linux-kernel - Re: [PATCH] KVM: nVMX: do not pin the VMCS12

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 27 Jul 2017 10:20:45 -0700
From:   David Matlack <dmatlack@...gle.com>
To:     Paolo Bonzini <pbonzini@...hat.com>
Cc:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        kvm list <kvm@...r.kernel.org>,
        Jim Mattson <jmattson@...gle.com>
Subject: Re: [PATCH] KVM: nVMX: do not pin the VMCS12

On Thu, Jul 27, 2017 at 6:54 AM, Paolo Bonzini <pbonzini@...hat.com> wrote:
> Since the current implementation of VMCS12 does a memcpy in and out
> of guest memory, we do not need current_vmcs12 and current_vmcs12_page
> anymore.  current_vmptr is enough to read and write the VMCS12.

This patch also fixes dirty tracking (memslot->dirty_bitmap) of the
VMCS12 page by using kvm_write_guest. nested_release_page() only marks
the struct page dirty.

>
> Signed-off-by: Paolo Bonzini <pbonzini@...hat.com>
> ---
>  arch/x86/kvm/vmx.c | 23 ++++++-----------------
>  1 file changed, 6 insertions(+), 17 deletions(-)
>
> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
> index b37161808352..142f16ebdca2 100644
> --- a/arch/x86/kvm/vmx.c
> +++ b/arch/x86/kvm/vmx.c
> @@ -416,9 +416,6 @@ struct nested_vmx {
>
>         /* The guest-physical address of the current VMCS L1 keeps for L2 */
>         gpa_t current_vmptr;
> -       /* The host-usable pointer to the above */
> -       struct page *current_vmcs12_page;
> -       struct vmcs12 *current_vmcs12;
>         /*
>          * Cache of the guest's VMCS, existing outside of guest memory.
>          * Loaded from guest memory during VMPTRLD. Flushed to guest
> @@ -7183,10 +7180,6 @@ static inline void nested_release_vmcs12(struct vcpu_vmx *vmx)
>         if (vmx->nested.current_vmptr == -1ull)
>                 return;
>
> -       /* current_vmptr and current_vmcs12 are always set/reset together */
> -       if (WARN_ON(vmx->nested.current_vmcs12 == NULL))
> -               return;
> -
>         if (enable_shadow_vmcs) {
>                 /* copy to memory all shadowed fields in case
>                    they were modified */
> @@ -7199,13 +7192,11 @@ static inline void nested_release_vmcs12(struct vcpu_vmx *vmx)
>         vmx->nested.posted_intr_nv = -1;
>
>         /* Flush VMCS12 to guest memory */
> -       memcpy(vmx->nested.current_vmcs12, vmx->nested.cached_vmcs12,
> -              VMCS12_SIZE);
> +       kvm_vcpu_write_guest_page(&vmx->vcpu,
> +                                 vmx->nested.current_vmptr >> PAGE_SHIFT,
> +                                 vmx->nested.cached_vmcs12, 0, VMCS12_SIZE);

Have you hit any "suspicious RCU usage" error messages during VM
teardown with this patch? We did when we replaced memcpy with
kvm_write_guest a while back. IIRC it was due to kvm->srcu not being
held in one of the teardown paths. kvm_write_guest() expects it to be
held in order to access memslots.

We fixed this by skipping the VMCS12 flush during VMXOFF. I'll send
that patch along with a few other nVMX dirty tracking related patches
I've been meaning to get upstreamed.

>
> -       kunmap(vmx->nested.current_vmcs12_page);
> -       nested_release_page(vmx->nested.current_vmcs12_page);
>         vmx->nested.current_vmptr = -1ull;
> -       vmx->nested.current_vmcs12 = NULL;
>  }
>
>  /*
> @@ -7623,14 +7614,13 @@ static int handle_vmptrld(struct kvm_vcpu *vcpu)
>                 }
>
>                 nested_release_vmcs12(vmx);
> -               vmx->nested.current_vmcs12 = new_vmcs12;
> -               vmx->nested.current_vmcs12_page = page;
>                 /*
>                  * Load VMCS12 from guest memory since it is not already
>                  * cached.
>                  */
> -               memcpy(vmx->nested.cached_vmcs12,
> -                      vmx->nested.current_vmcs12, VMCS12_SIZE);
> +               memcpy(vmx->nested.cached_vmcs12, new_vmcs12, VMCS12_SIZE);
> +               kunmap(page);

+ nested_release_page_clean(page);

> +
>                 set_current_vmptr(vmx, vmptr);
>         }
>
> @@ -9354,7 +9344,6 @@ static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id)
>
>         vmx->nested.posted_intr_nv = -1;
>         vmx->nested.current_vmptr = -1ull;
> -       vmx->nested.current_vmcs12 = NULL;
>
>         vmx->msr_ia32_feature_control_valid_bits = FEATURE_CONTROL_LOCKED;
>
> --
> 1.8.3.1
>