From: Maxim Levitsky <mlevitsk@redhat.com>
To: Paolo Bonzini <pbonzini@redhat.com>,
Vitaly Kuznetsov <vkuznets@redhat.com>,
kvm@vger.kernel.org
Cc: Sean Christopherson <seanjc@google.com>,
Wanpeng Li <wanpengli@tencent.com>,
Jim Mattson <jmattson@google.com>,
Cathy Avery <cavery@redhat.com>,
Emanuele Giuseppe Esposito <eesposit@redhat.com>,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH RFC] KVM: nSVM: Fix L1 state corruption upon return from SMM
Date: Wed, 23 Jun 2021 17:06:21 +0300 [thread overview]
Message-ID: <568fceb7f01d328f880af656bc79ead3eebdfc26.camel@redhat.com> (raw)
In-Reply-To: <01564b34-2476-2098-7ec8-47336922afda@redhat.com>
On Wed, 2021-06-23 at 15:21 +0200, Paolo Bonzini wrote:
> On 23/06/21 15:01, Maxim Levitsky wrote:
> > I did some homework on this now and I would like to share few my
> > thoughts on this:
> >
> > First of all my attention caught the way we intercept the #SMI
> > (this isn't 100% related to the bug but still worth talking about
> > IMHO)
> >
> > A. Bare metal: Looks like SVM allows to intercept SMI, with
> > SVM_EXIT_SMI,
> > with an intention of then entering the BIOS SMM handler manually
> > using the SMM_CTL msr.
>
> ... or just using STGI, which is what happens for KVM. This is in
> the
> manual: "The hypervisor may respond to the #VMEXIT(SMI) by executing
> the
> STGI instruction, which causes the pending SMI to be taken
> immediately".
Right, I didn't notice that, that makes sense.
Thanks for the explanation!
>
> It *should* work for KVM to just not intercept SMI, but it adds more
> complexity for no particular gain.
It would be nice to do so to increase testing coverage of running
a nested KVM. I'll add a hack for that in my nested kernel.
>
> > On bare metal we do set the INTERCEPT_SMI but we emulate the exit
> > as a nop.
> > I guess on bare metal there are some undocumented bits that BIOS
> > set which
> > make the CPU to ignore that SMI intercept and still take the #SMI
> > handler,
> > normally but I wonder if we could still break some motherboard
> > code due to that.
> >
> > B. Nested: If #SMI is intercepted, then it causes nested VMEXIT.
> > Since KVM does enable SMI intercept, when it runs nested it means
> > that all SMIs
> > that nested KVM gets are emulated as NOP, and L1's SMI handler is
> > not run.
>
> No, this is incorrect. Note that svm_check_nested_events does not
> clear
> smi_pending the way vmx_check_nested_events does it for nmi_pending.
> So
> the interrupt is still there and will be injected on the next STGI.
I din't check the code, but just assumed that same issue should be
present. Now it makes sense. I totally forgot about STGI.
Thanks,
Best regards,
Maxim Levitsky
>
> Paolo
>
> >
> > About the issue that was fixed in this patch. Let me try to
> > understand how
> > it would work on bare metal:
> >
> > 1. A guest is entered. Host state is saved to VM_HSAVE_PA area (or
> > stashed somewhere
> > in the CPU)
> >
> > 2. #SMI (without intercept) happens
> >
> > 3. CPU has to exit SVM, and start running the host SMI handler, it
> > loads the SMM
> > state without touching the VM_HSAVE_PA runs the SMI handler,
> > then once it RSMs,
> > it restores the guest state from SMM area and continues the
> > guest
> >
> > 4. Once a normal VMexit happens, the host state is restored from
> > VM_HSAVE_PA
> >
> > So host state indeed can't be saved to VMC01.
> >
> > I to be honest think would prefer not to use the L1's hsave area
> > but rather add back our
> > 'hsave' in KVM and store there the L1 host state on the nested
> > entry always.
> >
> > This way we will avoid touching the vmcb01 at all and both solve
> > the issue and
> > reduce code complexity.
> > (copying of L1 host state to what basically is L1 guest state area
> > and back
> > even has a comment to explain why it (was) possible to do so.
> > (before you discovered that this doesn't work with SMM).
> >
> > Thanks again for fixing this bug!
> >
> > Best regards,
> > Maxim Levitsky
> >
>
prev parent reply other threads:[~2021-06-23 14:06 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-23 7:44 [PATCH RFC] KVM: nSVM: Fix L1 state corruption upon return from SMM Vitaly Kuznetsov
2021-06-23 9:39 ` Paolo Bonzini
2021-06-23 11:39 ` Maxim Levitsky
2021-06-23 12:00 ` Paolo Bonzini
2021-06-23 13:01 ` Maxim Levitsky
2021-06-23 13:07 ` Maxim Levitsky
2021-06-23 13:32 ` Vitaly Kuznetsov
2021-06-23 14:41 ` Maxim Levitsky
2021-06-23 16:10 ` Sean Christopherson
2021-06-23 16:21 ` Sean Christopherson
2021-06-23 20:37 ` Paolo Bonzini
2021-06-24 7:41 ` Vitaly Kuznetsov
2021-06-24 8:20 ` Maxim Levitsky
2021-06-24 10:38 ` Paolo Bonzini
2021-06-24 14:32 ` Tom Lendacky
2021-06-24 15:36 ` Maxim Levitsky
2021-06-23 13:21 ` Paolo Bonzini
2021-06-23 14:06 ` Maxim Levitsky [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=568fceb7f01d328f880af656bc79ead3eebdfc26.camel@redhat.com \
--to=mlevitsk@redhat.com \
--cc=cavery@redhat.com \
--cc=eesposit@redhat.com \
--cc=jmattson@google.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=seanjc@google.com \
--cc=vkuznets@redhat.com \
--cc=wanpengli@tencent.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).