linux-kernel - Re: [PATCH] KVM: x86: check PIR even for vCPUs with disabled APICv

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 17 Nov 2021 21:10:17 +0000
From:   Sean Christopherson <seanjc@...gle.com>
To:     Paolo Bonzini <pbonzini@...hat.com>
Cc:     linux-kernel@...r.kernel.org, kvm@...r.kernel.org,
        stable@...r.kernel.org
Subject: Re: [PATCH] KVM: x86: check PIR even for vCPUs with disabled APICv

On Wed, Nov 17, 2021, Paolo Bonzini wrote:
> After fixing the handling of POSTED_INTR_WAKEUP_VECTOR for vCPUs with
> disabled APICv, take care of POSTED_INTR_VECTOR.  The IRTE for an assigned
> device can trigger a POSTED_INTR_VECTOR even if APICv is disabled on the
> vCPU that receives it.  In that case, the interrupt will just cause a
> vmexit and leave the ON bit set together with the PIR bit corresponding
> to the interrupt.
> 
> Right now, the interrupt would not be delivered until APICv is re-enabled.
> However, fixing this is just a matter of always doing the PIR->IRR
> synchronization, even if the vCPU does not have APICv enabled.
> 
> This is not a problem for performance, or if anything it is an
> improvement.  static_call_cond will elide the function call if APICv is
> not present or disabled, or if (as is the case for AMD hardware) it does
> not require a sync_pir_to_irr callback.

The AMD part is not accurate, SVM's sync_pir_to_irr() is wired up to point at
kvm_lapic_find_highest_irr().  That can and probably should be fixed in a separate
patch, 

And I believe apic_has_interrupt_for_ppr() needs to be updated as well.

We can handled both at once by nullifying SVM's hook and explicitly checking for
a non-NULL implementation in apic_has_interrupt_for_ppr(), which is the only path
that cares about the result of sync_pir_to_irr(), i.e. needs to do the work in
the SVM case.

diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 4388d22df500..1456745cf5c6 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -707,7 +707,8 @@ static void pv_eoi_clr_pending(struct kvm_vcpu *vcpu)
 static int apic_has_interrupt_for_ppr(struct kvm_lapic *apic, u32 ppr)
 {
        int highest_irr;
-       if (apic->vcpu->arch.apicv_active)
+
+       if (kvm_x86_ops.sync_pir_to_irr)
                highest_irr = static_call(kvm_x86_sync_pir_to_irr)(apic->vcpu);
        else
                highest_irr = apic_find_highest_irr(apic);
diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index ccbf96876ec6..470552e68b7e 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -4649,7 +4649,7 @@ static struct kvm_x86_ops svm_x86_ops __initdata = {
        .load_eoi_exitmap = svm_load_eoi_exitmap,
        .hwapic_irr_update = svm_hwapic_irr_update,
        .hwapic_isr_update = svm_hwapic_isr_update,
-       .sync_pir_to_irr = kvm_lapic_find_highest_irr,
+       .sync_pir_to_irr = NULL,
        .apicv_post_state_restore = avic_post_state_restore,

        .set_tss_addr = svm_set_tss_addr,