Re: [PATCH 2/2] x86/vmx: Disallow the use of inactivity states

[Tamas K Lengyel <tamas@xxxxxxxxxxxxx>]

On Wed, Nov 1, 2023 at 3:21 PM Andrew Cooper <andrew.cooper3@xxxxxxxxxx> wrote:
>
> Right now, vvmx will blindly copy L12's ACTIVITY_STATE into the L02 VMCS and
> enter the vCPU.  Luckily for us, nested-virt is explicitly unsupported for
> security bugs.
>
> The inactivity states are HLT, SHUTDOWN and WAIT-FOR-SIPI, and as noted by the
> SDM in Vol3 27.7 "Special Features of VM Entry":
>
>   If VM entry ends with the logical processor in an inactive activity state,
>   the VM entry generates any special bus cycle that is normally generated when
>   that activity state is entered from the active state.
>
> Also,
>
>   Some activity states unconditionally block certain events.
>
> I.e. A VMEntry with ACTIVITY=SHUTDOWN will initiate a platform reset, while a
> VMEntry with ACTIVITY=WAIT-FOR-SIPI will really block everything other than
> SIPIs.
>
> Both of these activity states are for the TXT ACM to use, not for regular
> hypervisors, and Xen doesn't support dropping the HLT intercept either.
>
> There are two paths in Xen which operate on ACTIVITY_STATE.
>
> 1) The vmx_{get,set}_nonreg_state() helpers for VM-Fork.
>
>    As regular VMs can't use any inactivity states, this is just duplicating
>    the 0 from construct_vmcs().  Drop the field, leaving a comment as to why
>    it is skipped.

I would like to keep the vmx_get_nonreg_state() function being able to
gather this field as it might be an interesting piece of data we want
to keep an eye on during fuzzing. I would prefer just sanitizing the
value in the set() function with perhaps a gdprintk message that it
happened?

Tamas