提交 0b66a631 编写于 作者: P Paolo Bonzini 提交者: Zheng Zengkai

KVM: x86: do not report a vCPU as preempted outside instruction boundaries

mainline inclusion
from mainline-v5.19-rc2
commit 6cd88243
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5PJ7H
CVE: CVE-2022-39189

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6cd88243c7e03845a450795e134b488fc2afb736

----------------------------------------

If a vCPU is outside guest mode and is scheduled out, it might be in the
process of making a memory access.  A problem occurs if another vCPU uses
the PV TLB flush feature during the period when the vCPU is scheduled
out, and a virtual address has already been translated but has not yet
been accessed, because this is equivalent to using a stale TLB entry.

To avoid this, only report a vCPU as preempted if sure that the guest
is at an instruction boundary.  A rescheduling request will be delivered
to the host physical CPU as an external interrupt, so for simplicity
consider any vmexit *not* instruction boundary except for external
interrupts.

It would in principle be okay to report the vCPU as preempted also
if it is sleeping in kvm_vcpu_block(): a TLB flush IPI will incur the
vmentry/vmexit overhead unnecessarily, and optimistic spinning is
also unlikely to succeed.  However, leave it for later because right
now kvm_vcpu_check_block() is doing memory accesses.  Even
though the TLB flush issue only applies to virtual memory address,
it's very much preferrable to be conservative.
Reported-by: NJann Horn <jannh@google.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

conflict:
	arch/x86/kvm/x86.c
Signed-off-by: NGuo Mengqi <guomengqi3@huawei.com>
Reviewed-by: NXiu Jianfeng <xiujianfeng@huawei.com>
Reviewed-by: NWeilong Chen <chenweilong@huawei.com>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
上级 56afc45b
...@@ -553,6 +553,7 @@ struct kvm_vcpu_arch { ...@@ -553,6 +553,7 @@ struct kvm_vcpu_arch {
u64 ia32_misc_enable_msr; u64 ia32_misc_enable_msr;
u64 smbase; u64 smbase;
u64 smi_count; u64 smi_count;
bool at_instruction_boundary;
bool tpr_access_reporting; bool tpr_access_reporting;
bool xsaves_enabled; bool xsaves_enabled;
u64 ia32_xss; u64 ia32_xss;
...@@ -1077,6 +1078,8 @@ struct kvm_vcpu_stat { ...@@ -1077,6 +1078,8 @@ struct kvm_vcpu_stat {
u64 utime; u64 utime;
u64 stime; u64 stime;
u64 gtime; u64 gtime;
u64 preemption_reported;
u64 preemption_other;
u64 preemption_timer_exits; u64 preemption_timer_exits;
}; };
......
...@@ -3992,6 +3992,8 @@ static int svm_check_intercept(struct kvm_vcpu *vcpu, ...@@ -3992,6 +3992,8 @@ static int svm_check_intercept(struct kvm_vcpu *vcpu,
static void svm_handle_exit_irqoff(struct kvm_vcpu *vcpu) static void svm_handle_exit_irqoff(struct kvm_vcpu *vcpu)
{ {
if (to_svm(vcpu)->vmcb->control.exit_code == SVM_EXIT_INTR)
vcpu->arch.at_instruction_boundary = true;
} }
static void svm_sched_in(struct kvm_vcpu *vcpu, int cpu) static void svm_sched_in(struct kvm_vcpu *vcpu, int cpu)
......
...@@ -6605,6 +6605,7 @@ static void handle_external_interrupt_irqoff(struct kvm_vcpu *vcpu) ...@@ -6605,6 +6605,7 @@ static void handle_external_interrupt_irqoff(struct kvm_vcpu *vcpu)
return; return;
handle_interrupt_nmi_irqoff(vcpu, gate_offset(desc)); handle_interrupt_nmi_irqoff(vcpu, gate_offset(desc));
vcpu->arch.at_instruction_boundary = true;
} }
static void vmx_handle_exit_irqoff(struct kvm_vcpu *vcpu) static void vmx_handle_exit_irqoff(struct kvm_vcpu *vcpu)
......
...@@ -233,6 +233,8 @@ struct kvm_stats_debugfs_item debugfs_entries[] = { ...@@ -233,6 +233,8 @@ struct kvm_stats_debugfs_item debugfs_entries[] = {
VCPU_STAT("l1d_flush", l1d_flush), VCPU_STAT("l1d_flush", l1d_flush),
VCPU_STAT("halt_poll_success_ns", halt_poll_success_ns), VCPU_STAT("halt_poll_success_ns", halt_poll_success_ns),
VCPU_STAT("halt_poll_fail_ns", halt_poll_fail_ns), VCPU_STAT("halt_poll_fail_ns", halt_poll_fail_ns),
VCPU_STAT("preemption_reported", preemption_reported),
VCPU_STAT("preemption_other", preemption_other),
VM_STAT("mmu_shadow_zapped", mmu_shadow_zapped), VM_STAT("mmu_shadow_zapped", mmu_shadow_zapped),
VM_STAT("mmu_pte_write", mmu_pte_write), VM_STAT("mmu_pte_write", mmu_pte_write),
VM_STAT("mmu_pde_zapped", mmu_pde_zapped), VM_STAT("mmu_pde_zapped", mmu_pde_zapped),
...@@ -287,6 +289,8 @@ struct dfx_kvm_stats_debugfs_item dfx_debugfs_entries[] = { ...@@ -287,6 +289,8 @@ struct dfx_kvm_stats_debugfs_item dfx_debugfs_entries[] = {
DFX_STAT("stime", stime), DFX_STAT("stime", stime),
DFX_STAT("gtime", gtime), DFX_STAT("gtime", gtime),
DFX_STAT("preemption_timer_exits", preemption_timer_exits), DFX_STAT("preemption_timer_exits", preemption_timer_exits),
DFX_STAT("preemption_reported", preemption_reported),
DFX_STAT("preemption_other", preemption_other),
{ NULL } { NULL }
}; };
...@@ -4082,6 +4086,19 @@ static void kvm_steal_time_set_preempted(struct kvm_vcpu *vcpu) ...@@ -4082,6 +4086,19 @@ static void kvm_steal_time_set_preempted(struct kvm_vcpu *vcpu)
struct kvm_host_map map; struct kvm_host_map map;
struct kvm_steal_time *st; struct kvm_steal_time *st;
/*
* The vCPU can be marked preempted if and only if the VM-Exit was on
* an instruction boundary and will not trigger guest emulation of any
* kind (see vcpu_run). Vendor specific code controls (conservatively)
* when this is true, for example allowing the vCPU to be marked
* preempted if and only if the VM-Exit was due to a host interrupt.
*/
if (!vcpu->arch.at_instruction_boundary) {
vcpu->stat.preemption_other++;
return;
}
vcpu->stat.preemption_reported++;
if (!(vcpu->arch.st.msr_val & KVM_MSR_ENABLED)) if (!(vcpu->arch.st.msr_val & KVM_MSR_ENABLED))
return; return;
...@@ -9329,6 +9346,13 @@ static int vcpu_run(struct kvm_vcpu *vcpu) ...@@ -9329,6 +9346,13 @@ static int vcpu_run(struct kvm_vcpu *vcpu)
vcpu->arch.l1tf_flush_l1d = true; vcpu->arch.l1tf_flush_l1d = true;
for (;;) { for (;;) {
/*
* If another guest vCPU requests a PV TLB flush in the middle
* of instruction emulation, the rest of the emulation could
* use a stale page translation. Assume that any code after
* this point can start executing an instruction.
*/
vcpu->arch.at_instruction_boundary = false;
if (kvm_vcpu_running(vcpu)) { if (kvm_vcpu_running(vcpu)) {
r = vcpu_enter_guest(vcpu); r = vcpu_enter_guest(vcpu);
} else { } else {
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册