[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Qemu-commits] [qemu/qemu] 5746f7: i386/sev: Avoid SEV-ES crash due to m

From: Alex Bennée
Subject: [Qemu-commits] [qemu/qemu] 5746f7: i386/sev: Avoid SEV-ES crash due to missing MSR_EF...
Date: Thu, 07 Dec 2023 01:13:33 -0800

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: 5746f70d685be1e0156e6e7f0d4a1e9bdca2e2e8
  Author: Michael Roth <michael.roth@amd.com>
  Date:   2023-12-06 (Wed, 06 Dec 2023)

  Changed paths:
    M target/i386/kvm/kvm.c

  Log Message:
  i386/sev: Avoid SEV-ES crash due to missing MSR_EFER_LMA bit

Commit 7191f24c7fcf ("accel/kvm/kvm-all: Handle register access errors")
added error checking for KVM_SET_SREGS/KVM_SET_SREGS2. In doing so, it
exposed a long-running bug in current KVM support for SEV-ES where the
kernel assumes that MSR_EFER_LMA will be set explicitly by the guest
kernel, in which case EFER write traps would result in KVM eventually
seeing MSR_EFER_LMA get set and recording it in such a way that it would
be subsequently visible when accessing it via KVM_GET_SREGS/etc.

However, guest kernels currently rely on MSR_EFER_LMA getting set
automatically when MSR_EFER_LME is set and paging is enabled via
CR0_PG_MASK. As a result, the EFER write traps don't actually expose the
MSR_EFER_LMA bit, even though it is set internally, and when QEMU
subsequently tries to pass this EFER value back to KVM via
KVM_SET_SREGS* it will fail various sanity checks and return -EINVAL,
which is now considered fatal due to the aforementioned QEMU commit.

This can be addressed by inferring the MSR_EFER_LMA bit being set when
paging is enabled and MSR_EFER_LME is set, and synthesizing it to ensure
the expected bits are all present in subsequent handling on the host

Ultimately, this handling will be implemented in the host kernel, but to
avoid breaking QEMU's SEV-ES support when using older host kernels, the
same handling can be done in QEMU just after fetching the register
values via KVM_GET_SREGS*. Implement that here.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Marcelo Tosatti <mtosatti@redhat.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Akihiko Odaki <akihiko.odaki@daynix.com>
Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
Cc: Lara Lazier <laramglazier@gmail.com>
Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
Cc: Maxim Levitsky <mlevitsk@redhat.com>
Cc:  <kvm@vger.kernel.org>
Fixes: 7191f24c7fcf ("accel/kvm/kvm-all: Handle register access errors")
Signed-off-by: Michael Roth <michael.roth@amd.com>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20231206155821.1194551-1-michael.roth@amd.com>

  Commit: 9c74490bff6c8886a922008d0c9ce6cae70dd17e
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   2023-12-06 (Wed, 06 Dec 2023)

  Changed paths:

  Log Message:
  Update version for v8.2.0-rc3 release

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Compare: https://github.com/qemu/qemu/compare/d451e32ce8e1...9c74490bff6c

reply via email to

[Prev in Thread] Current Thread [Next in Thread]