Commit 17e433b5 authored by Wanpeng Li's avatar Wanpeng Li Committed by Paolo Bonzini
Browse files

KVM: Fix leak vCPU's VMCS value into other pCPU 



After commit d73eb57b (KVM: Boost vCPUs that are delivering interrupts), a
five years old bug is exposed. Running ebizzy benchmark in three 80 vCPUs VMs
on one 80 pCPUs Skylake server, a lot of rcu_sched stall warning splatting
in the VMs after stress testing:

 INFO: rcu_sched detected stalls on CPUs/tasks: { 4 41 57 62 77} (detected by 15, t=60004 jiffies, g=899, c=898, q=15073)
 Call Trace:
   flush_tlb_mm_range+0x68/0x140
   tlb_flush_mmu.part.75+0x37/0xe0
   tlb_finish_mmu+0x55/0x60
   zap_page_range+0x142/0x190
   SyS_madvise+0x3cd/0x9c0
   system_call_fastpath+0x1c/0x21

swait_active() sustains to be true before finish_swait() is called in
kvm_vcpu_block(), voluntarily preempted vCPUs are taken into account
by kvm_vcpu_on_spin() loop greatly increases the probability condition
kvm_arch_vcpu_runnable(vcpu) is checked and can be true, when APICv
is enabled the yield-candidate vCPU's VMCS RVI field leaks(by
vmx_sync_pir_to_irr()) into spinning-on-a-taken-lock vCPU's current
VMCS.

This patch fixes it by checking conservatively a subset of events.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Cc: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: Marc Zyngier <Marc.Zyngier@arm.com>
Cc: stable@vger.kernel.org
Fixes: 98f4a146 (KVM: add kvm_arch_vcpu_runnable() test to kvm_vcpu_on_spin() loop)
Signed-off-by: default avatarWanpeng Li <wanpengli@tencent.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent 046ddeed

arch/powerpc/kvm/powerpc.c

+5 −0
Original line number Diff line number Diff line
@@ -50,6 +50,11 @@ int kvm_arch_vcpu_runnable(struct kvm_vcpu *v) 
	return !!(v->arch.pending_exceptions) || kvm_request_pending(v);

}



bool kvm_arch_dy_runnable(struct kvm_vcpu *vcpu)

{

	return kvm_arch_vcpu_runnable(vcpu);

}



bool kvm_arch_vcpu_in_kernel(struct kvm_vcpu *vcpu)

{

	return false;

arch/x86/include/asm/kvm_host.h

+1 −0
Original line number Diff line number Diff line
@@ -1175,6 +1175,7 @@ struct kvm_x86_ops { 
	int (*update_pi_irte)(struct kvm *kvm, unsigned int host_irq,

			      uint32_t guest_irq, bool set);

	void (*apicv_post_state_restore)(struct kvm_vcpu *vcpu);

	bool (*dy_apicv_has_pending_interrupt)(struct kvm_vcpu *vcpu);



	int (*set_hv_timer)(struct kvm_vcpu *vcpu, u64 guest_deadline_tsc,

			    bool *expired);

arch/x86/kvm/svm.c

+6 −0
Original line number Diff line number Diff line
@@ -5190,6 +5190,11 @@ static void svm_deliver_avic_intr(struct kvm_vcpu *vcpu, int vec) 
		kvm_vcpu_wake_up(vcpu);

}



static bool svm_dy_apicv_has_pending_interrupt(struct kvm_vcpu *vcpu)

{

	return false;

}



static void svm_ir_list_del(struct vcpu_svm *svm, struct amd_iommu_pi_data *pi)

{

	unsigned long flags;
@@ -7314,6 +7319,7 @@ static struct kvm_x86_ops svm_x86_ops __ro_after_init = { 


	.pmu_ops = &amd_pmu_ops,

	.deliver_posted_interrupt = svm_deliver_avic_intr,

	.dy_apicv_has_pending_interrupt = svm_dy_apicv_has_pending_interrupt,

	.update_pi_irte = svm_update_pi_irte,

	.setup_mce = svm_setup_mce,

arch/x86/kvm/vmx/vmx.c

+6 −0
Original line number Diff line number Diff line
@@ -6117,6 +6117,11 @@ static int vmx_sync_pir_to_irr(struct kvm_vcpu *vcpu) 
	return max_irr;

}



static bool vmx_dy_apicv_has_pending_interrupt(struct kvm_vcpu *vcpu)

{

	return pi_test_on(vcpu_to_pi_desc(vcpu));

}



static void vmx_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap)

{

	if (!kvm_vcpu_apicv_active(vcpu))
@@ -7726,6 +7731,7 @@ static struct kvm_x86_ops vmx_x86_ops __ro_after_init = { 
	.guest_apic_has_interrupt = vmx_guest_apic_has_interrupt,

	.sync_pir_to_irr = vmx_sync_pir_to_irr,

	.deliver_posted_interrupt = vmx_deliver_posted_interrupt,

	.dy_apicv_has_pending_interrupt = vmx_dy_apicv_has_pending_interrupt,



	.set_tss_addr = vmx_set_tss_addr,

	.set_identity_map_addr = vmx_set_identity_map_addr,

arch/x86/kvm/x86.c

+16 −0
Original line number Diff line number Diff line
@@ -9698,6 +9698,22 @@ int kvm_arch_vcpu_runnable(struct kvm_vcpu *vcpu) 
	return kvm_vcpu_running(vcpu) || kvm_vcpu_has_events(vcpu);

}



bool kvm_arch_dy_runnable(struct kvm_vcpu *vcpu)

{

	if (READ_ONCE(vcpu->arch.pv.pv_unhalted))

		return true;



	if (kvm_test_request(KVM_REQ_NMI, vcpu) ||

		kvm_test_request(KVM_REQ_SMI, vcpu) ||

		 kvm_test_request(KVM_REQ_EVENT, vcpu))

		return true;



	if (vcpu->arch.apicv_active && kvm_x86_ops->dy_apicv_has_pending_interrupt(vcpu))

		return true;



	return false;

}



bool kvm_arch_vcpu_in_kernel(struct kvm_vcpu *vcpu)

{

	return vcpu->arch.preempted_in_kernel;

CRA Git | Maintained and supported by SUSTech CRA and CCSE