Re: [Question] some questions about vmx

Re: [Question] some questions about vmx

[linmiaohe]

Hi:
Vitaly Kuznetsov <vkuznets@redhat.com> writes:
>linmiaohe <linmiaohe@huawei.com> writes:
>
>> About nWMX.
>> When nested_vmx_handle_enlightened_vmptrld() return 0, it do not 
>> inject any exception or set rflags to Indicate VMLAUNCH instruction 
>> failed and skip this instruction. This would cause nested_vmx_run() 
>
>Yes, it seems it can. 
>
>nested_vmx_handle_enlightened_vmptrld() has two possible places where it can fail:
>
>kvm_vcpu_map() -- meaning that the guest passed some invalid GPA.
>revision id check -- meaning that the supplied eVMCS is unsupported/garbage.
>
>I think the right behavior would be to nested_vmx_failInvalid() in both these cases. We can also check what genuing Hyper-V does.
>

Many thanks for your reply. I think this would be a problem too. And would you like to fix this potential problem? I have no idea
how to fix this correctly... Thanks again.

Re: [Question] some questions about vmx

[Vitaly Kuznetsov]

linmiaohe <linmiaohe@huawei.com> writes:

> Hi:
> Vitaly Kuznetsov <vkuznets@redhat.com> writes:
>>linmiaohe <linmiaohe@huawei.com> writes:
>>
>>> About nWMX.
>>> When nested_vmx_handle_enlightened_vmptrld() return 0, it do not 
>>> inject any exception or set rflags to Indicate VMLAUNCH instruction 
>>> failed and skip this instruction. This would cause nested_vmx_run() 
>>
>>Yes, it seems it can. 
>>
>>nested_vmx_handle_enlightened_vmptrld() has two possible places where it can fail:
>>
>>kvm_vcpu_map() -- meaning that the guest passed some invalid GPA.
>>revision id check -- meaning that the supplied eVMCS is unsupported/garbage.
>>
>>I think the right behavior would be to nested_vmx_failInvalid() in both these cases. We can also check what genuing Hyper-V does.
>>
>
> Many thanks for your reply. I think this would be a problem too. And would you like to fix this potential problem? I have no idea
> how to fix this correctly...

Yes,

let me check what happens on Hyper-V and I'll send a patch. The problem
should not be that severe as it only affect misbehaving L1 hypervisors.

-- 
Vitaly

Re: [Question] some questions about vmx

[Vitaly Kuznetsov]

linmiaohe <linmiaohe@huawei.com> writes:

> About nWMX.
> When nested_vmx_handle_enlightened_vmptrld() return 0, it do not inject any exception or set rflags to
> Indicate VMLAUNCH instruction failed and skip this instruction. This would cause nested_vmx_run()
> return 1 and resume guest and retry this instruction. When the error causing nested_vmx_handle_enlightened_vmptrld()
> failed can't be handled, would deadloop ouucr ?

Yes, it seems it can. 

nested_vmx_handle_enlightened_vmptrld() has two possible places where it
can fail:

kvm_vcpu_map() -- meaning that the guest passed some invalid GPA.
revision id check -- meaning that the supplied eVMCS is
unsupported/garbage.

I think the right behavior would be to nested_vmx_failInvalid() in both
these cases. We can also check what genuing Hyper-V does.

-- 
Vitaly

[Question] some questions about vmx

[linmiaohe]

Hi all:
	I'am investigating the vmx code and encounter some questions. It's very nice of you if you can
help me fix these.

About wbinvd.
1. Which way (ctxt->ops->wbinvd)(ctxt) is called? If cpu_has_vmx_wbinvd_exit(), wbinvd instruction would
be handled by handle_wbinvd and instruction emulate is skipped...

2. What is the purpose of set local cpu into wbinvd_dirty_mask in kvm_emulate_wbinvd_noskip()? It seems
local cpu is ignored in smp_call_function_many(). And so local cpu wbinvd is missed ?

3. Commit (2eec73437487: KVM: x86: Avoid issuing wbinvd twice) said we may call wbinvd twice. Could you
please explain how it could execute it twice in detail ?

About nWMX.
When nested_vmx_handle_enlightened_vmptrld() return 0, it do not inject any exception or set rflags to
Indicate VMLAUNCH instruction failed and skip this instruction. This would cause nested_vmx_run()
return 1 and resume guest and retry this instruction. When the error causing nested_vmx_handle_enlightened_vmptrld()
failed can't be handled, would deadloop ouucr ?

About defer setting of CR2 (see commit (da998b46d244: kvm: x86: Defer setting of CR2 until #PF delivery))
How defer setting of CR2 until #PF delivery works? In inject_pending_event(), the payload of exception is loaded into
vmcs12' exit_qualification without setting CR2 via nested_vmx_check_exception() in kvm_x86_ops-> check_nested_events();
But CR2 is unconditionally set to exception.payload via vmx_queue_exception() before we enter L1.
So CR2 is modified before L1 hypervisor could intercept the fault.

Where's the wrong in my understand? Please help me figure it out. Any answer would be very appreciated.
Thanks in advance! ^_^

Best wishes!