From: Vitaly Kuznetsov <vkuznets@redhat.com>
To: Sean Christopherson <seanjc@google.com>
Cc: kvm@vger.kernel.org, "David Hildenbrand" <david@redhat.com>,
"Atish Patra" <atishp@atishpatra.org>,
linux-kernel@vger.kernel.org, "Kai Huang" <kai.huang@intel.com>,
linux-riscv@lists.infradead.org,
"Claudio Imbrenda" <imbrenda@linux.ibm.com>,
kvmarm@lists.cs.columbia.edu, linux-s390@vger.kernel.org,
"Janosch Frank" <frankja@linux.ibm.com>,
"Huacai Chen" <chenhuacai@kernel.org>,
"Aleksandar Markovic" <aleksandar.qemu.devel@gmail.com>,
"Palmer Dabbelt" <palmer@dabbelt.com>,
"Christian Borntraeger" <borntraeger@linux.ibm.com>,
"David Woodhouse" <dwmw2@infradead.org>,
"Matthew Rosato" <mjrosato@linux.ibm.com>,
"Chao Gao" <chao.gao@intel.com>,
"Eric Farman" <farman@linux.ibm.com>,
"Albert Ou" <aou@eecs.berkeley.edu>,
"Suzuki K Poulose" <suzuki.poulose@arm.com>,
"Sean Christopherson" <seanjc@google.com>,
"Paul Durrant" <paul@xen.org>,
"Paul Walmsley" <paul.walmsley@sifive.com>,
"Yuan Yao" <yuan.yao@intel.com>,
kvmarm@lists.linux.dev, "Thomas Gleixner" <tglx@linutronix.de>,
"Alexandru Elisei" <alexandru.elisei@arm.com>
Subject: Re: [PATCH v2 10/50] KVM: VMX: Reset eVMCS controls in VP assist page during hardware disabling
Date: Thu, 01 Dec 2022 16:42:58 +0100 [thread overview]
Message-ID: <87h6yff7ul.fsf@ovpn-194-141.brq.redhat.com> (raw)
In-Reply-To: <20221130230934.1014142-11-seanjc@google.com>
Sean Christopherson <seanjc@google.com> writes:
> Reset the eVMCS controls in the per-CPU VP assist page during hardware
> disabling instead of waiting until kvm-intel's module exit. The controls
> are activated if and only if KVM creates a VM, i.e. don't need to be
> reset if hardware is never enabled.
>
> Doing the reset during hardware disabling will naturally fix a potential
> NULL pointer deref bug once KVM disables CPU hotplug while enabling and
> disabling hardware (which is necessary to fix a variety of bugs). If the
> kernel is running as the root partition, the VP assist page is unmapped
> during CPU hot unplug, and so KVM's clearing of the eVMCS controls needs
> to occur with CPU hot(un)plug disabled, otherwise KVM could attempt to
> write to a CPU's VP assist page after it's unmapped.
>
> Reported-by: Vitaly Kuznetsov <vkuznets@redhat.com>
> Signed-off-by: Sean Christopherson <seanjc@google.com>
> ---
> arch/x86/kvm/vmx/vmx.c | 50 +++++++++++++++++++++++++-----------------
> 1 file changed, 30 insertions(+), 20 deletions(-)
>
> diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
> index cea8c07f5229..d85d175dca70 100644
> --- a/arch/x86/kvm/vmx/vmx.c
> +++ b/arch/x86/kvm/vmx/vmx.c
> @@ -551,6 +551,33 @@ static int hv_enable_l2_tlb_flush(struct kvm_vcpu *vcpu)
> return 0;
> }
>
> +static void hv_reset_evmcs(void)
> +{
> + struct hv_vp_assist_page *vp_ap;
> +
> + if (!static_branch_unlikely(&enable_evmcs))
> + return;
> +
> + /*
> + * KVM should enable eVMCS if and only if all CPUs have a VP assist
> + * page, and should reject CPU onlining if eVMCS is enabled the CPU
> + * doesn't have a VP assist page allocated.
> + */
> + vp_ap = hv_get_vp_assist_page(smp_processor_id());
> + if (WARN_ON_ONCE(!vp_ap))
> + return;
> +
In case my understanding is correct, this may actually get triggered
for Hyper-V root partition: vmx_hardware_disable() gets called from
kvm_dying_cpu() which has its own CPUHP_AP_KVM_STARTING stage. VP page
unmapping happens in hv_cpu_die() which uses generic CPUHP_AP_ONLINE_DYN
(happens first on CPU oflining AFAIR). I believe we need to introduce a
new CPUHP_AP_HYPERV_STARTING stage and put it before
CPUHP_AP_KVM_STARTING so it happens after it upon offlining.
The issue is likely theoretical as Hyper-V root partition is a very
special case, I'm not sure whether KVM is used there and whether CPU
offlining is possible. In any case, WARN_ON_ONCE() is much better than
NULL pointer dereference we have now :-)
> + /*
> + * Reset everything to support using non-enlightened VMCS access later
> + * (e.g. when we reload the module with enlightened_vmcs=0)
> + */
> + vp_ap->nested_control.features.directhypercall = 0;
> + vp_ap->current_nested_vmcs = 0;
> + vp_ap->enlighten_vmentry = 0;
> +}
> +
> +#else /* IS_ENABLED(CONFIG_HYPERV) */
> +static void hv_reset_evmcs(void) {}
> #endif /* IS_ENABLED(CONFIG_HYPERV) */
>
> /*
> @@ -2496,6 +2523,8 @@ static void vmx_hardware_disable(void)
> if (cpu_vmxoff())
> kvm_spurious_fault();
>
> + hv_reset_evmcs();
> +
> intel_pt_handle_vmx(0);
> }
>
> @@ -8462,27 +8491,8 @@ static void vmx_exit(void)
> kvm_exit();
>
> #if IS_ENABLED(CONFIG_HYPERV)
> - if (static_branch_unlikely(&enable_evmcs)) {
> - int cpu;
> - struct hv_vp_assist_page *vp_ap;
> - /*
> - * Reset everything to support using non-enlightened VMCS
> - * access later (e.g. when we reload the module with
> - * enlightened_vmcs=0)
> - */
> - for_each_online_cpu(cpu) {
> - vp_ap = hv_get_vp_assist_page(cpu);
> -
> - if (!vp_ap)
> - continue;
> -
> - vp_ap->nested_control.features.directhypercall = 0;
> - vp_ap->current_nested_vmcs = 0;
> - vp_ap->enlighten_vmentry = 0;
> - }
> -
> + if (static_branch_unlikely(&enable_evmcs))
> static_branch_disable(&enable_evmcs);
> - }
> #endif
> vmx_cleanup_l1d_flush();
Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com>
--
Vitaly
next prev parent reply other threads:[~2022-12-01 15:44 UTC|newest]
Thread overview: 77+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-30 23:08 [PATCH v2 00/50] KVM: Rework kvm_init() and hardware enabling Sean Christopherson
2022-11-30 23:08 ` [PATCH v2 01/50] KVM: Register /dev/kvm as the _very_ last thing during initialization Sean Christopherson
2022-11-30 23:08 ` [PATCH v2 02/50] KVM: Initialize IRQ FD after arch hardware setup Sean Christopherson
2022-11-30 23:08 ` [PATCH v2 03/50] KVM: Allocate cpus_hardware_enabled " Sean Christopherson
2022-11-30 23:08 ` [PATCH v2 04/50] KVM: Teardown VFIO ops earlier in kvm_exit() Sean Christopherson
2022-11-30 23:08 ` [PATCH v2 05/50] KVM: s390: Unwind kvm_arch_init() piece-by-piece() if a step fails Sean Christopherson
2022-11-30 23:08 ` [PATCH v2 06/50] KVM: s390: Move hardware setup/unsetup to init/exit Sean Christopherson
2022-11-30 23:08 ` [PATCH v2 07/50] KVM: x86: Do timer initialization after XCR0 configuration Sean Christopherson
2022-11-30 23:08 ` [PATCH v2 08/50] KVM: x86: Move hardware setup/unsetup to init/exit Sean Christopherson
2022-11-30 23:08 ` [PATCH v2 09/50] KVM: Drop arch hardware (un)setup hooks Sean Christopherson
2022-11-30 23:08 ` [PATCH v2 10/50] KVM: VMX: Reset eVMCS controls in VP assist page during hardware disabling Sean Christopherson
2022-12-01 15:42 ` Vitaly Kuznetsov [this message]
2022-11-30 23:08 ` [PATCH v2 11/50] KVM: VMX: Don't bother disabling eVMCS static key on module exit Sean Christopherson
2022-11-30 23:08 ` [PATCH v2 12/50] KVM: VMX: Move Hyper-V eVMCS initialization to helper Sean Christopherson
2022-12-01 15:22 ` Vitaly Kuznetsov
2022-11-30 23:08 ` [PATCH v2 13/50] KVM: x86: Move guts of kvm_arch_init() to standalone helper Sean Christopherson
2022-11-30 23:08 ` [PATCH v2 14/50] KVM: VMX: Do _all_ initialization before exposing /dev/kvm to userspace Sean Christopherson
2022-11-30 23:08 ` [PATCH v2 15/50] KVM: x86: Serialize vendor module initialization (hardware setup) Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 16/50] KVM: arm64: Simplify the CPUHP logic Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 17/50] KVM: arm64: Free hypervisor allocations if vector slot init fails Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 18/50] KVM: arm64: Unregister perf callbacks if hypervisor finalization fails Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 19/50] KVM: arm64: Do arm/arch initialization without bouncing through kvm_init() Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 20/50] KVM: arm64: Mark kvm_arm_init() and its unique descendants as __init Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 21/50] KVM: MIPS: Hardcode callbacks to hardware virtualization extensions Sean Christopherson
2022-12-01 22:00 ` Philippe Mathieu-Daudé
2022-12-01 22:49 ` Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 22/50] KVM: MIPS: Setup VZ emulation? directly from kvm_mips_init() Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 23/50] KVM: MIPS: Register die notifier prior to kvm_init() Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 24/50] KVM: RISC-V: Do arch init directly in riscv_kvm_init() Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 25/50] KVM: RISC-V: Tag init functions and data with __init, __ro_after_init Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 26/50] KVM: PPC: Move processor compatibility check to module init Sean Christopherson
2022-12-01 5:21 ` Michael Ellerman
2022-12-01 16:38 ` Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 27/50] KVM: s390: Do s390 specific init without bouncing through kvm_init() Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 28/50] KVM: s390: Mark __kvm_s390_init() and its descendants as __init Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 29/50] KVM: Drop kvm_arch_{init,exit}() hooks Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 30/50] KVM: VMX: Make VMCS configuration/capabilities structs read-only after init Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 31/50] KVM: x86: Do CPU compatibility checks in x86 code Sean Christopherson
2022-12-02 12:16 ` Huang, Kai
2022-12-05 20:52 ` Isaku Yamahata
2022-12-05 21:12 ` Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 32/50] KVM: Drop kvm_arch_check_processor_compat() hook Sean Christopherson
2022-12-02 12:18 ` Huang, Kai
2022-11-30 23:09 ` [PATCH v2 33/50] KVM: x86: Use KBUILD_MODNAME to specify vendor module name Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 34/50] KVM: x86: Unify pr_fmt to use module name for all KVM modules Sean Christopherson
2022-12-01 10:43 ` Paul Durrant
2022-11-30 23:09 ` [PATCH v2 35/50] KVM: VMX: Use current CPU's info to perform "disabled by BIOS?" checks Sean Christopherson
2022-12-02 12:18 ` Huang, Kai
2022-11-30 23:09 ` [PATCH v2 36/50] KVM: x86: Do VMX/SVM support checks directly in vendor code Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 37/50] KVM: VMX: Shuffle support checks and hardware enabling code around Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 38/50] KVM: SVM: Check for SVM support in CPU compatibility checks Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 39/50] KVM: x86: Move CPU compat checks hook to kvm_x86_ops (from kvm_x86_init_ops) Sean Christopherson
2022-12-02 13:01 ` Huang, Kai
2022-12-05 21:04 ` Isaku Yamahata
2022-11-30 23:09 ` [PATCH v2 40/50] KVM: x86: Do compatibility checks when onlining CPU Sean Christopherson
2022-12-02 13:03 ` Huang, Kai
2022-12-02 13:36 ` Huang, Kai
2022-12-02 16:04 ` Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 41/50] KVM: Rename and move CPUHP_AP_KVM_STARTING to ONLINE section Sean Christopherson
2022-12-02 13:06 ` Huang, Kai
2022-12-02 16:08 ` Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 42/50] KVM: Disable CPU hotplug during hardware enabling/disabling Sean Christopherson
2022-12-02 12:59 ` Huang, Kai
2022-12-02 16:31 ` Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 43/50] KVM: Ensure CPU is stable during low level hardware enable/disable Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 44/50] KVM: Drop kvm_count_lock and instead protect kvm_usage_count with kvm_lock Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 45/50] KVM: Remove on_each_cpu(hardware_disable_nolock) in kvm_exit() Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 46/50] KVM: Use a per-CPU variable to track which CPUs have enabled virtualization Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 47/50] KVM: Make hardware_enable_failed a local variable in the "enable all" path Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 48/50] KVM: Register syscore (suspend/resume) ops early in kvm_init() Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 49/50] KVM: Opt out of generic hardware enabling on s390 and PPC Sean Christopherson
2022-11-30 23:09 ` [PATCH v2 50/50] KVM: Clean up error labels in kvm_init() Sean Christopherson
2022-12-02 8:02 ` [PATCH v2 00/50] KVM: Rework kvm_init() and hardware enabling Chao Gao
2022-12-27 13:02 ` Paolo Bonzini
2022-12-28 11:22 ` Marc Zyngier
2022-12-28 11:58 ` Paolo Bonzini
2022-12-29 20:52 ` Paolo Bonzini
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87h6yff7ul.fsf@ovpn-194-141.brq.redhat.com \
--to=vkuznets@redhat.com \
--cc=aleksandar.qemu.devel@gmail.com \
--cc=alexandru.elisei@arm.com \
--cc=aou@eecs.berkeley.edu \
--cc=atishp@atishpatra.org \
--cc=borntraeger@linux.ibm.com \
--cc=chao.gao@intel.com \
--cc=chenhuacai@kernel.org \
--cc=david@redhat.com \
--cc=dwmw2@infradead.org \
--cc=farman@linux.ibm.com \
--cc=frankja@linux.ibm.com \
--cc=imbrenda@linux.ibm.com \
--cc=kai.huang@intel.com \
--cc=kvm@vger.kernel.org \
--cc=kvmarm@lists.cs.columbia.edu \
--cc=kvmarm@lists.linux.dev \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-riscv@lists.infradead.org \
--cc=linux-s390@vger.kernel.org \
--cc=mjrosato@linux.ibm.com \
--cc=palmer@dabbelt.com \
--cc=paul.walmsley@sifive.com \
--cc=paul@xen.org \
--cc=seanjc@google.com \
--cc=suzuki.poulose@arm.com \
--cc=tglx@linutronix.de \
--cc=yuan.yao@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).