Those are two patches that fix SMM entries while nested guests
are active and either EPT or unrestricted guest mode is disabled
(EPT disables the later)
1. First patch makes sure that we don't run vmx_handle_exit_irqoff
when we emulate a handful of real mode smm instructions.
When in emulation mode, vmx exit reason is not updated,
and thus this function uses outdated values and crashes.
2. Second patch works around an incorrect restore of segment
registers upon entry to nested guest from SMM.
When entering the nested guest from SMM we enter real mode,
and from it straight to nested guest, and in particular
once we restore L2's CR0, enter_pmode is called which
'restores' the segment registers from real mode segment
cache.
Normally this isn't a problem since after we finish entering
the nested guest, we restore all its registers from SMRAM,
but for the brief period when L2's segment registers are not up to date,
we trip 'vmx_guest_state_valid' check for non unrestricted guest mode, even
though it will be later valid.
Note that I still am able to crash L1 by migrating a VM with a
nested guest running and smm load, on VMX.
This even happens with normal stock settings of ept=1,unrestricted_guest=1
and will soon be investigated.
Best regards,
Maxim Levitsky
Maxim Levitsky (2):
KVM: VMX: avoid running vmx_handle_exit_irqoff in case of emulation
VMX: nSVM: enter protected mode prior to returning to nested guest
from SMM
arch/x86/kvm/vmx/vmx.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--
2.26.3
