Commit 6cd88243 authored by Paolo Bonzini's avatar Paolo Bonzini
Browse files

KVM: x86: do not report a vCPU as preempted outside instruction boundaries 



If a vCPU is outside guest mode and is scheduled out, it might be in the
process of making a memory access.  A problem occurs if another vCPU uses
the PV TLB flush feature during the period when the vCPU is scheduled
out, and a virtual address has already been translated but has not yet
been accessed, because this is equivalent to using a stale TLB entry.

To avoid this, only report a vCPU as preempted if sure that the guest
is at an instruction boundary.  A rescheduling request will be delivered
to the host physical CPU as an external interrupt, so for simplicity
consider any vmexit *not* instruction boundary except for external
interrupts.

It would in principle be okay to report the vCPU as preempted also
if it is sleeping in kvm_vcpu_block(): a TLB flush IPI will incur the
vmentry/vmexit overhead unnecessarily, and optimistic spinning is
also unlikely to succeed.  However, leave it for later because right
now kvm_vcpu_check_block() is doing memory accesses.  Even
though the TLB flush issue only applies to virtual memory address,
it's very much preferrable to be conservative.

Reported-by: default avatarJann Horn <jannh@google.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent 54aa83c9

arch/x86/include/asm/kvm_host.h

+3 −0
Original line number Diff line number Diff line
@@ -653,6 +653,7 @@ struct kvm_vcpu_arch { 
	u64 ia32_misc_enable_msr;

	u64 smbase;

	u64 smi_count;

	bool at_instruction_boundary;

	bool tpr_access_reporting;

	bool xsaves_enabled;

	bool xfd_no_write_intercept;
@@ -1300,6 +1301,8 @@ struct kvm_vcpu_stat { 
	u64 nested_run;

	u64 directed_yield_attempted;

	u64 directed_yield_successful;

	u64 preemption_reported;

	u64 preemption_other;

	u64 guest_mode;

};

arch/x86/kvm/svm/svm.c

+2 −0
Original line number Diff line number Diff line
@@ -4263,6 +4263,8 @@ static int svm_check_intercept(struct kvm_vcpu *vcpu, 


static void svm_handle_exit_irqoff(struct kvm_vcpu *vcpu)

{

	if (to_svm(vcpu)->vmcb->control.exit_code == SVM_EXIT_INTR)

		vcpu->arch.at_instruction_boundary = true;

}



static void svm_sched_in(struct kvm_vcpu *vcpu, int cpu)

arch/x86/kvm/vmx/vmx.c

+1 −0
Original line number Diff line number Diff line
@@ -6547,6 +6547,7 @@ static void handle_external_interrupt_irqoff(struct kvm_vcpu *vcpu) 
		return;



	handle_interrupt_nmi_irqoff(vcpu, gate_offset(desc));

	vcpu->arch.at_instruction_boundary = true;

}



static void vmx_handle_exit_irqoff(struct kvm_vcpu *vcpu)

arch/x86/kvm/x86.c

+22 −0
Original line number Diff line number Diff line
@@ -296,6 +296,8 @@ const struct _kvm_stats_desc kvm_vcpu_stats_desc[] = { 
	STATS_DESC_COUNTER(VCPU, nested_run),

	STATS_DESC_COUNTER(VCPU, directed_yield_attempted),

	STATS_DESC_COUNTER(VCPU, directed_yield_successful),

	STATS_DESC_COUNTER(VCPU, preemption_reported),

	STATS_DESC_COUNTER(VCPU, preemption_other),

	STATS_DESC_ICOUNTER(VCPU, guest_mode)

};
@@ -4625,6 +4627,19 @@ static void kvm_steal_time_set_preempted(struct kvm_vcpu *vcpu) 
	struct kvm_memslots *slots;

	static const u8 preempted = KVM_VCPU_PREEMPTED;



	/*

	 * The vCPU can be marked preempted if and only if the VM-Exit was on

	 * an instruction boundary and will not trigger guest emulation of any

	 * kind (see vcpu_run).  Vendor specific code controls (conservatively)

	 * when this is true, for example allowing the vCPU to be marked

	 * preempted if and only if the VM-Exit was due to a host interrupt.

	 */

	if (!vcpu->arch.at_instruction_boundary) {

		vcpu->stat.preemption_other++;

		return;

	}



	vcpu->stat.preemption_reported++;

	if (!(vcpu->arch.st.msr_val & KVM_MSR_ENABLED))

		return;
@@ -10424,6 +10439,13 @@ static int vcpu_run(struct kvm_vcpu *vcpu) 
	vcpu->arch.l1tf_flush_l1d = true;



	for (;;) {

		/*

		 * If another guest vCPU requests a PV TLB flush in the middle

		 * of instruction emulation, the rest of the emulation could

		 * use a stale page translation. Assume that any code after

		 * this point can start executing an instruction.

		 */

		vcpu->arch.at_instruction_boundary = false;

		if (kvm_vcpu_running(vcpu)) {

			r = vcpu_enter_guest(vcpu);

		} else {