All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sean Christopherson <seanjc@google.com>
To: Zeng Guang <guang.zeng@intel.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>,
	Vitaly Kuznetsov <vkuznets@redhat.com>,
	Wanpeng Li <wanpengli@tencent.com>,
	Jim Mattson <jmattson@google.com>, Joerg Roedel <joro@8bytes.org>,
	kvm@vger.kernel.org, Dave Hansen <dave.hansen@linux.intel.com>,
	Tony Luck <tony.luck@intel.com>,
	Kan Liang <kan.liang@linux.intel.com>,
	Thomas Gleixner <tglx@linutronix.de>,
	Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
	"H. Peter Anvin" <hpa@zytor.com>,
	Kim Phillips <kim.phillips@amd.com>,
	Jarkko Sakkinen <jarkko@kernel.org>,
	Jethro Beekman <jethro@fortanix.com>,
	Kai Huang <kai.huang@intel.com>,
	x86@kernel.org, linux-kernel@vger.kernel.org,
	Robert Hu <robert.hu@intel.com>, Gao Chao <chao.gao@intel.com>
Subject: Re: [PATCH v8 9/9] KVM: VMX: enable IPI virtualization
Date: Fri, 15 Apr 2022 15:25:06 +0000	[thread overview]
Message-ID: <YlmOUtXgIdQcUTO1@google.com> (raw)
In-Reply-To: <20220411090447.5928-10-guang.zeng@intel.com>

On Mon, Apr 11, 2022, Zeng Guang wrote:
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index d1a39285deab..23fbf52f7bea 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -11180,11 +11180,15 @@ static int sync_regs(struct kvm_vcpu *vcpu)
>  
>  int kvm_arch_vcpu_precreate(struct kvm *kvm, unsigned int id)
>  {
> +	int ret = 0;
> +
>  	if (kvm_check_tsc_unstable() && atomic_read(&kvm->online_vcpus) != 0)
>  		pr_warn_once("kvm: SMP vm created on host with unstable TSC; "
>  			     "guest TSC will not be reliable\n");
>  
> -	return 0;
> +	if (kvm_x86_ops.alloc_ipiv_pid_table)
> +		ret = static_call(kvm_x86_alloc_ipiv_pid_table)(kvm);

Add a generic kvm_x86_ops.vcpu_precreate, no reason to make this so specific.
And use KVM_X86_OP_RET0 instead of KVM_X86_OP_OPTIONAL, then this can simply be

	return static_call(kvm_x86_vcpu_precreate);

That said, there's a flaw in my genius plan.

  1. KVM_CREATE_VM
  2. KVM_CAP_MAX_VCPU_ID, set max_vcpu_ids=1
  3. KVM_CREATE_VCPU, create IPIv table but ultimately fails
  4. KVM decrements created_vcpus back to '0'
  5. KVM_CAP_MAX_VCPU_ID, set max_vcpu_ids=4096
  6. KVM_CREATE_VCPU w/ ID out of range

In other words, malicious userspace could trigger buffer overflow.

That could be solved by adding an arch hook to undo precreate, but that's gross
and a good indication that we're trying to solve this the wrong way.

I think it's high time we add KVM_FINALIZE_VM, though that's probably a bad name
since e.g. TDX wants to use that name for VM really, really, being finalized[*],
i.e. after all vCPUs have been created.

KVM_POST_CREATE_VM?  That's not very good either.

Paolo or anyone else, thoughts?

[*] https://lore.kernel.org/all/83768bf0f786d24f49d9b698a45ba65441ef5ef0.1646422845.git.isaku.yamahata@intel.com

  reply	other threads:[~2022-04-15 15:25 UTC|newest]

Thread overview: 23+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-04-11  9:04 [PATCH v8 0/9] IPI virtualization support for VM Zeng Guang
2022-04-11  9:04 ` [PATCH v8 1/9] x86/cpu: Add new VMX feature, Tertiary VM-Execution control Zeng Guang
2022-04-11  9:04 ` [PATCH v8 2/9] KVM: VMX: Extend BUILD_CONTROLS_SHADOW macro to support 64-bit variation Zeng Guang
2022-04-11  9:04 ` [PATCH v8 3/9] KVM: VMX: Detect Tertiary VM-Execution control when setup VMCS config Zeng Guang
2022-04-11  9:04 ` [PATCH v8 4/9] KVM: VMX: Report tertiary_exec_control field in dump_vmcs() Zeng Guang
2022-04-11  9:04 ` [PATCH v8 5/9] KVM: x86: Add support for vICR APIC-write VM-Exits in x2APIC mode Zeng Guang
2022-04-11  9:04 ` [PATCH v8 6/9] KVM: x86: lapic: don't allow to change APIC ID unconditionally Zeng Guang
2022-04-15 14:39   ` Sean Christopherson
2022-04-19 14:07     ` Maxim Levitsky
2022-04-26  8:14       ` Maxim Levitsky
2022-04-26 14:00         ` Chao Gao
2022-04-11  9:04 ` [PATCH v8 7/9] KVM: Move kvm_arch_vcpu_precreate() under kvm->lock Zeng Guang
2022-04-15 15:00   ` Sean Christopherson
2022-04-15 15:11     ` Sean Christopherson
2022-04-11  9:04 ` [PATCH v8 8/9] KVM: x86: Allow userspace set maximum VCPU id for VM Zeng Guang
2022-04-15 15:01   ` Sean Christopherson
2022-04-11  9:04 ` [PATCH v8 9/9] KVM: VMX: enable IPI virtualization Zeng Guang
2022-04-15 15:25   ` Sean Christopherson [this message]
2022-04-18  9:25     ` Chao Gao
2022-04-18 15:14       ` Sean Christopherson
2022-04-19  0:00         ` Chao Gao
2022-04-18 12:49     ` Zeng Guang
2022-04-15 15:45   ` Sean Christopherson

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=YlmOUtXgIdQcUTO1@google.com \
    --to=seanjc@google.com \
    --cc=bp@alien8.de \
    --cc=chao.gao@intel.com \
    --cc=dave.hansen@linux.intel.com \
    --cc=guang.zeng@intel.com \
    --cc=hpa@zytor.com \
    --cc=jarkko@kernel.org \
    --cc=jethro@fortanix.com \
    --cc=jmattson@google.com \
    --cc=joro@8bytes.org \
    --cc=kai.huang@intel.com \
    --cc=kan.liang@linux.intel.com \
    --cc=kim.phillips@amd.com \
    --cc=kvm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mingo@redhat.com \
    --cc=pbonzini@redhat.com \
    --cc=robert.hu@intel.com \
    --cc=tglx@linutronix.de \
    --cc=tony.luck@intel.com \
    --cc=vkuznets@redhat.com \
    --cc=wanpengli@tencent.com \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.