Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754430Ab3CKUYA (ORCPT ); Mon, 11 Mar 2013 16:24:00 -0400 Received: from mx1.redhat.com ([209.132.183.28]:25573 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753690Ab3CKUX7 (ORCPT ); Mon, 11 Mar 2013 16:23:59 -0400 Date: Mon, 11 Mar 2013 21:30:03 +0200 From: Gleb Natapov To: Jan Kiszka Cc: Paolo Bonzini , "linux-kernel@vger.kernel.org" , "kvm@vger.kernel.org" , "mtosatti@redhat.com" Subject: Re: [PATCH] x86: kvm: reset the bootstrap processor when it gets an INIT Message-ID: <20130311193003.GC14689@redhat.com> References: <20130311172342.GS31619@redhat.com> <513E158B.80506@siemens.com> <20130311174155.GU31619@redhat.com> <513E1CFC.6010201@siemens.com> <20130311181306.GW31619@redhat.com> <513E2220.2090501@siemens.com> <20130311183915.GA14689@redhat.com> <513E26A7.4020405@siemens.com> <20130311185132.GB14689@redhat.com> <513E2A0A.3080008@siemens.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <513E2A0A.3080008@siemens.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1411 Lines: 34 On Mon, Mar 11, 2013 at 08:01:30PM +0100, Jan Kiszka wrote: > On 2013-03-11 19:51, Gleb Natapov wrote: > >>> On Intel: > >>> CPU 1 CPU 2 in a guest mode > >>> send INIT > >>> send SIPI > >>> INIT vmexit > >>> vmxoff > >>> reset and start from SIPI vector > >> > >> Is SIPI sticky as well, even if the CPU is not in the wait-for-SIPI > >> state (but runnable and in vmxon) while receiving it? > >> > > That what they seams to be saying: > > However, an INIT and SIPI interrupts sent to a CPU during time when > > it is in a VMX mode are remembered and delivered, perhaps hours later, > > when the CPU exits the VMX mode > > > > Otherwise their exploit will not work. > > Very weird, specifically as SIPI is not just a binary event but carries > payload. Will another SIPI event overwrite the previously "saved" > vector? We are deep into an underspecified area... My guess is that VMX INIT blocking is done by the same mechanism as INIT blocking during SMM. Obviously after exit from SMM pending INIT/SIPI have to be processed. -- Gleb. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/