From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.0 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,NICE_REPLY_A,RCVD_ILLEGAL_IP, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6C628C388F2 for ; Tue, 3 Nov 2020 06:09:06 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 22201222EC for ; Tue, 3 Nov 2020 06:09:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727714AbgKCGJF (ORCPT ); Tue, 3 Nov 2020 01:09:05 -0500 Received: from mga02.intel.com ([134.134.136.20]:52366 "EHLO mga02.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725958AbgKCGJE (ORCPT ); Tue, 3 Nov 2020 01:09:04 -0500 IronPort-SDR: ggwdjie/9LDoMciHG+juR5HTGhOuf7bDPd2GmzyIonu+BBgVWJwz7Nxv5x/a/SQjaNQW4e7U6g oPSuzuAmrKwQ== X-IronPort-AV: E=McAfee;i="6000,8403,9793"; a="155992441" X-IronPort-AV: E=Sophos;i="5.77,447,1596524400"; d="scan'208";a="155992441" X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga004.fm.intel.com ([10.253.24.48]) by orsmga101.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 02 Nov 2020 22:09:03 -0800 IronPort-SDR: ibJSAcIICb1zvAAFmRkFWQJgwkG/GIRz518Zx/VvRMV+DBH0LeWqzjlwyhD8CIKyOq6pLpo9hn W7Uodn9f0c1w== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.77,447,1596524400"; d="scan'208";a="353093840" Received: from shzintpr01.sh.intel.com (HELO [0.0.0.0]) ([10.239.4.80]) by fmsmga004.fm.intel.com with ESMTP; 02 Nov 2020 22:09:00 -0800 Subject: Re: [PATCH] KVM: VMX: Enable Notify VM exit To: Andy Lutomirski Cc: Paolo Bonzini , "Christopherson, Sean J" , Vitaly Kuznetsov , Wanpeng Li , Jim Mattson , Joerg Roedel , Thomas Gleixner , Ingo Molnar , Borislav Petkov , "H. Peter Anvin" , X86 ML , kvm list , LKML , Xiaoyao Li References: <20201102061445.191638-1-tao3.xu@intel.com> From: Tao Xu Message-ID: Date: Tue, 3 Nov 2020 14:08:59 +0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 11/3/20 12:43 AM, Andy Lutomirski wrote: > On Sun, Nov 1, 2020 at 10:14 PM Tao Xu wrote: >> >> There are some cases that malicious virtual machines can cause CPU stuck >> (event windows don't open up), e.g., infinite loop in microcode when >> nested #AC (CVE-2015-5307). No event window obviously means no events, >> e.g. NMIs, SMIs, and IRQs will all be blocked, may cause the related >> hardware CPU can't be used by host or other VM. >> >> To resolve those cases, it can enable a notify VM exit if no >> event window occur in VMX non-root mode for a specified amount of >> time (notify window). >> >> Expose a module param for setting notify window, default setting it to >> the time as 1/10 of periodic tick, and user can set it to 0 to disable >> this feature. >> >> TODO: >> 1. The appropriate value of notify window. >> 2. Another patch to disable interception of #DB and #AC when notify >> VM-Exiting is enabled. > > Whoa there. > > A VM control that says "hey, CPU, if you messed up and livelocked for > a long time, please break out of the loop" is not a substitute for > fixing the livelocks. So I don't think you get do disable > interception of #DB and #AC. I also think you should print a loud > warning and have some intelligent handling when this new exit > triggers. > >> +static int handle_notify(struct kvm_vcpu *vcpu) >> +{ >> + unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION); >> + >> + /* >> + * Notify VM exit happened while executing iret from NMI, >> + * "blocked by NMI" bit has to be set before next VM entry. >> + */ >> + if (exit_qualification & NOTIFY_VM_CONTEXT_VALID) { >> + if (enable_vnmi && >> + (exit_qualification & INTR_INFO_UNBLOCK_NMI)) >> + vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO, >> + GUEST_INTR_STATE_NMI); > > This needs actual documentation in the SDM or at least ISE please. > Notify VM-Exit is defined in ISE, chapter 9.2: https://software.intel.com/content/dam/develop/external/us/en/documents/architecture-instruction-set-extensions-programming-reference.pdf I will add this information into commit message. Thank you for reminding me.