mbox series

[v2,0/4] AVIC bugfixes and workarounds

Message ID 20230928173354.217464-1-mlevitsk@redhat.com
Headers
Series AVIC bugfixes and workarounds |

Message

Maxim Levitsky Sept. 28, 2023, 5:33 p.m. UTC 
  This patch series includes several fixes to AVIC I found while working
on a new version of nested AVIC code.

Also while developing it I realized that a very simple workaround for
AVIC's errata #1235 exists and included it in this patch series as well.

changes since v2:

- added 'fixes' tags
- reworked workaround for avic errata #1235
- dropped iommu patch as it is no longer needed.

Best regards,
        Maxim Levitsky

Maxim Levitsky (4):
  x86: KVM: SVM: always update the x2avic msr interception
  x86: KVM: SVM: add support for Invalid IPI Vector interception
  x86: KVM: SVM: refresh AVIC inhibition in svm_leave_nested()
  x86: KVM: SVM: workaround for AVIC's errata #1235

 arch/x86/include/asm/svm.h |  1 +
 arch/x86/kvm/svm/avic.c    | 68 +++++++++++++++++++++++++++-----------
 arch/x86/kvm/svm/nested.c  |  3 ++
 arch/x86/kvm/svm/svm.c     |  3 +-
 arch/x86/kvm/svm/svm.h     |  1 +
 5 files changed, 55 insertions(+), 21 deletions(-)

-- 
2.26.3

Comments

Sean Christopherson Sept. 29, 2023, 12:24 a.m. UTC | #1 
On Thu, Sep 28, 2023, Maxim Levitsky wrote:
> The following problem exists since x2avic was enabled in the KVM:
> 
> svm_set_x2apic_msr_interception is called to enable the interception of

Nit, svm_set_x2apic_msr_interception().

Definitely not worth another version though.

> the x2apic msrs.
> 
> In particular it is called at the moment the guest resets its apic.
> 
> Assuming that the guest's apic was in x2apic mode, the reset will bring
> it back to the xapic mode.
> 
> The svm_set_x2apic_msr_interception however has an erroneous check for
> '!apic_x2apic_mode()' which prevents it from doing anything in this case.
> 
> As a result of this, all x2apic msrs are left unintercepted, and that
> exposes the bare metal x2apic (if enabled) to the guest.
> Oops.
> 
> Remove the erroneous '!apic_x2apic_mode()' check to fix that.
> 
> This fixes CVE-2023-5090
> 
> Fixes: 4d1d7942e36a ("KVM: SVM: Introduce logic to (de)activate x2AVIC mode")
> Cc: stable@vger.kernel.org
> Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
> ---

Reviewed-by: Sean Christopherson <seanjc@google.com>
Sean Christopherson Sept. 29, 2023, 2:09 a.m. UTC | #2 
On Thu, Sep 28, 2023, Maxim Levitsky wrote:
> Maxim Levitsky (4):
>   x86: KVM: SVM: always update the x2avic msr interception
>   x86: KVM: SVM: add support for Invalid IPI Vector interception
>   x86: KVM: SVM: refresh AVIC inhibition in svm_leave_nested()

Paolo, I assume you'll take the first three directly for 6.6?

>   x86: KVM: SVM: workaround for AVIC's errata #1235
Paolo Bonzini Sept. 29, 2023, 5:42 p.m. UTC | #3 
On Fri, Sep 29, 2023 at 4:09 AM Sean Christopherson <seanjc@google.com> wrote:
>
> On Thu, Sep 28, 2023, Maxim Levitsky wrote:
> > Maxim Levitsky (4):
> >   x86: KVM: SVM: always update the x2avic msr interception
> >   x86: KVM: SVM: add support for Invalid IPI Vector interception
> >   x86: KVM: SVM: refresh AVIC inhibition in svm_leave_nested()
>
> Paolo, I assume you'll take the first three directly for 6.6?

Yes.

Paolo

> >   x86: KVM: SVM: workaround for AVIC's errata #1235
>
Paolo Bonzini Oct. 12, 2023, 2:46 p.m. UTC | #4 
Queued patches 1-3, thanks.

Paolo