky
2022-02-07 15:54 ` [PATCH RESEND 18/30] KVM: x86: mmu: add strict mmu mode Maxim Levitsky
2022-02-07 15:54 ` [PATCH RESEND 19/30] KVM: x86: mmu: add gfn_in_memslot helper Maxim Levitsky
2022-02-07 15:54 ` [PATCH RESEND 20/30] KVM: x86: mmu: allow to enable write tracking externally Maxim Levitsky
2022-02-07 15:54 ` [PATCH RESEND 21/30] x86: KVMGT: use kvm_page_track_write_tracking_enable Maxim Levitsky
2022-02-07 15:54 ` [PATCH RESEND 22/30] KVM: x86: nSVM: correctly virtualize LBR msrs when L2 is running Maxim Levitsky
2022-02-07 15:54 ` [PATCH RESEND 23/30] KVM: x86: nSVM: implement nested LBR virtualization Maxim Levitsky
2022-02-07 15:54 ` [PATCH RESEND 24/30] KVM: x86: nSVM: implement nested VMLOAD/VMSAVE Maxim Levitsky
2022-02-07 15:54 ` [PATCH RESEND 25/30] KVM: x86: nSVM: support PAUSE filter threshold and count when cpu_pm=on Maxim Levitsky
2022-02-07 15:54 ` [PATCH RESEND 26/30] KVM: x86: nSVM: implement nested vGIF Maxim Levitsky
2022-02-07 15:54 ` [PATCH RESEND 27/30] KVM: x86: add force_intercept_exceptions_mask Maxim Levitsky
2022-02-07 15:54 ` [PATCH RESEND 28/30] KVM: SVM: implement force_intercept_exceptions_mask Maxim Levitsky
2022-02-07 15:54 ` [PATCH RESEND 29/30] KVM: VMX: " Maxim Levitsky
2022-02-07 15:54 ` [PATCH RESEND 30/30] KVM: x86: get rid of KVM_REQ_GET_NESTED_STATE_PAGES Maxim Levitsky
2022-02-08 12:02 ` [PATCH RESEND 00/30] My patch queue Paolo Bonzini
2022-02-08 12:45   ` Maxim Levitsky

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220207155447.840194-4-mlevitsk@redhat.com \
    --to=mlevitsk@redhat.com \
    --cc=airlied@linux.ie \
    --cc=bp@alien8.de \
    --cc=brijesh.singh@amd.com \
    --cc=chang.seok.bae@intel.com \
    --cc=daniel@ffwll.ch \
    --cc=dave.hansen@linux.intel.com \
    --cc=hpa@zytor.com \
    --cc=intel-gvt-dev@lists.freedesktop.org \
    --cc=jani.nikula@linux.intel.com \
    --cc=jmattson@google.com \
    --cc=joonas.lahtinen@linux.intel.com \
    --cc=joro@8bytes.org \
    --cc=kan.liang@linux.intel.com \
    --cc=kvm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mingo@redhat.com \
    --cc=pawan.kumar.gupta@linux.intel.com \
    --cc=pbonzini@redhat.com \
    --cc=rodrigo.vivi@intel.com \
    --cc=seanjc@google.com \
    --cc=stable@vger.kernel.org \
    --cc=tglx@linutronix.de \
    --cc=tony.luck@intel.com \
    --cc=vkuznets@redhat.com \
    --cc=wanpengli@tencent.com \
    --cc=x86@kernel.org \
    --cc=zhenyuw@linux.intel.com \
    --cc=zhi.a.wang@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox