2022-04-27 18:04:55

by Paolo Bonzini

[permalink] [raw]
Subject: [PATCH 0/2] KVM: x86: never write to memory from kvm_vcpu_check_block

Maxim reported the following backtrace:

[ 1355.807187] kvm_vcpu_map+0x159/0x190 [kvm]
[ 1355.807628] nested_svm_vmexit+0x4c/0x7f0 [kvm_amd]
[ 1355.808036] ? kvm_vcpu_block+0x54/0xa0 [kvm]
[ 1355.808450] svm_check_nested_events+0x97/0x390 [kvm_amd]
[ 1355.808920] kvm_check_nested_events+0x1c/0x40 [kvm]
[ 1355.809396] kvm_arch_vcpu_runnable+0x4e/0x190 [kvm]
[ 1355.809892] kvm_vcpu_check_block+0x4f/0x100 [kvm]
[ 1355.811259] kvm_vcpu_block+0x6b/0xa0 [kvm]

due to kmap being called in non-sleepable (!TASK_RUNNING) context.
Fix it by extending kvm_x86_ops->nested_ops.hv_timer_pending and
getting rid of one annoying instance of kvm_check_nested_events.

Paolo


2022-04-27 18:05:04

by Paolo Bonzini

[permalink] [raw]
Subject: [PATCH 3/3] KVM: x86: never write to memory from kvm_vcpu_check_block

kvm_vcpu_check_block is called while not in TASK_RUNNING, and therefore
cannot sleep. Writing to guest memory is therefore forbidden, but it
can happen if kvm_check_nested_events causes a vmexit.

Fortunately, all events that are caught by kvm_check_nested_events are
also handled by kvm_vcpu_has_events through vendor callbacks such as
kvm_x86_interrupt_allowed or kvm_x86_ops.nested_ops->has_events, so
remove the call.

Cc: [email protected]
Reported-by: Maxim Levitsky <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
---
arch/x86/kvm/x86.c | 3 ---
1 file changed, 3 deletions(-)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index d563812ca229..90b4f50b9a84 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -10341,9 +10341,6 @@ static inline int vcpu_block(struct kvm_vcpu *vcpu)

static inline bool kvm_vcpu_running(struct kvm_vcpu *vcpu)
{
- if (is_guest_mode(vcpu))
- kvm_check_nested_events(vcpu);
-
return (vcpu->arch.mp_state == KVM_MP_STATE_RUNNABLE &&
!vcpu->arch.apf.halted);
}
--
2.31.1

2022-04-27 22:35:03

by Maxim Levitsky

[permalink] [raw]
Subject: Re: [PATCH 3/3] KVM: x86: never write to memory from kvm_vcpu_check_block

On Wed, 2022-04-27 at 13:37 -0400, Paolo Bonzini wrote:
> kvm_vcpu_check_block is called while not in TASK_RUNNING, and therefore
> cannot sleep. Writing to guest memory is therefore forbidden, but it
> can happen if kvm_check_nested_events causes a vmexit.
>
> Fortunately, all events that are caught by kvm_check_nested_events are
> also handled by kvm_vcpu_has_events through vendor callbacks such as
> kvm_x86_interrupt_allowed or kvm_x86_ops.nested_ops->has_events, so
> remove the call.
>
> Cc: [email protected]
> Reported-by: Maxim Levitsky <[email protected]>
> Signed-off-by: Paolo Bonzini <[email protected]>
> ---
> arch/x86/kvm/x86.c | 3 ---
> 1 file changed, 3 deletions(-)
>
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index d563812ca229..90b4f50b9a84 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -10341,9 +10341,6 @@ static inline int vcpu_block(struct kvm_vcpu *vcpu)
>
> static inline bool kvm_vcpu_running(struct kvm_vcpu *vcpu)
> {
> - if (is_guest_mode(vcpu))
> - kvm_check_nested_events(vcpu);
> -
> return (vcpu->arch.mp_state == KVM_MP_STATE_RUNNABLE &&
> !vcpu->arch.apf.halted);
> }

Reviewed-by: Maxim Levitsky <[email protected]>

I tested this on AMD, and it seems to work fine, and my nested AVIC test
works as good as was before.

Note that I forgot to mention, that I had to apply most of the patches
manually, they don't apply to kvm/queue.

Best regards,
Maxim Levitsky

2022-07-20 09:38:24

by Maxim Levitsky

[permalink] [raw]
Subject: Re: [PATCH 0/2] KVM: x86: never write to memory from kvm_vcpu_check_block

On Wed, 2022-04-27 at 13:37 -0400, Paolo Bonzini wrote:
> Maxim reported the following backtrace:
>
> [ 1355.807187]  kvm_vcpu_map+0x159/0x190 [kvm]
> [ 1355.807628]  nested_svm_vmexit+0x4c/0x7f0 [kvm_amd]
> [ 1355.808036]  ? kvm_vcpu_block+0x54/0xa0 [kvm]
> [ 1355.808450]  svm_check_nested_events+0x97/0x390 [kvm_amd]
> [ 1355.808920]  kvm_check_nested_events+0x1c/0x40 [kvm]
> [ 1355.809396]  kvm_arch_vcpu_runnable+0x4e/0x190 [kvm]
> [ 1355.809892]  kvm_vcpu_check_block+0x4f/0x100 [kvm]
> [ 1355.811259]  kvm_vcpu_block+0x6b/0xa0 [kvm]
>
> due to kmap being called in non-sleepable (!TASK_RUNNING) context.
> Fix it by extending kvm_x86_ops->nested_ops.hv_timer_pending and
> getting rid of one annoying instance of kvm_check_nested_events.
>
> Paolo
>

Any update on this patch series? Pinging so it is not forgotten.

Best regards,
Maxim Levitsky