Re: [PATCH] KVM: VMX: Enable Notify VM exit

2020-11-02 Thread Xiaoyao Li
On 11/3/2020 2:08 PM, Tao Xu wrote: On 11/3/20 12:43 AM, Andy Lutomirski wrote: On Sun, Nov 1, 2020 at 10:14 PM Tao Xu wrote: ... +static int handle_notify(struct kvm_vcpu *vcpu) +{ +   unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION); + +   /* +    *

Re: [PATCH] KVM: VMX: Enable Notify VM exit

2020-11-02 Thread Xiaoyao Li
On 11/3/2020 2:25 AM, Paolo Bonzini wrote: On 02/11/20 19:01, Andy Lutomirski wrote: What's the point? Surely the kernel should reliably mitigate the flaw, and the kernel should decide how to do so. There is some slowdown in trapping #DB and #AC unconditionally. Though for these two cases

Re: [PATCH] KVM: VMX: Enable Notify VM exit

2020-11-02 Thread Xiaoyao Li
On 11/3/2020 2:12 PM, Tao Xu wrote: On 11/3/20 6:53 AM, Jim Mattson wrote: On Sun, Nov 1, 2020 at 10:14 PM Tao Xu wrote: There are some cases that malicious virtual machines can cause CPU stuck (event windows don't open up), e.g., infinite loop in microcode when nested #AC (CVE-2015-5307).

Re: [PATCH] KVM: VMX: Enable Notify VM exit

2020-11-02 Thread Tao Xu
On 11/3/20 6:53 AM, Jim Mattson wrote: On Sun, Nov 1, 2020 at 10:14 PM Tao Xu wrote: There are some cases that malicious virtual machines can cause CPU stuck (event windows don't open up), e.g., infinite loop in microcode when nested #AC (CVE-2015-5307). No event window obviously means no

Re: [PATCH] KVM: VMX: Enable Notify VM exit

2020-11-02 Thread Tao Xu
On 11/3/20 12:43 AM, Andy Lutomirski wrote: On Sun, Nov 1, 2020 at 10:14 PM Tao Xu wrote: There are some cases that malicious virtual machines can cause CPU stuck (event windows don't open up), e.g., infinite loop in microcode when nested #AC (CVE-2015-5307). No event window obviously

Re: [PATCH] KVM: VMX: Enable Notify VM exit

2020-11-02 Thread Tao Xu
On 11/3/20 1:32 AM, Sean Christopherson wrote: On Mon, Nov 02, 2020 at 02:14:45PM +0800, Tao Xu wrote: There are some cases that malicious virtual machines can cause CPU stuck (event windows don't open up), e.g., infinite loop in microcode when nested #AC (CVE-2015-5307). No event window

Re: [PATCH] KVM: VMX: Enable Notify VM exit

2020-11-02 Thread Tao Xu
On 11/3/20 1:31 AM, Sean Christopherson wrote: On Mon, Nov 02, 2020 at 08:43:30AM -0800, Andy Lutomirski wrote: On Sun, Nov 1, 2020 at 10:14 PM Tao Xu wrote: 2. Another patch to disable interception of #DB and #AC when notify VM-Exiting is enabled. Whoa there. A VM control that says

Re: [PATCH] KVM: VMX: Enable Notify VM exit

2020-11-02 Thread Jim Mattson
On Sun, Nov 1, 2020 at 10:14 PM Tao Xu wrote: > > There are some cases that malicious virtual machines can cause CPU stuck > (event windows don't open up), e.g., infinite loop in microcode when > nested #AC (CVE-2015-5307). No event window obviously means no events, > e.g. NMIs, SMIs, and IRQs

Re: [PATCH] KVM: VMX: Enable Notify VM exit

2020-11-02 Thread Sean Christopherson
On Mon, Nov 02, 2020 at 10:01:16AM -0800, Andy Lutomirski wrote: > On Mon, Nov 2, 2020 at 9:31 AM Sean Christopherson > wrote: > > > > On Mon, Nov 02, 2020 at 08:43:30AM -0800, Andy Lutomirski wrote: > > > On Sun, Nov 1, 2020 at 10:14 PM Tao Xu wrote: > > > > 2. Another patch to disable

Re: [PATCH] KVM: VMX: Enable Notify VM exit

2020-11-02 Thread Paolo Bonzini
On 02/11/20 19:01, Andy Lutomirski wrote: > What's the point? Surely the kernel should reliably mitigate the > flaw, and the kernel should decide how to do so. There is some slowdown in trapping #DB and #AC unconditionally. Though for these two cases nobody should care so I agree with keeping

Re: [PATCH] KVM: VMX: Enable Notify VM exit

2020-11-02 Thread Andy Lutomirski
On Mon, Nov 2, 2020 at 9:31 AM Sean Christopherson wrote: > > On Mon, Nov 02, 2020 at 08:43:30AM -0800, Andy Lutomirski wrote: > > On Sun, Nov 1, 2020 at 10:14 PM Tao Xu wrote: > > > 2. Another patch to disable interception of #DB and #AC when notify > > > VM-Exiting is enabled. > > > > Whoa

Re: [PATCH] KVM: VMX: Enable Notify VM exit

2020-11-02 Thread Sean Christopherson
On Mon, Nov 02, 2020 at 02:14:45PM +0800, Tao Xu wrote: > There are some cases that malicious virtual machines can cause CPU stuck > (event windows don't open up), e.g., infinite loop in microcode when > nested #AC (CVE-2015-5307). No event window obviously means no events, > e.g. NMIs, SMIs, and

Re: [PATCH] KVM: VMX: Enable Notify VM exit

2020-11-02 Thread Sean Christopherson
On Mon, Nov 02, 2020 at 08:43:30AM -0800, Andy Lutomirski wrote: > On Sun, Nov 1, 2020 at 10:14 PM Tao Xu wrote: > > 2. Another patch to disable interception of #DB and #AC when notify > > VM-Exiting is enabled. > > Whoa there. > > A VM control that says "hey, CPU, if you messed up and

Re: [PATCH] KVM: VMX: Enable Notify VM exit

2020-11-02 Thread Andy Lutomirski
On Sun, Nov 1, 2020 at 10:14 PM Tao Xu wrote: > > There are some cases that malicious virtual machines can cause CPU stuck > (event windows don't open up), e.g., infinite loop in microcode when > nested #AC (CVE-2015-5307). No event window obviously means no events, > e.g. NMIs, SMIs, and IRQs

[PATCH] KVM: VMX: Enable Notify VM exit

2020-11-01 Thread Tao Xu
There are some cases that malicious virtual machines can cause CPU stuck (event windows don't open up), e.g., infinite loop in microcode when nested #AC (CVE-2015-5307). No event window obviously means no events, e.g. NMIs, SMIs, and IRQs will all be blocked, may cause the related hardware CPU