diff options
| author | Paolo Bonzini <pbonzini@redhat.com> | 2022-11-17 11:50:23 -0500 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2022-11-17 11:51:09 -0500 |
| commit | 771a579c6e74f305eff97752d91e9b05c4e46323 (patch) | |
| tree | e291aeae462e3aed281e2b909bfd765a6801522e /tools/testing/selftests/kvm/.gitignore | |
| parent | eb298605705a5c6b3d61c754e3c80ac8ef8e8724 (diff) | |
| parent | 05311ce954aebe75935d9ae7d38ac82b5b796e33 (diff) | |
Merge branch 'kvm-svm-harden' into HEAD
This fixes three issues in nested SVM:
1) in the shutdown_interception() vmexit handler we call kvm_vcpu_reset().
However, if running nested and L1 doesn't intercept shutdown, the function
resets vcpu->arch.hflags without properly leaving the nested state.
This leaves the vCPU in inconsistent state and later triggers a kernel
panic in SVM code. The same bug can likely be triggered by sending INIT
via local apic to a vCPU which runs a nested guest.
On VMX we are lucky that the issue can't happen because VMX always
intercepts triple faults, thus triple fault in L2 will always be
redirected to L1. Plus, handle_triple_fault() doesn't reset the vCPU.
INIT IPI can't happen on VMX either because INIT events are masked while
in VMX mode.
Secondarily, KVM doesn't honour SHUTDOWN intercept bit of L1 on SVM.
A normal hypervisor should always intercept SHUTDOWN, a unit test on
the other hand might want to not do so.
Finally, the guest can trigger a kernel non rate limited printk on SVM
from the guest, which is fixed as well.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'tools/testing/selftests/kvm/.gitignore')
| -rw-r--r-- | tools/testing/selftests/kvm/.gitignore | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/tools/testing/selftests/kvm/.gitignore b/tools/testing/selftests/kvm/.gitignore index bef984e4c39d..582e2e198fbf 100644 --- a/tools/testing/selftests/kvm/.gitignore +++ b/tools/testing/selftests/kvm/.gitignore @@ -42,6 +42,7 @@ /x86_64/svm_vmcall_test /x86_64/svm_int_ctl_test /x86_64/svm_nested_soft_inject_test +/x86_64/svm_nested_shutdown_test /x86_64/sync_regs_test /x86_64/tsc_msrs_test /x86_64/tsc_scaling_sync |