* [PATCH] KVM: x86: Exit to userspace when kvm_check_nested_events fails
@ 2021-07-28 11:53 Paolo Bonzini
2021-07-28 12:39 ` Vitaly Kuznetsov
2021-07-28 16:24 ` Sean Christopherson
0 siblings, 2 replies; 6+ messages in thread
From: Paolo Bonzini @ 2021-07-28 11:53 UTC (permalink / raw)
To: linux-kernel, kvm; +Cc: Jim Mattson
From: Jim Mattson <jmattson@google.com>
If kvm_check_nested_events fails due to raising an
EXIT_REASON_INTERNAL_ERROR, propagate it to userspace
immediately, even if the vCPU would otherwise be sleeping.
This happens for example when the posted interrupt descriptor
points outside guest memory.
Reported-by: Jim Mattson <jmattson@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
arch/x86/kvm/x86.c | 22 +++++++++++++++-------
1 file changed, 15 insertions(+), 7 deletions(-)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 348452bb16bc..916c976e99ab 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -9752,10 +9752,14 @@ static inline int vcpu_block(struct kvm *kvm, struct kvm_vcpu *vcpu)
return 1;
}
-static inline bool kvm_vcpu_running(struct kvm_vcpu *vcpu)
+static inline int kvm_vcpu_running(struct kvm_vcpu *vcpu)
{
- if (is_guest_mode(vcpu))
- kvm_check_nested_events(vcpu);
+ int r;
+ if (is_guest_mode(vcpu)) {
+ r = kvm_check_nested_events(vcpu);
+ if (r < 0 && r != -EBUSY)
+ return r;
+ }
return (vcpu->arch.mp_state == KVM_MP_STATE_RUNNABLE &&
!vcpu->arch.apf.halted);
@@ -9770,12 +9774,16 @@ static int vcpu_run(struct kvm_vcpu *vcpu)
vcpu->arch.l1tf_flush_l1d = true;
for (;;) {
- if (kvm_vcpu_running(vcpu)) {
- r = vcpu_enter_guest(vcpu);
- } else {
- r = vcpu_block(kvm, vcpu);
+ r = kvm_vcpu_running(vcpu);
+ if (r < 0) {
+ r = 0;
+ break;
}
+ if (r)
+ r = vcpu_enter_guest(vcpu);
+ else
+ r = vcpu_block(kvm, vcpu);
if (r <= 0)
break;
--
2.27.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] KVM: x86: Exit to userspace when kvm_check_nested_events fails
2021-07-28 11:53 [PATCH] KVM: x86: Exit to userspace when kvm_check_nested_events fails Paolo Bonzini
@ 2021-07-28 12:39 ` Vitaly Kuznetsov
2021-07-28 15:55 ` Paolo Bonzini
2021-07-28 16:24 ` Sean Christopherson
1 sibling, 1 reply; 6+ messages in thread
From: Vitaly Kuznetsov @ 2021-07-28 12:39 UTC (permalink / raw)
To: Paolo Bonzini; +Cc: Jim Mattson, linux-kernel, kvm
Paolo Bonzini <pbonzini@redhat.com> writes:
> From: Jim Mattson <jmattson@google.com>
>
> If kvm_check_nested_events fails due to raising an
> EXIT_REASON_INTERNAL_ERROR, propagate it to userspace
> immediately, even if the vCPU would otherwise be sleeping.
> This happens for example when the posted interrupt descriptor
> points outside guest memory.
>
> Reported-by: Jim Mattson <jmattson@google.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
> arch/x86/kvm/x86.c | 22 +++++++++++++++-------
> 1 file changed, 15 insertions(+), 7 deletions(-)
>
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 348452bb16bc..916c976e99ab 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -9752,10 +9752,14 @@ static inline int vcpu_block(struct kvm *kvm, struct kvm_vcpu *vcpu)
> return 1;
> }
>
> -static inline bool kvm_vcpu_running(struct kvm_vcpu *vcpu)
> +static inline int kvm_vcpu_running(struct kvm_vcpu *vcpu)
> {
> - if (is_guest_mode(vcpu))
> - kvm_check_nested_events(vcpu);
> + int r;
> + if (is_guest_mode(vcpu)) {
> + r = kvm_check_nested_events(vcpu);
> + if (r < 0 && r != -EBUSY)
> + return r;
> + }
>
> return (vcpu->arch.mp_state == KVM_MP_STATE_RUNNABLE &&
> !vcpu->arch.apf.halted);
> @@ -9770,12 +9774,16 @@ static int vcpu_run(struct kvm_vcpu *vcpu)
> vcpu->arch.l1tf_flush_l1d = true;
>
> for (;;) {
> - if (kvm_vcpu_running(vcpu)) {
> - r = vcpu_enter_guest(vcpu);
> - } else {
> - r = vcpu_block(kvm, vcpu);
> + r = kvm_vcpu_running(vcpu);
> + if (r < 0) {
> + r = 0;
> + break;
> }
>
> + if (r)
> + r = vcpu_enter_guest(vcpu);
> + else
> + r = vcpu_block(kvm, vcpu);
> if (r <= 0)
> break;
Shouldn't we also change kvm_arch_vcpu_runnable() and check
'kvm_vcpu_running() > 0' now?
--
Vitaly
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] KVM: x86: Exit to userspace when kvm_check_nested_events fails
2021-07-28 12:39 ` Vitaly Kuznetsov
@ 2021-07-28 15:55 ` Paolo Bonzini
2021-07-28 17:53 ` Sean Christopherson
0 siblings, 1 reply; 6+ messages in thread
From: Paolo Bonzini @ 2021-07-28 15:55 UTC (permalink / raw)
To: Vitaly Kuznetsov; +Cc: Jim Mattson, linux-kernel, kvm
On 28/07/21 14:39, Vitaly Kuznetsov wrote:
> Shouldn't we also change kvm_arch_vcpu_runnable() and check
> 'kvm_vcpu_running() > 0' now?
I think leaving kvm_vcpu_block on error is the better choice, so it
should be good with returning true if kvm_vcpu_running(vcpu) < 0.
Paolo
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] KVM: x86: Exit to userspace when kvm_check_nested_events fails
2021-07-28 15:55 ` Paolo Bonzini
@ 2021-07-28 17:53 ` Sean Christopherson
2021-08-02 17:06 ` Paolo Bonzini
0 siblings, 1 reply; 6+ messages in thread
From: Sean Christopherson @ 2021-07-28 17:53 UTC (permalink / raw)
To: Paolo Bonzini; +Cc: Vitaly Kuznetsov, Jim Mattson, linux-kernel, kvm
On Wed, Jul 28, 2021, Paolo Bonzini wrote:
> On 28/07/21 14:39, Vitaly Kuznetsov wrote:
> > Shouldn't we also change kvm_arch_vcpu_runnable() and check
> > 'kvm_vcpu_running() > 0' now?
>
> I think leaving kvm_vcpu_block on error is the better choice, so it should
> be good with returning true if kvm_vcpu_running(vcpu) < 0.
Blech. This is all gross. There is a subtle bug lurking in both Jim's approach
and in this approach. It's not detected because the selftest exercises a bad PI
descriptor, not a bad vAPIC page.
In Jim's approach of returning 'true' from kvm_vcpu_running() if
kvm_check_nested_events() fails due to vmx_complete_nested_posted_interrupt()
detecting a bad vAPIC page, the resulting KVM_EXIT_INTERNAL_ERROR will be "lost"
due to vmx->nested.pi_pending being cleared. KVM runs the vCPU, but skips over
the PI check in inject_pending_event() due to vmx->nested.pi_pending==false.
The selftest works because the bad PI descriptor case is handled _before_
pi_pending is cleared.
This approach mostly fixes that bug by virtue of returning immediately in the
vcpu_run() case, but if the bad vAPIC page is encountered via
kvm_arch_vcpu_runnable(), KVM will effectively drop the error. This can be
hack-a-fixed by pre-checking the vAPIC page. That's arguably architecturally
wrong as the vAPIC emulation access shouldn't occur until after PI.ON is cleared,
but from KVM's perspective I think it's the least awful "fix" given the current
train wreck.
Alternatively, what about punting all of this in favor of targeting the full
cleanup[*] for 5.15? I believe I have the bandwidth to pick that up.
[*] https://lkml.kernel.org/r/YKWI1GPdNc4shaCt@google.com
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 0d0dd6580cfd..8d1c8217954a 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -3707,6 +3707,10 @@ static int vmx_complete_nested_posted_interrupt(struct kvm_vcpu *vcpu)
if (!vmx->nested.pi_desc)
goto mmio_needed;
+ vapic_page = vmx->nested.virtual_apic_map.hva;
+ if (!vapic_page)
+ goto mmio_needed;
+
vmx->nested.pi_pending = false;
if (!pi_test_and_clear_on(vmx->nested.pi_desc))
@@ -3714,10 +3718,6 @@ static int vmx_complete_nested_posted_interrupt(struct kvm_vcpu *vcpu)
max_irr = find_last_bit((unsigned long *)vmx->nested.pi_desc->pir, 256);
if (max_irr != 256) {
- vapic_page = vmx->nested.virtual_apic_map.hva;
- if (!vapic_page)
- goto mmio_needed;
-
__kvm_apic_update_irr(vmx->nested.pi_desc->pir,
vapic_page, &max_irr);
status = vmcs_read16(GUEST_INTR_STATUS);
[*]
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] KVM: x86: Exit to userspace when kvm_check_nested_events fails
2021-07-28 17:53 ` Sean Christopherson
@ 2021-08-02 17:06 ` Paolo Bonzini
0 siblings, 0 replies; 6+ messages in thread
From: Paolo Bonzini @ 2021-08-02 17:06 UTC (permalink / raw)
To: Sean Christopherson; +Cc: Vitaly Kuznetsov, Jim Mattson, linux-kernel, kvm
On 28/07/21 19:53, Sean Christopherson wrote:
> Alternatively, what about punting all of this in favor of targeting the full
> cleanup[*] for 5.15? I believe I have the bandwidth to pick that up.
That's fine of course. I'll keep this in queue for the moment so that I
can at least run Jim's testcase, but otherwise won't merge it to kvm/next.
Paolo
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] KVM: x86: Exit to userspace when kvm_check_nested_events fails
2021-07-28 11:53 [PATCH] KVM: x86: Exit to userspace when kvm_check_nested_events fails Paolo Bonzini
2021-07-28 12:39 ` Vitaly Kuznetsov
@ 2021-07-28 16:24 ` Sean Christopherson
1 sibling, 0 replies; 6+ messages in thread
From: Sean Christopherson @ 2021-07-28 16:24 UTC (permalink / raw)
To: Paolo Bonzini; +Cc: linux-kernel, kvm, Jim Mattson
On Wed, Jul 28, 2021, Paolo Bonzini wrote:
> From: Jim Mattson <jmattson@google.com>
I don't think this is actually from Jim.
> If kvm_check_nested_events fails due to raising an
> EXIT_REASON_INTERNAL_ERROR, propagate it to userspace
> immediately, even if the vCPU would otherwise be sleeping.
> This happens for example when the posted interrupt descriptor
> points outside guest memory.
>
> Reported-by: Jim Mattson <jmattson@google.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
> arch/x86/kvm/x86.c | 22 +++++++++++++++-------
> 1 file changed, 15 insertions(+), 7 deletions(-)
>
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 348452bb16bc..916c976e99ab 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -9752,10 +9752,14 @@ static inline int vcpu_block(struct kvm *kvm, struct kvm_vcpu *vcpu)
> return 1;
> }
>
> -static inline bool kvm_vcpu_running(struct kvm_vcpu *vcpu)
> +static inline int kvm_vcpu_running(struct kvm_vcpu *vcpu)
> {
> - if (is_guest_mode(vcpu))
> - kvm_check_nested_events(vcpu);
> + int r;
newline
> + if (is_guest_mode(vcpu)) {
> + r = kvm_check_nested_events(vcpu);
> + if (r < 0 && r != -EBUSY)
> + return r;
> + }
>
> return (vcpu->arch.mp_state == KVM_MP_STATE_RUNNABLE &&
> !vcpu->arch.apf.halted);
> @@ -9770,12 +9774,16 @@ static int vcpu_run(struct kvm_vcpu *vcpu)
> vcpu->arch.l1tf_flush_l1d = true;
>
> for (;;) {
> - if (kvm_vcpu_running(vcpu)) {
> - r = vcpu_enter_guest(vcpu);
> - } else {
> - r = vcpu_block(kvm, vcpu);
> + r = kvm_vcpu_running(vcpu);
> + if (r < 0) {
> + r = 0;
> + break;
> }
>
> + if (r)
> + r = vcpu_enter_guest(vcpu);
> + else
> + r = vcpu_block(kvm, vcpu);
> if (r <= 0)
> break;
>
> --
> 2.27.0
>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2021-08-02 17:07 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-07-28 11:53 [PATCH] KVM: x86: Exit to userspace when kvm_check_nested_events fails Paolo Bonzini
2021-07-28 12:39 ` Vitaly Kuznetsov
2021-07-28 15:55 ` Paolo Bonzini
2021-07-28 17:53 ` Sean Christopherson
2021-08-02 17:06 ` Paolo Bonzini
2021-07-28 16:24 ` Sean Christopherson
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).