From: "Maciej S. Szmigiero" <mail@maciej.szmigiero.name>
To: Paolo Bonzini <pbonzini@redhat.com>
Cc: Sean Christopherson <seanjc@google.com>,
Vitaly Kuznetsov <vkuznets@redhat.com>,
Wanpeng Li <wanpengli@tencent.com>,
Jim Mattson <jmattson@google.com>, Joerg Roedel <joro@8bytes.org>,
Tom Lendacky <thomas.lendacky@amd.com>,
Brijesh Singh <brijesh.singh@amd.com>,
Jon Grimm <Jon.Grimm@amd.com>,
David Kaplan <David.Kaplan@amd.com>,
Boris Ostrovsky <boris.ostrovsky@oracle.com>,
Liam Merwick <liam.merwick@oracle.com>,
kvm@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH 0/5] nSVM: L1 -> L2 event injection fixes and a self-test
Date: Thu, 10 Mar 2022 22:38:36 +0100 [thread overview]
Message-ID: <cover.1646944472.git.maciej.szmigiero@oracle.com> (raw)
From: "Maciej S. Szmigiero" <maciej.szmigiero@oracle.com>
There are some issues with respect to nSVM L1 -> L2 event injection.
First, the next_rip field of a VMCB is *not* an output-only field for a VMRUN.
This field value (instead of the saved guest RIP) in used by the CPU for
the return address pushed on stack when injecting a software interrupt or
INT3 or INTO exception (this was confirmed by AMD).
On a VMRUN that does event injection it has similar function as VMX's
VM_ENTRY_INSTRUCTION_LEN field, although, in contrast to VMX, it holds an
absolute RIP value, not a relative increment.
However, KVM seems to treat this field as a unidirectional hint from the CPU
to the hypervisor - there seems to be no specific effort to maintain this
field consistency for such VMRUN.
This is mostly visible with running a nested guest, with L1 trying to inject
an event into its L2.
In this case, we need to make sure the next_rip field gets synced from
vmcb12 to vmcb02.
Another issue is that pending L1 -> L2 events are forgotten if there is an
intervening L0 VMEXIT during their delivery.
We need to make sure they are remembered (including their desired next_rip
field value) until they are either re-injected into L2 successfully or
returned back to L1 in the EXITINTINFO field upon a nested VMEXIT.
A new KVM self-test that checks for the nSVM issues described above is
included in this patch series.
These issues are SVM-specific - all the use cases described above already
work correctly with VMX.
This patch set was tested with both Linux and Windows nested guests.
KVM: nSVM: Sync next_rip field from vmcb12 to vmcb02
KVM: SVM: Downgrade BUG_ON() to WARN_ON() in svm_inject_irq()
KVM: nSVM: Don't forget about L1-injected events
KVM: nSVM: Restore next_rip when doing L1 -> L2 event re-injection
KVM: selftests: nSVM: Add svm_nested_soft_inject_test
arch/x86/kvm/svm/nested.c | 69 +++++++-
arch/x86/kvm/svm/svm.c | 60 ++++++-
arch/x86/kvm/svm/svm.h | 48 ++++++
tools/testing/selftests/kvm/.gitignore | 1 +
tools/testing/selftests/kvm/Makefile | 1 +
.../selftests/kvm/include/x86_64/svm_util.h | 2 +
.../kvm/x86_64/svm_nested_soft_inject_test.c | 147 ++++++++++++++++++
7 files changed, 324 insertions(+), 4 deletions(-)
create mode 100644 tools/testing/selftests/kvm/x86_64/svm_nested_soft_inject_test.c
next reply other threads:[~2022-03-10 21:39 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-10 21:38 Maciej S. Szmigiero [this message]
2022-03-10 21:38 ` [PATCH 1/5] KVM: nSVM: Sync next_rip field from vmcb12 to vmcb02 Maciej S. Szmigiero
2022-04-01 18:32 ` Sean Christopherson
2022-04-01 19:08 ` Maciej S. Szmigiero
2022-04-01 21:51 ` Sean Christopherson
2022-04-04 9:50 ` Maxim Levitsky
2022-03-10 21:38 ` [PATCH 2/5] KVM: SVM: Downgrade BUG_ON() to WARN_ON() in svm_inject_irq() Maciej S. Szmigiero
2022-04-04 9:50 ` Maxim Levitsky
2022-03-10 21:38 ` [PATCH 3/5] KVM: nSVM: Don't forget about L1-injected events Maciej S. Szmigiero
2022-03-30 21:59 ` Sean Christopherson
2022-03-30 22:16 ` Maciej S. Szmigiero
2022-03-30 23:20 ` Sean Christopherson
2022-03-31 23:09 ` Maciej S. Szmigiero
2022-04-01 0:08 ` Sean Christopherson
2022-04-01 16:05 ` Maciej S. Szmigiero
2022-04-01 22:07 ` Sean Christopherson
2022-04-04 9:53 ` Maxim Levitsky
2022-04-04 21:05 ` Maciej S. Szmigiero
2022-03-10 21:38 ` [PATCH 4/5] KVM: nSVM: Restore next_rip when doing L1 -> L2 event re-injection Maciej S. Szmigiero
2022-03-10 21:38 ` [PATCH 5/5] KVM: selftests: nSVM: Add svm_nested_soft_inject_test Maciej S. Szmigiero
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cover.1646944472.git.maciej.szmigiero@oracle.com \
--to=mail@maciej.szmigiero.name \
--cc=David.Kaplan@amd.com \
--cc=Jon.Grimm@amd.com \
--cc=boris.ostrovsky@oracle.com \
--cc=brijesh.singh@amd.com \
--cc=jmattson@google.com \
--cc=joro@8bytes.org \
--cc=kvm@vger.kernel.org \
--cc=liam.merwick@oracle.com \
--cc=linux-kernel@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=seanjc@google.com \
--cc=thomas.lendacky@amd.com \
--cc=vkuznets@redhat.com \
--cc=wanpengli@tencent.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).