linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] KVM: x86: Exit to userspace when kvm_check_nested_events fails
@ 2021-07-28 11:53 Paolo Bonzini
  2021-07-28 12:39 ` Vitaly Kuznetsov
  2021-07-28 16:24 ` Sean Christopherson
  0 siblings, 2 replies; 6+ messages in thread
From: Paolo Bonzini @ 2021-07-28 11:53 UTC (permalink / raw)
  To: linux-kernel, kvm; +Cc: Jim Mattson

From: Jim Mattson <jmattson@google.com>

If kvm_check_nested_events fails due to raising an
EXIT_REASON_INTERNAL_ERROR, propagate it to userspace
immediately, even if the vCPU would otherwise be sleeping.
This happens for example when the posted interrupt descriptor
points outside guest memory.

Reported-by: Jim Mattson <jmattson@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 arch/x86/kvm/x86.c | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 348452bb16bc..916c976e99ab 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -9752,10 +9752,14 @@ static inline int vcpu_block(struct kvm *kvm, struct kvm_vcpu *vcpu)
 	return 1;
 }
 
-static inline bool kvm_vcpu_running(struct kvm_vcpu *vcpu)
+static inline int kvm_vcpu_running(struct kvm_vcpu *vcpu)
 {
-	if (is_guest_mode(vcpu))
-		kvm_check_nested_events(vcpu);
+	int r;
+	if (is_guest_mode(vcpu)) {
+		r = kvm_check_nested_events(vcpu);
+		if (r < 0 && r != -EBUSY)
+			return r;
+	}
 
 	return (vcpu->arch.mp_state == KVM_MP_STATE_RUNNABLE &&
 		!vcpu->arch.apf.halted);
@@ -9770,12 +9774,16 @@ static int vcpu_run(struct kvm_vcpu *vcpu)
 	vcpu->arch.l1tf_flush_l1d = true;
 
 	for (;;) {
-		if (kvm_vcpu_running(vcpu)) {
-			r = vcpu_enter_guest(vcpu);
-		} else {
-			r = vcpu_block(kvm, vcpu);
+		r = kvm_vcpu_running(vcpu);
+		if (r < 0) {
+			r = 0;
+			break;
 		}
 
+		if (r)
+			r = vcpu_enter_guest(vcpu);
+		else
+			r = vcpu_block(kvm, vcpu);
 		if (r <= 0)
 			break;
 
-- 
2.27.0


^ permalink raw reply related	[flat|nested] 6+ messages in thread
* Re: [PATCH] KVM: x86: Exit to userspace when kvm_check_nested_events fails
  2021-07-28 11:53 [PATCH] KVM: x86: Exit to userspace when kvm_check_nested_events fails Paolo Bonzini
@ 2021-07-28 12:39 ` Vitaly Kuznetsov
  2021-07-28 15:55   ` Paolo Bonzini
  2021-07-28 16:24 ` Sean Christopherson
  1 sibling, 1 reply; 6+ messages in thread
From: Vitaly Kuznetsov @ 2021-07-28 12:39 UTC (permalink / raw)
  To: Paolo Bonzini; +Cc: Jim Mattson, linux-kernel, kvm

Paolo Bonzini <pbonzini@redhat.com> writes:

> From: Jim Mattson <jmattson@google.com>
>
> If kvm_check_nested_events fails due to raising an
> EXIT_REASON_INTERNAL_ERROR, propagate it to userspace
> immediately, even if the vCPU would otherwise be sleeping.
> This happens for example when the posted interrupt descriptor
> points outside guest memory.
>
> Reported-by: Jim Mattson <jmattson@google.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
>  arch/x86/kvm/x86.c | 22 +++++++++++++++-------
>  1 file changed, 15 insertions(+), 7 deletions(-)
>
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 348452bb16bc..916c976e99ab 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -9752,10 +9752,14 @@ static inline int vcpu_block(struct kvm *kvm, struct kvm_vcpu *vcpu)
>  	return 1;
>  }
>  
> -static inline bool kvm_vcpu_running(struct kvm_vcpu *vcpu)
> +static inline int kvm_vcpu_running(struct kvm_vcpu *vcpu)
>  {
> -	if (is_guest_mode(vcpu))
> -		kvm_check_nested_events(vcpu);
> +	int r;
> +	if (is_guest_mode(vcpu)) {
> +		r = kvm_check_nested_events(vcpu);
> +		if (r < 0 && r != -EBUSY)
> +			return r;
> +	}
>  
>  	return (vcpu->arch.mp_state == KVM_MP_STATE_RUNNABLE &&
>  		!vcpu->arch.apf.halted);
> @@ -9770,12 +9774,16 @@ static int vcpu_run(struct kvm_vcpu *vcpu)
>  	vcpu->arch.l1tf_flush_l1d = true;
>  
>  	for (;;) {
> -		if (kvm_vcpu_running(vcpu)) {
> -			r = vcpu_enter_guest(vcpu);
> -		} else {
> -			r = vcpu_block(kvm, vcpu);
> +		r = kvm_vcpu_running(vcpu);
> +		if (r < 0) {
> +			r = 0;
> +			break;
>  		}
>  
> +		if (r)
> +			r = vcpu_enter_guest(vcpu);
> +		else
> +			r = vcpu_block(kvm, vcpu);
>  		if (r <= 0)
>  			break;

Shouldn't we also change kvm_arch_vcpu_runnable() and check
'kvm_vcpu_running() > 0' now?

-- 
Vitaly


^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH] KVM: x86: Exit to userspace when kvm_check_nested_events fails
  2021-07-28 12:39 ` Vitaly Kuznetsov
@ 2021-07-28 15:55   ` Paolo Bonzini
  2021-07-28 17:53     ` Sean Christopherson
  0 siblings, 1 reply; 6+ messages in thread
From: Paolo Bonzini @ 2021-07-28 15:55 UTC (permalink / raw)
  To: Vitaly Kuznetsov; +Cc: Jim Mattson, linux-kernel, kvm

On 28/07/21 14:39, Vitaly Kuznetsov wrote:
> Shouldn't we also change kvm_arch_vcpu_runnable() and check
> 'kvm_vcpu_running() > 0' now?

I think leaving kvm_vcpu_block on error is the better choice, so it 
should be good with returning true if kvm_vcpu_running(vcpu) < 0.

Paolo


^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH] KVM: x86: Exit to userspace when kvm_check_nested_events fails
  2021-07-28 11:53 [PATCH] KVM: x86: Exit to userspace when kvm_check_nested_events fails Paolo Bonzini
  2021-07-28 12:39 ` Vitaly Kuznetsov
@ 2021-07-28 16:24 ` Sean Christopherson
  1 sibling, 0 replies; 6+ messages in thread
From: Sean Christopherson @ 2021-07-28 16:24 UTC (permalink / raw)
  To: Paolo Bonzini; +Cc: linux-kernel, kvm, Jim Mattson

On Wed, Jul 28, 2021, Paolo Bonzini wrote:
> From: Jim Mattson <jmattson@google.com>

I don't think this is actually from Jim.

> If kvm_check_nested_events fails due to raising an
> EXIT_REASON_INTERNAL_ERROR, propagate it to userspace
> immediately, even if the vCPU would otherwise be sleeping.
> This happens for example when the posted interrupt descriptor
> points outside guest memory.
> 
> Reported-by: Jim Mattson <jmattson@google.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
>  arch/x86/kvm/x86.c | 22 +++++++++++++++-------
>  1 file changed, 15 insertions(+), 7 deletions(-)
> 
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 348452bb16bc..916c976e99ab 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -9752,10 +9752,14 @@ static inline int vcpu_block(struct kvm *kvm, struct kvm_vcpu *vcpu)
>  	return 1;
>  }
>  
> -static inline bool kvm_vcpu_running(struct kvm_vcpu *vcpu)
> +static inline int kvm_vcpu_running(struct kvm_vcpu *vcpu)
>  {
> -	if (is_guest_mode(vcpu))
> -		kvm_check_nested_events(vcpu);
> +	int r;

newline

> +	if (is_guest_mode(vcpu)) {
> +		r = kvm_check_nested_events(vcpu);
> +		if (r < 0 && r != -EBUSY)
> +			return r;
> +	}
>  
>  	return (vcpu->arch.mp_state == KVM_MP_STATE_RUNNABLE &&
>  		!vcpu->arch.apf.halted);
> @@ -9770,12 +9774,16 @@ static int vcpu_run(struct kvm_vcpu *vcpu)
>  	vcpu->arch.l1tf_flush_l1d = true;
>  
>  	for (;;) {
> -		if (kvm_vcpu_running(vcpu)) {
> -			r = vcpu_enter_guest(vcpu);
> -		} else {
> -			r = vcpu_block(kvm, vcpu);
> +		r = kvm_vcpu_running(vcpu);
> +		if (r < 0) {
> +			r = 0;
> +			break;
>  		}
>  
> +		if (r)
> +			r = vcpu_enter_guest(vcpu);
> +		else
> +			r = vcpu_block(kvm, vcpu);
>  		if (r <= 0)
>  			break;
>  
> -- 
> 2.27.0
> 

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH] KVM: x86: Exit to userspace when kvm_check_nested_events fails
  2021-07-28 15:55   ` Paolo Bonzini
@ 2021-07-28 17:53     ` Sean Christopherson
  2021-08-02 17:06       ` Paolo Bonzini
  0 siblings, 1 reply; 6+ messages in thread
From: Sean Christopherson @ 2021-07-28 17:53 UTC (permalink / raw)
  To: Paolo Bonzini; +Cc: Vitaly Kuznetsov, Jim Mattson, linux-kernel, kvm

On Wed, Jul 28, 2021, Paolo Bonzini wrote:
> On 28/07/21 14:39, Vitaly Kuznetsov wrote:
> > Shouldn't we also change kvm_arch_vcpu_runnable() and check
> > 'kvm_vcpu_running() > 0' now?
> 
> I think leaving kvm_vcpu_block on error is the better choice, so it should
> be good with returning true if kvm_vcpu_running(vcpu) < 0.

Blech.  This is all gross.  There is a subtle bug lurking in both Jim's approach
and in this approach.  It's not detected because the selftest exercises a bad PI
descriptor, not a bad vAPIC page.

In Jim's approach of returning 'true' from kvm_vcpu_running() if
kvm_check_nested_events() fails due to vmx_complete_nested_posted_interrupt()
detecting a bad vAPIC page, the resulting KVM_EXIT_INTERNAL_ERROR will be "lost"
due to vmx->nested.pi_pending being cleared.  KVM runs the vCPU, but skips over
the PI check in inject_pending_event() due to vmx->nested.pi_pending==false.
The selftest works because the bad PI descriptor case is handled _before_
pi_pending is cleared.

This approach mostly fixes that bug by virtue of returning immediately in the
vcpu_run() case, but if the bad vAPIC page is encountered via
kvm_arch_vcpu_runnable(), KVM will effectively drop the error.  This can be
hack-a-fixed by pre-checking the vAPIC page.  That's arguably architecturally
wrong as the vAPIC emulation access shouldn't occur until after PI.ON is cleared,
but from KVM's perspective I think it's the least awful "fix" given the current
train wreck.

Alternatively, what about punting all of this in favor of targeting the full
cleanup[*] for 5.15?  I believe I have the bandwidth to pick that up.

[*] https://lkml.kernel.org/r/YKWI1GPdNc4shaCt@google.com

diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 0d0dd6580cfd..8d1c8217954a 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -3707,6 +3707,10 @@ static int vmx_complete_nested_posted_interrupt(struct kvm_vcpu *vcpu)
        if (!vmx->nested.pi_desc)
                goto mmio_needed;

+       vapic_page = vmx->nested.virtual_apic_map.hva;
+       if (!vapic_page)
+               goto mmio_needed;
+
        vmx->nested.pi_pending = false;

        if (!pi_test_and_clear_on(vmx->nested.pi_desc))
@@ -3714,10 +3718,6 @@ static int vmx_complete_nested_posted_interrupt(struct kvm_vcpu *vcpu)

        max_irr = find_last_bit((unsigned long *)vmx->nested.pi_desc->pir, 256);
        if (max_irr != 256) {
-               vapic_page = vmx->nested.virtual_apic_map.hva;
-               if (!vapic_page)
-                       goto mmio_needed;
-
                __kvm_apic_update_irr(vmx->nested.pi_desc->pir,
                        vapic_page, &max_irr);
                status = vmcs_read16(GUEST_INTR_STATUS);

[*] 

^ permalink raw reply related	[flat|nested] 6+ messages in thread
* Re: [PATCH] KVM: x86: Exit to userspace when kvm_check_nested_events fails
  2021-07-28 17:53     ` Sean Christopherson
@ 2021-08-02 17:06       ` Paolo Bonzini
  0 siblings, 0 replies; 6+ messages in thread
From: Paolo Bonzini @ 2021-08-02 17:06 UTC (permalink / raw)
  To: Sean Christopherson; +Cc: Vitaly Kuznetsov, Jim Mattson, linux-kernel, kvm

On 28/07/21 19:53, Sean Christopherson wrote:
> Alternatively, what about punting all of this in favor of targeting the full
> cleanup[*] for 5.15?  I believe I have the bandwidth to pick that up.

That's fine of course.  I'll keep this in queue for the moment so that I 
can at least run Jim's testcase, but otherwise won't merge it to kvm/next.

Paolo


^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2021-08-02 17:07 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-07-28 11:53 [PATCH] KVM: x86: Exit to userspace when kvm_check_nested_events fails Paolo Bonzini
2021-07-28 12:39 ` Vitaly Kuznetsov
2021-07-28 15:55   ` Paolo Bonzini
2021-07-28 17:53     ` Sean Christopherson
2021-08-02 17:06       ` Paolo Bonzini
2021-07-28 16:24 ` Sean Christopherson

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).