Re: x86_64 INIT/SIPI Bug

[Sean Christopherson]

On Fri, Nov 09, 2018 at 11:04:59AM -0700, Rian Quinn wrote:
> >> I apologize upfront if this is the wrong place to post this, pretty new to this.
> >>
> >> We are working on the Bareflank Hypervisor (www.bareflank.org), and we
> >> are passing through the INIT/SIPI process (similar to how a VMX
> >> rootkit from EFI might boot the OS) and we noticed that on Arch Linux,
> >> the INIT/SIPI process stalls, something we are not seeing on Ubuntu.
> >
> > I'm confused, INIT is blocked post-VMXON, what are you passing through?
> 
> You are correct that INIT will track unconditionally, but all we do is set the
> activity state to wait-for-sipi and return back, allowing Linux to continue
> its boot process.

That's not pass-through, maybe call it reflection?  I realize I'm being
a bit pedantic, but differentiating between the two matters since true
pass-through gives you bare metal performance whereas reflection obviously
requires a round-trip VMX transition.

Most hypervisors don't need a delay because they don't pass-through the
local APIC and instead emulate INIT/SIPI/SIPI.  In other words, forcing
a delay for all hypervisors is unwarranted.

The correct fix is probably to add a new hook to struct x86_hyper_init
to provide a custom init delay, and add Bareflank as a new hypervisor.