From: Chao Gao <chao.gao@intel.com>
To: Maxim Levitsky <mlevitsk@redhat.com>
Cc: Sean Christopherson <seanjc@google.com>,
Zeng Guang <guang.zeng@intel.com>,
Paolo Bonzini <pbonzini@redhat.com>,
Vitaly Kuznetsov <vkuznets@redhat.com>,
Wanpeng Li <wanpengli@tencent.com>,
Jim Mattson <jmattson@google.com>, Joerg Roedel <joro@8bytes.org>,
kvm@vger.kernel.org, Dave Hansen <dave.hansen@linux.intel.com>,
Tony Luck <tony.luck@intel.com>,
Kan Liang <kan.liang@linux.intel.com>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
"H. Peter Anvin" <hpa@zytor.com>,
Kim Phillips <kim.phillips@amd.com>,
Jarkko Sakkinen <jarkko@kernel.org>,
Jethro Beekman <jethro@fortanix.com>,
Kai Huang <kai.huang@intel.com>,
x86@kernel.org, linux-kernel@vger.kernel.org,
Robert Hu <robert.hu@intel.com>
Subject: Re: [PATCH v8 6/9] KVM: x86: lapic: don't allow to change APIC ID unconditionally
Date: Tue, 26 Apr 2022 22:00:18 +0800 [thread overview]
Message-ID: <20220426140013.GA11796@gao-cwp> (raw)
In-Reply-To: <6475522c58aec5db3ee0a5ccd3230c63a2f013a9.camel@redhat.com>
>Palo, Sean, Any update?
>
>After thinking more about this, I actualy think I will do something
>different, something that actually was proposed here, and I was against it:
>
>
>1. I will add new inhibit APICV_INHIBIT_REASON_RO_SETTINGS, which will be set
>first time any vCPU touches apic id and/or apic base because why not...
>
>That will take care of non nested case cleanly, and will take care of IPIv
>for now (as long as it does't support nesting).
Yes. This works well with intel IPIv.
>
>2. For my nested AVIC, I will do 2 things:
>
> a. My code never reads L1 apic ids, and always uses vcpu_id, thus
> in theory, if I just ignore the problem, and the guest changes apic ids,
> the nested AVIC will just keep on using initial apic ids, thus there is no danger
> of CVE like issue if the guest tries to change theses ids in the 'right' time.
>
> b. on each nested vm entry I'll just check that apic id is not changed from the default,
> if AVIC is enabled for the nested guest.
>
> if so the nested entry will fail (best with kvm_vm_bugged) to get attention of
> the user, but I can just fail it with standard vm exit reason of 0xFFFFFFFF.
For sake of simplicity, I prefer to make APIC ID read-only for VMs that
supports (nested) AVIC or IPIv (KVM can check guest CPUID/MSR to know
this). When guest attempts to change read-only APIC ID, KVM can raise an
internal error, saying KVM cannot emulate this action. To get rid of such
an error, users should launch the VM with nested AVIC/IPIv disabled or
upgrade VM kernel to not change APIC ID.
next prev parent reply other threads:[~2022-04-26 14:00 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-04-11 9:04 [PATCH v8 0/9] IPI virtualization support for VM Zeng Guang
2022-04-11 9:04 ` [PATCH v8 1/9] x86/cpu: Add new VMX feature, Tertiary VM-Execution control Zeng Guang
2022-04-11 9:04 ` [PATCH v8 2/9] KVM: VMX: Extend BUILD_CONTROLS_SHADOW macro to support 64-bit variation Zeng Guang
2022-04-11 9:04 ` [PATCH v8 3/9] KVM: VMX: Detect Tertiary VM-Execution control when setup VMCS config Zeng Guang
2022-04-11 9:04 ` [PATCH v8 4/9] KVM: VMX: Report tertiary_exec_control field in dump_vmcs() Zeng Guang
2022-04-11 9:04 ` [PATCH v8 5/9] KVM: x86: Add support for vICR APIC-write VM-Exits in x2APIC mode Zeng Guang
2022-04-11 9:04 ` [PATCH v8 6/9] KVM: x86: lapic: don't allow to change APIC ID unconditionally Zeng Guang
2022-04-15 14:39 ` Sean Christopherson
2022-04-19 14:07 ` Maxim Levitsky
2022-04-26 8:14 ` Maxim Levitsky
2022-04-26 14:00 ` Chao Gao [this message]
2022-04-11 9:04 ` [PATCH v8 7/9] KVM: Move kvm_arch_vcpu_precreate() under kvm->lock Zeng Guang
2022-04-15 15:00 ` Sean Christopherson
2022-04-15 15:11 ` Sean Christopherson
2022-04-11 9:04 ` [PATCH v8 8/9] KVM: x86: Allow userspace set maximum VCPU id for VM Zeng Guang
2022-04-15 15:01 ` Sean Christopherson
2022-04-11 9:04 ` [PATCH v8 9/9] KVM: VMX: enable IPI virtualization Zeng Guang
2022-04-15 15:25 ` Sean Christopherson
2022-04-18 9:25 ` Chao Gao
2022-04-18 15:14 ` Sean Christopherson
2022-04-19 0:00 ` Chao Gao
2022-04-18 12:49 ` Zeng Guang
2022-04-15 15:45 ` Sean Christopherson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220426140013.GA11796@gao-cwp \
--to=chao.gao@intel.com \
--cc=bp@alien8.de \
--cc=dave.hansen@linux.intel.com \
--cc=guang.zeng@intel.com \
--cc=hpa@zytor.com \
--cc=jarkko@kernel.org \
--cc=jethro@fortanix.com \
--cc=jmattson@google.com \
--cc=joro@8bytes.org \
--cc=kai.huang@intel.com \
--cc=kan.liang@linux.intel.com \
--cc=kim.phillips@amd.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=mlevitsk@redhat.com \
--cc=pbonzini@redhat.com \
--cc=robert.hu@intel.com \
--cc=seanjc@google.com \
--cc=tglx@linutronix.de \
--cc=tony.luck@intel.com \
--cc=vkuznets@redhat.com \
--cc=wanpengli@tencent.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.