linux-kernel - Re: [PATCH 0/5] kvm: fix latent guest entry/exit bugs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Tue, 11 Jan 2022 10:47:38 -0800 (PST)
From:   Palmer Dabbelt <palmer@...belt.com>
To:     mark.rutland@....com
CC:     linux-kernel@...r.kernel.org, aleksandar.qemu.devel@...il.com,
        alexandru.elisei@....com, anup@...infault.org,
        aou@...s.berkeley.edu, Atish Patra <atishp@...osinc.com>,
        benh@...nel.crashing.org, borntraeger@...ux.ibm.com, bp@...en8.de,
        catalin.marinas@....com, chenhuacai@...nel.org,
        dave.hansen@...ux.intel.com, david@...hat.com,
        frankja@...ux.ibm.com, frederic@...nel.org, gor@...ux.ibm.com,
        hca@...ux.ibm.com, imbrenda@...ux.ibm.com, james.morse@....com,
        jmattson@...gle.com, joro@...tes.org, kvm@...r.kernel.org,
        mark.rutland@....com, Marc Zyngier <maz@...nel.org>,
        mingo@...hat.com, mpe@...erman.id.au, nsaenzju@...hat.com,
        paulmck@...nel.org, paulus@...ba.org,
        Paul Walmsley <paul.walmsley@...ive.com>, pbonzini@...hat.com,
        seanjc@...gle.com, suzuki.poulose@....com, tglx@...utronix.de,
        tsbogend@...ha.franken.de, vkuznets@...hat.com,
        wanpengli@...cent.com, Will Deacon <will@...nel.org>
Subject:     Re: [PATCH 0/5] kvm: fix latent guest entry/exit bugs

On Tue, 11 Jan 2022 07:35:34 PST (-0800), mark.rutland@....com wrote:
> Several architectures have latent bugs around guest entry/exit, most
> notably:
>
> 1) Several architectures enable interrupts between guest_enter() and
>    guest_exit(). As this period is an RCU extended quiescent state (EQS) this
>    is unsound unless the irq entry code explicitly wakes RCU, which most
>    architectures only do for entry from usersapce or idle.
>
>    I believe this affects: arm64, riscv, s390
>
>    I am not sure about powerpc.
>
> 2) Several architectures permit instrumentation of code between
>    guest_enter() and guest_exit(), e.g. KASAN, KCOV, KCSAN, etc. As
>    instrumentation may directly o indirectly use RCU, this has the same
>    problems as with interrupts.
>
>    I believe this affects: arm64, mips, powerpc, riscv, s390

Moving to Atish and Anup's new email addresses, looks like MAINTAINERS 
hasn't been updated yet.  I thought I remembering seeing patches getting 
picked up for these, but LMK if you guys were expecting me to send them 
along -- sorry if I misunderstood!

>
> 3) Several architectures do not inform lockdep and tracing that
>    interrupts are enabled during the execution of the guest, or do so in
>    an incorrect order. Generally
>    this means that logs will report IRQs being masked for much longer
>    than is actually the case, which is not ideal for debugging. I don't
>    know whether this affects the correctness of lockdep.
>
>    I believe this affects: arm64, mips, powerpc, riscv, s390
>
> This was previously fixed for x86 specifically in a series of commits:
>
>   87fa7f3e98a1310e ("x86/kvm: Move context tracking where it belongs")
>   0642391e2139a2c1 ("x86/kvm/vmx: Add hardirq tracing to guest enter/exit")
>   9fc975e9efd03e57 ("x86/kvm/svm: Add hardirq tracing on guest enter/exit")
>   3ebccdf373c21d86 ("x86/kvm/vmx: Move guest enter/exit into .noinstr.text")
>   135961e0a7d555fc ("x86/kvm/svm: Move guest enter/exit into .noinstr.text")
>   160457140187c5fb ("KVM: x86: Defer vtime accounting 'til after IRQ handling")
>   bc908e091b326467 ("KVM: x86: Consolidate guest enter/exit logic to common helpers")
>
> But other architectures were left broken, and the infrastructure for
> handling this correctly is x86-specific.
>
> This series introduces generic helper functions which can be used to
> handle the problems above, and migrates architectures over to these,
> fixing the latent issues.
>
> I wasn't able to figure my way around powerpc and s390, so I have not
> altered these. I'd appreciate if anyone could take a look at those
> cases, and either have a go at patches or provide some feedback as to
> any alternative approaches which work work better there.
>
> I have build-tested the arm64, mips, riscv, and x86 cases, but I don't
> have a suitable HW setup to test these, so any review and/or testing
> would be much appreciated.
>
> I've pushed the series (based on v5.16) to my kvm/entry-rework branch:
>
>   https://git.kernel.org/pub/scm/linux/kernel/git/mark/linux.git/log/?h=kvm/entry-rework
>   git://git.kernel.org/pub/scm/linux/kernel/git/mark/linux.git kvm/entry-rework
>
> ... also tagged as kvm-entry-rework-20210111
>
> Thanks,
> Mark.
>
> Mark Rutland (5):
>   kvm: add exit_to_guest_mode() and enter_from_guest_mode()
>   kvm/arm64: rework guest entry logic
>   kvm/mips: rework guest entry logic
>   kvm/riscv: rework guest entry logic
>   kvm/x86: rework guest entry logic
>
>  arch/arm64/kvm/arm.c     |  51 +++++++++++-------
>  arch/mips/kvm/mips.c     |  37 ++++++++++++--
>  arch/riscv/kvm/vcpu.c    |  44 ++++++++++------
>  arch/x86/kvm/svm/svm.c   |   4 +-
>  arch/x86/kvm/vmx/vmx.c   |   4 +-
>  arch/x86/kvm/x86.c       |   4 +-
>  arch/x86/kvm/x86.h       |  45 ----------------
>  include/linux/kvm_host.h | 108 +++++++++++++++++++++++++++++++++++++--
>  8 files changed, 206 insertions(+), 91 deletions(-)