| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <e32174b183584904925f8217736acebb@EX13D32EUC003.ant.amazon.com>
Date: Wed, 22 Jun 2022 09:50:10 +0000
From: "Durrant, Paul" <pdurrant@...zon.co.uk>
To: Vitaly Kuznetsov <vkuznets@...hat.com>
CC: Paolo Bonzini <pbonzini@...hat.com>,
Sean Christopherson <seanjc@...gle.com>,
Wanpeng Li <wanpengli@...cent.com>,
Jim Mattson <jmattson@...gle.com>,
Joerg Roedel <joro@...tes.org>,
Thomas Gleixner <tglx@...utronix.de>,
Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
Dave Hansen <dave.hansen@...ux.intel.com>,
"H. Peter Anvin" <hpa@...or.com>,
"x86@...nel.org" <x86@...nel.org>,
"kvm@...r.kernel.org" <kvm@...r.kernel.org>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH] KVM: x86/xen: Update Xen CPUID Leaf 4 (tsc info) sub-leaves,
if present
> -----Original Message-----
> From: Vitaly Kuznetsov <vkuznets@...hat.com>
> Sent: 22 June 2022 10:40
> To: Durrant, Paul <pdurrant@...zon.co.uk>
> Cc: Paolo Bonzini <pbonzini@...hat.com>; Sean Christopherson <seanjc@...gle.com>; Wanpeng Li
> <wanpengli@...cent.com>; Jim Mattson <jmattson@...gle.com>; Joerg Roedel <joro@...tes.org>; Thomas
> Gleixner <tglx@...utronix.de>; Ingo Molnar <mingo@...hat.com>; Borislav Petkov <bp@...en8.de>; Dave
> Hansen <dave.hansen@...ux.intel.com>; H. Peter Anvin <hpa@...or.com>; x86@...nel.org;
> kvm@...r.kernel.org; linux-kernel@...r.kernel.org
> Subject: RE: [EXTERNAL][PATCH] KVM: x86/xen: Update Xen CPUID Leaf 4 (tsc info) sub-leaves, if present
>
> CAUTION: This email originated from outside of the organization. Do not click links or open
> attachments unless you can confirm the sender and know the content is safe.
>
>
>
> Paul Durrant <pdurrant@...zon.com> writes:
>
> > The scaling information in sub-leaf 1 should match the values in the
> > 'vcpu_info' sub-structure 'time_info' (a.k.a. pvclock_vcpu_time_info) which
> > is shared with the guest. The offset values are not set since a TSC offset
> > is already applied.
> > The host TSC frequency should also be set in sub-leaf 2.
> >
> > This patch adds a new kvm_xen_set_cpuid() function that scans for the
> > relevant CPUID leaf when the CPUID information is updated by the VMM and
> > stashes pointers to the sub-leaves in the kvm_vcpu_xen structure.
> > The values are then updated by a call to the, also new,
> > kvm_xen_setup_tsc_info() function made at the end of
> > kvm_guest_time_update() just before entering the guest.
> >
> > Signed-off-by: Paul Durrant <pdurrant@...zon.com>
> > ---
> > arch/x86/include/asm/kvm_host.h | 2 ++
> > arch/x86/kvm/cpuid.c | 2 ++
> > arch/x86/kvm/x86.c | 1 +
> > arch/x86/kvm/xen.c | 41 +++++++++++++++++++++++++++++++++
> > arch/x86/kvm/xen.h | 10 ++++++++
> > 5 files changed, 56 insertions(+)
> >
> > diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
> > index 1038ccb7056a..f77a4940542f 100644
> > --- a/arch/x86/include/asm/kvm_host.h
> > +++ b/arch/x86/include/asm/kvm_host.h
> > @@ -638,6 +638,8 @@ struct kvm_vcpu_xen {
> > struct hrtimer timer;
> > int poll_evtchn;
> > struct timer_list poll_timer;
> > + struct kvm_cpuid_entry2 *tsc_info_1;
> > + struct kvm_cpuid_entry2 *tsc_info_2;
> > };
> >
> > struct kvm_vcpu_arch {
> > diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
> > index d47222ab8e6e..eb6cd88c974a 100644
> > --- a/arch/x86/kvm/cpuid.c
> > +++ b/arch/x86/kvm/cpuid.c
> > @@ -25,6 +25,7 @@
> > #include "mmu.h"
> > #include "trace.h"
> > #include "pmu.h"
> > +#include "xen.h"
> >
> > /*
> > * Unlike "struct cpuinfo_x86.x86_capability", kvm_cpu_caps doesn't need to be
> > @@ -310,6 +311,7 @@ static void kvm_vcpu_after_set_cpuid(struct kvm_vcpu *vcpu)
> > __cr4_reserved_bits(guest_cpuid_has, vcpu);
> >
> > kvm_hv_set_cpuid(vcpu);
> > + kvm_xen_set_cpuid(vcpu);
> >
> > /* Invoke the vendor callback only after the above state is updated. */
> > static_call(kvm_x86_vcpu_after_set_cpuid)(vcpu);
> > diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> > index 00e23dc518e0..8b45f9975e45 100644
> > --- a/arch/x86/kvm/x86.c
> > +++ b/arch/x86/kvm/x86.c
> > @@ -3123,6 +3123,7 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
> > if (vcpu->xen.vcpu_time_info_cache.active)
> > kvm_setup_guest_pvclock(v, &vcpu->xen.vcpu_time_info_cache, 0);
> > kvm_hv_setup_tsc_page(v->kvm, &vcpu->hv_clock);
> > + kvm_xen_setup_tsc_info(v);
> > return 0;
> > }
> >
> > diff --git a/arch/x86/kvm/xen.c b/arch/x86/kvm/xen.c
> > index 610beba35907..a016ff85264d 100644
> > --- a/arch/x86/kvm/xen.c
> > +++ b/arch/x86/kvm/xen.c
> > @@ -10,6 +10,9 @@
> > #include "xen.h"
> > #include "hyperv.h"
> > #include "lapic.h"
> > +#include "cpuid.h"
> > +
> > +#include <asm/xen/cpuid.h>
> >
> > #include <linux/eventfd.h>
> > #include <linux/kvm_host.h>
> > @@ -1855,3 +1858,41 @@ void kvm_xen_destroy_vm(struct kvm *kvm)
> > if (kvm->arch.xen_hvm_config.msr)
> > static_branch_slow_dec_deferred(&kvm_xen_enabled);
> > }
> > +
> > +void kvm_xen_set_cpuid(struct kvm_vcpu *vcpu)
> > +{
> > + u32 base = 0;
> > + u32 function;
> > +
> > + for_each_possible_hypervisor_cpuid_base(function) {
> > + struct kvm_cpuid_entry2 *entry = kvm_find_cpuid_entry(vcpu, function, 0);
> > +
> > + if (entry &&
> > + entry->ebx == XEN_CPUID_SIGNATURE_EBX &&
> > + entry->ecx == XEN_CPUID_SIGNATURE_ECX &&
> > + entry->edx == XEN_CPUID_SIGNATURE_EDX) {
> > + base = function;
> > + break;
> > + }
> > + }
> > + if (!base)
> > + return;
> > +
> > + function = base | XEN_CPUID_LEAF(3);
> > + vcpu->arch.xen.tsc_info_1 = kvm_find_cpuid_entry(vcpu, function, 1);
> > + vcpu->arch.xen.tsc_info_2 = kvm_find_cpuid_entry(vcpu, function, 2);
> > +}
>
> Imagine the following scenario: CPUID data was supplied with Xen CPUID
> leaves first and then got updated with new information which doesn't
> have Xen CPUID info (e.g. has Hyper-V signature instead of Xen in the
> same 0x40000000 leaf). Won't arch.xen.tsc_info_1/arch.xen.tsc_info_2
> pointers become dangling here after we free the old CPUID data ...
>
> > +
> > +void kvm_xen_setup_tsc_info(struct kvm_vcpu *vcpu)
> > +{
> > + struct kvm_cpuid_entry2 *entry = vcpu->arch.xen.tsc_info_1;
> > +
> > + if (entry) {
> > + entry->ecx = vcpu->arch.hv_clock.tsc_to_system_mul;
> > + entry->edx = vcpu->arch.hv_clock.tsc_shift;
>
> ... just to crash everything here?
Yes, you are indeed correct. I'd never considered the leaves being removed from the set but the code should cope with this. V2 shortly.
Paul
>
> > + }
> > +
> > + entry = vcpu->arch.xen.tsc_info_2;
> > + if (entry)
> > + entry->eax = vcpu->arch.hw_tsc_khz;
> > +}
> > diff --git a/arch/x86/kvm/xen.h b/arch/x86/kvm/xen.h
> > index 532a535a9e99..1afb663318a9 100644
> > --- a/arch/x86/kvm/xen.h
> > +++ b/arch/x86/kvm/xen.h
> > @@ -32,6 +32,8 @@ int kvm_xen_set_evtchn_fast(struct kvm_xen_evtchn *xe,
> > int kvm_xen_setup_evtchn(struct kvm *kvm,
> > struct kvm_kernel_irq_routing_entry *e,
> > const struct kvm_irq_routing_entry *ue);
> > +void kvm_xen_set_cpuid(struct kvm_vcpu *vcpu);
> > +void kvm_xen_setup_tsc_info(struct kvm_vcpu *vcpu);
> >
> > static inline bool kvm_xen_msr_enabled(struct kvm *kvm)
> > {
> > @@ -135,6 +137,14 @@ static inline bool kvm_xen_timer_enabled(struct kvm_vcpu *vcpu)
> > {
> > return false;
> > }
> > +
> > +static inline void kvm_xen_set_cpuid(struct kvm_vcpu *vcpu)
> > +{
> > +}
> > +
> > +static inline void kvm_xen_setup_tsc_info(struct kvm_vcpu *vcpu)
> > +{
> > +}
> > #endif
> >
> > int kvm_xen_hypercall(struct kvm_vcpu *vcpu);
>
> --
> Vitaly
Powered by blists - more mailing lists