From nobody Tue May 7 02:21:17 2024 Delivered-To: importer2@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass header.i=@intel.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer2=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1653400730; cv=none; d=zohomail.com; s=zohoarc; b=Op04IMQ5JGZ4leIUf68EjS7kfUNTkjH36jKC92f/ztdGmYZjl9thatZqy/pOvK27uMrsQWsIB3QDFhuRKHKKqWVXVd60yY3/8JrvT00DL+G/5apql5drCLNxcqTOyjH5huRg3C407NRRRmB74zOhEcuREOlrKfIS3FAyGga0utc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1653400730; h=Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:Message-ID:References:Sender:Subject:To; bh=yoLcnqriCWJ1UkfjmD2syJuU4q9jV0TYEt+hvgi9/vU=; b=IRsPnqghCGxhwkDMU/qyeuziLyE/hUmwEK8I+fPq0AwwV+Sq61ZcaZ4cQ8eCBv96BJME1WKgaXEsPDVYqHJMXG5aZXupJBBHLvSu0YmjCRQiT/FmWgNkbG1gUgEptBuEDWAVA6VjFoW0o96ZocsLrSXLKxJFkt9kS7vUtnbQhvk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=@intel.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer2=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1653400730534152.1109982055184; Tue, 24 May 2022 06:58:50 -0700 (PDT) Received: from localhost ([::1]:43384 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ntV3g-00034k-GH for importer2@patchew.org; Tue, 24 May 2022 09:58:48 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:43564) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ntV1r-0000xw-Ag for qemu-devel@nongnu.org; Tue, 24 May 2022 09:56:55 -0400 Received: from mga05.intel.com ([192.55.52.43]:62583) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ntV1o-0003H8-Jz for qemu-devel@nongnu.org; Tue, 24 May 2022 09:56:54 -0400 Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 May 2022 06:56:50 -0700 Received: from chenyi-pc.sh.intel.com ([10.239.159.73]) by fmsmga001-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 May 2022 06:56:48 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1653400612; x=1684936612; h=from:to:cc:subject:date:message-id:in-reply-to: references; bh=JdShOr5JW3EdD/+1WRPhlMd9UsMATYvu9LGcy64jWZk=; b=LpXIkH3Vzjg6GQ4OE+pq880Q/mn+e/w5Qj85N1yMnjQLx5su8aE72WME x/1giQBUI7YElQDuqIE+10JHud1FG6rmNuhYrqlxQ4OyKiCTpZiiO3hPk FMfAZ+AaaJEi1v8vqSl+gi7jDuC6Zrtpfnl+d9B6aqYatXqqIpF2s4Xkj ZRGe/APIzLtBDXSnfsURdSBduAE4oOpPNAGUe1sr8ki7HwKhTODsxIs+w lbvcvUaAbwnRdbhaRQAwv8OzkDT8z+nGnIsrgsmLKsVFsqNO5xY3prIqO g4MVkJshkH1epbGfmtZq2y6Jlj0B5YsR5JXuAJStaUMYkdyYNfpC59Vhy A==; X-IronPort-AV: E=McAfee;i="6400,9594,10356"; a="359928373" X-IronPort-AV: E=Sophos;i="5.91,248,1647327600"; d="scan'208";a="359928373" X-IronPort-AV: E=Sophos;i="5.91,248,1647327600"; d="scan'208";a="717179432" From: Chenyi Qiang To: Paolo Bonzini , Sean Christopherson , Richard Henderson , Eduardo Habkost , Marcelo Tosatti , Xiaoyao Li Cc: Chenyi Qiang , qemu-devel@nongnu.org, kvm@vger.kernel.org Subject: [PATCH v4 1/3] linux-header: update linux header Date: Tue, 24 May 2022 22:03:00 +0800 Message-Id: <20220524140302.23272-2-chenyi.qiang@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20220524140302.23272-1-chenyi.qiang@intel.com> References: <20220524140302.23272-1-chenyi.qiang@intel.com> Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer2=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=192.55.52.43; envelope-from=chenyi.qiang@intel.com; helo=mga05.intel.com X-Spam_score_int: -44 X-Spam_score: -4.5 X-Spam_bar: ---- X-Spam_report: (-4.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.082, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer2=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: pass (identity @intel.com) X-ZM-MESSAGEID: 1653400731297100001 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" This linux-header update is only a reference to include some definitions related to notify VM exit. Signed-off-by: Chenyi Qiang --- linux-headers/asm-x86/kvm.h | 6 +++++- linux-headers/linux/kvm.h | 11 +++++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/linux-headers/asm-x86/kvm.h b/linux-headers/asm-x86/kvm.h index bf6e96011d..8791f7c228 100644 --- a/linux-headers/asm-x86/kvm.h +++ b/linux-headers/asm-x86/kvm.h @@ -325,6 +325,7 @@ struct kvm_reinject_control { #define KVM_VCPUEVENT_VALID_SHADOW 0x00000004 #define KVM_VCPUEVENT_VALID_SMM 0x00000008 #define KVM_VCPUEVENT_VALID_PAYLOAD 0x00000010 +#define KVM_VCPUEVENT_VALID_TRIPLE_FAULT 0x00000020 =20 /* Interrupt shadow states */ #define KVM_X86_SHADOW_INT_MOV_SS 0x01 @@ -359,7 +360,10 @@ struct kvm_vcpu_events { __u8 smm_inside_nmi; __u8 latched_init; } smi; - __u8 reserved[27]; + struct { + __u8 pending; + } triple_fault; + __u8 reserved[26]; __u8 exception_has_payload; __u64 exception_payload; }; diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h index d232feaae9..81dfdcfaa1 100644 --- a/linux-headers/linux/kvm.h +++ b/linux-headers/linux/kvm.h @@ -270,6 +270,7 @@ struct kvm_xen_exit { #define KVM_EXIT_X86_BUS_LOCK 33 #define KVM_EXIT_XEN 34 #define KVM_EXIT_RISCV_SBI 35 +#define KVM_EXIT_NOTIFY 36 =20 /* For KVM_EXIT_INTERNAL_ERROR */ /* Emulate instruction failed. */ @@ -487,6 +488,11 @@ struct kvm_run { unsigned long args[6]; unsigned long ret[2]; } riscv_sbi; + /* KVM_EXIT_NOTIFY */ + struct { +#define KVM_NOTIFY_CONTEXT_INVALID (1 << 0) + __u32 flags; + } notify; /* Fix the size of the union. */ char padding[256]; }; @@ -1134,6 +1140,8 @@ struct kvm_ppc_resize_hpt { #define KVM_CAP_VM_GPA_BITS 207 #define KVM_CAP_XSAVE2 208 #define KVM_CAP_SYS_ATTRIBUTES 209 +#define KVM_CAP_TRIPLE_FAULT_EVENT 216 +#define KVM_CAP_X86_NOTIFY_VMEXIT 217 =20 #ifdef KVM_CAP_IRQ_ROUTING =20 @@ -2051,4 +2059,7 @@ struct kvm_stats_desc { /* Available with KVM_CAP_XSAVE2 */ #define KVM_GET_XSAVE2 _IOR(KVMIO, 0xcf, struct kvm_xsave) =20 +#define KVM_X86_NOTIFY_VMEXIT_ENABLED (1ULL << 0) +#define KVM_X86_NOTIFY_VMEXIT_USER (1ULL << 1) + #endif /* __LINUX_KVM_H */ --=20 2.17.1 From nobody Tue May 7 02:21:17 2024 Delivered-To: importer2@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass header.i=@intel.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer2=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1653400834; cv=none; d=zohomail.com; s=zohoarc; b=nDEP+WKCU7+/IpRBQtIZoxrYzUHfz4VOl/ZP7FuhanndtPzIZHZ3t1MIBXtP2erITB5fjPElxQAl7voJXpnv4NSp7ziVMvmXkxVqKuQihY3aaFlnsFwcNKI03tHzcY8IP8nmXjlXyxKrlXszAbNlBB4QZ5+4+BLiuEdZ/3OqEHE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1653400834; h=Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:Message-ID:References:Sender:Subject:To; bh=1QjGyxlKAenn/k6JBbwtY81mcm4QLboUhjjkWxwSDv0=; b=DmHKA1+PsN4Yu6QLu8sD8M2TY9K9jfkeQ6drpKS01lCjlfP4Lw92/83B3NLX7c+NXdCSoTSq3WSEikCHbkNb7FmgueSwB2KVRmht1i1BsN2cYfEXJziFeLvfkVeWVDQfbWdnV/CffStGxf0SyKNFed2PHKbCwwwuXYUFm5Xr7yQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=@intel.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer2=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1653400834932815.1370425612146; Tue, 24 May 2022 07:00:34 -0700 (PDT) Received: from localhost ([::1]:47216 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ntV5N-0005dv-KQ for importer2@patchew.org; Tue, 24 May 2022 10:00:33 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:43570) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ntV1r-0000zr-La for qemu-devel@nongnu.org; Tue, 24 May 2022 09:56:55 -0400 Received: from mga05.intel.com ([192.55.52.43]:62573) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ntV1p-0003Gp-Qb for qemu-devel@nongnu.org; Tue, 24 May 2022 09:56:55 -0400 Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 May 2022 06:56:52 -0700 Received: from chenyi-pc.sh.intel.com ([10.239.159.73]) by fmsmga001-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 May 2022 06:56:50 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1653400613; x=1684936613; h=from:to:cc:subject:date:message-id:in-reply-to: references; bh=RrS6kepK7TXKuEYh/sgiRn166QnJLj40olbhHYklvg8=; b=NeiE3X+JMUE8W8rd8+1PXU0ZhWyxLNDU+hePjEKp/batjIb5FpIgLGgj l8MiPpYZAU0/010ODONh4CEY79OSmhxLSNlNBgdHYU9SUFRGwSU67eOsf /7h9olyJVVjG/CjSyjfa0+XLMV70jG3b2zuHOMLsz97pbjM9f+zyktPrX 2LWkRJGU9R36ZqYFbMzc3pF0xHV9wLUw0BXItO+eervmKSUt9jpYHsmBZ CNoXPqfS82+JrdQ2GTs2eEsy4gD7CJTXNE+LG+2jqne3BVnwMzLYAw0rO PF/NSWg0i3dLMWm95VoMHtzw0BURTPtIJJJWZfmFn8Tfg1sqLOMegxbB4 g==; X-IronPort-AV: E=McAfee;i="6400,9594,10356"; a="359928389" X-IronPort-AV: E=Sophos;i="5.91,248,1647327600"; d="scan'208";a="359928389" X-IronPort-AV: E=Sophos;i="5.91,248,1647327600"; d="scan'208";a="717179444" From: Chenyi Qiang To: Paolo Bonzini , Sean Christopherson , Richard Henderson , Eduardo Habkost , Marcelo Tosatti , Xiaoyao Li Cc: Chenyi Qiang , qemu-devel@nongnu.org, kvm@vger.kernel.org Subject: [PATCH v4 2/3] i386: kvm: extend kvm_{get, put}_vcpu_events to support pending triple fault Date: Tue, 24 May 2022 22:03:01 +0800 Message-Id: <20220524140302.23272-3-chenyi.qiang@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20220524140302.23272-1-chenyi.qiang@intel.com> References: <20220524140302.23272-1-chenyi.qiang@intel.com> Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer2=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=192.55.52.43; envelope-from=chenyi.qiang@intel.com; helo=mga05.intel.com X-Spam_score_int: -44 X-Spam_score: -4.5 X-Spam_bar: ---- X-Spam_report: (-4.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.082, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer2=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: pass (identity @intel.com) X-ZM-MESSAGEID: 1653400836468100003 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" For the direct triple faults, i.e. hardware detected and KVM morphed to VM-Exit, KVM will never lose them. But for triple faults sythesized by KVM, e.g. the RSM path, if KVM exits to userspace before the request is serviced, userspace could migrate the VM and lose the triple fault. A new flag KVM_VCPUEVENT_VALID_TRIPLE_FAULT is defined to signal that the event.triple_fault_pending field contains a valid state if the KVM_CAP_TRIPLE_FAULT_EVENT capability is enabled. Signed-off-by: Chenyi Qiang --- target/i386/cpu.c | 1 + target/i386/cpu.h | 1 + target/i386/kvm/kvm.c | 20 ++++++++++++++++++++ 3 files changed, 22 insertions(+) diff --git a/target/i386/cpu.c b/target/i386/cpu.c index cb6b5467d0..276058d52e 100644 --- a/target/i386/cpu.c +++ b/target/i386/cpu.c @@ -5998,6 +5998,7 @@ static void x86_cpu_reset(DeviceState *dev) env->exception_has_payload =3D false; env->exception_payload =3D 0; env->nmi_injected =3D false; + env->triple_fault_pending =3D false; #if !defined(CONFIG_USER_ONLY) /* We hard-wire the BSP to the first CPU. */ apic_designate_bsp(cpu->apic_state, s->cpu_index =3D=3D 0); diff --git a/target/i386/cpu.h b/target/i386/cpu.h index 982c532353..a2a9423747 100644 --- a/target/i386/cpu.h +++ b/target/i386/cpu.h @@ -1701,6 +1701,7 @@ typedef struct CPUArchState { uint8_t has_error_code; uint8_t exception_has_payload; uint64_t exception_payload; + bool triple_fault_pending; uint32_t ins_len; uint32_t sipi_vector; bool tsc_valid; diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c index 9cf8e03669..2f2fc18b4f 100644 --- a/target/i386/kvm/kvm.c +++ b/target/i386/kvm/kvm.c @@ -129,6 +129,7 @@ static int has_xcrs; static int has_pit_state2; static int has_sregs2; static int has_exception_payload; +static int has_triple_fault_event; =20 static bool has_msr_mcg_ext_ctl; =20 @@ -2385,6 +2386,16 @@ int kvm_arch_init(MachineState *ms, KVMState *s) } } =20 + has_triple_fault_event =3D kvm_check_extension(s, KVM_CAP_TRIPLE_FAULT= _EVENT); + if (has_triple_fault_event) { + ret =3D kvm_vm_enable_cap(s, KVM_CAP_TRIPLE_FAULT_EVENT, 0, true); + if (ret < 0) { + error_report("kvm: Failed to enable triple fault event cap: %s= ", + strerror(-ret)); + return ret; + } + } + ret =3D kvm_get_supported_msrs(s); if (ret < 0) { return ret; @@ -4105,6 +4116,11 @@ static int kvm_put_vcpu_events(X86CPU *cpu, int leve= l) } } =20 + if (has_triple_fault_event) { + events.flags |=3D KVM_VCPUEVENT_VALID_TRIPLE_FAULT; + events.triple_fault.pending =3D env->triple_fault_pending; + } + return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_VCPU_EVENTS, &events); } =20 @@ -4174,6 +4190,10 @@ static int kvm_get_vcpu_events(X86CPU *cpu) } } =20 + if (events.flags & KVM_VCPUEVENT_VALID_TRIPLE_FAULT) { + env->triple_fault_pending =3D events.triple_fault.pending; + } + env->sipi_vector =3D events.sipi_vector; =20 return 0; --=20 2.17.1 From nobody Tue May 7 02:21:17 2024 Delivered-To: importer2@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass header.i=@intel.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer2=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1653401212; cv=none; d=zohomail.com; s=zohoarc; b=LfjY5gXXp9k5czLfsgnR32SKIfoPwi54+Jfk79ql9DnnSVEYIrsCxZiPIYkyTvjbLTA3wSGIZoZHlRkZG870I8xJe/wUvpCM0j301YjUFneoIRuZVlyuhqQqGrSMjJCJ+lF0GYU4SSHU/uh9ZvdNtwSJwCMhz5qlg8v16ETFqME= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1653401212; h=Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:Message-ID:References:Sender:Subject:To; bh=8oT0HlIG6aUWx9VT+RMJ86jQITxQQIjmwuGMvkKY9SU=; b=hqDf80KEXyqu6nwtNA4KMSIF+9OKn3GMawfXl/cjW66d12L84u3WmzqR9mJEyl6Bivrvx+6aIack7XpM6lImWWun+Gyr+9Dt5N/1+O2MBtcBPWH3xvHGN2LwQs6a51D4saUVrxmpAjohaAr+OZbbWYSNPADMHaHdFST8IODsWEE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=@intel.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer2=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1653401212147891.114048099483; Tue, 24 May 2022 07:06:52 -0700 (PDT) Received: from localhost ([::1]:53706 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ntVBS-0001v2-Ch for importer2@patchew.org; Tue, 24 May 2022 10:06:50 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:43586) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ntV1u-00016l-4u for qemu-devel@nongnu.org; Tue, 24 May 2022 09:56:58 -0400 Received: from mga05.intel.com ([192.55.52.43]:62573) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ntV1r-0003Gp-VC for qemu-devel@nongnu.org; Tue, 24 May 2022 09:56:57 -0400 Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 May 2022 06:56:55 -0700 Received: from chenyi-pc.sh.intel.com ([10.239.159.73]) by fmsmga001-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 May 2022 06:56:52 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1653400615; x=1684936615; h=from:to:cc:subject:date:message-id:in-reply-to: references; bh=pIg9Ocn5efaX7OdYWsm6Um5aagELN6npfFKsfQ3VSZU=; b=kcX//+PTir5JmcWzwcyVo+eLrwOp9HqLn15qbBHuIuFbfy+OABrbS3lJ m2Vg04/ryjc0w7RDdHyu5LW9qxIm3N9wAoUHklwTc5Fo5oSG6opWVm8Ym xdsyosRsxc25ZwFUsnVF0Dbkq4qP6+ftuvNitQR5OTT41DCRbOvc9ZfNV Y6JOhGcliFT4VRS7ZoAqcIUA45lXB9bWFHziaClvjG/+IqgN9h8A2VcRE VpmXr8YD+hxyiRhqctji6ch4WIAW8FjECMORiL+koWp3UUf69zI92D2PV 1d16e52J2nZVQod8jSK15uYfEdsy9NRh7CaA87cut/I0M19RqUG55OVMv Q==; X-IronPort-AV: E=McAfee;i="6400,9594,10356"; a="359928405" X-IronPort-AV: E=Sophos;i="5.91,248,1647327600"; d="scan'208";a="359928405" X-IronPort-AV: E=Sophos;i="5.91,248,1647327600"; d="scan'208";a="717179454" From: Chenyi Qiang To: Paolo Bonzini , Sean Christopherson , Richard Henderson , Eduardo Habkost , Marcelo Tosatti , Xiaoyao Li Cc: Chenyi Qiang , qemu-devel@nongnu.org, kvm@vger.kernel.org Subject: [PATCH v4 3/3] i386: Add notify VM exit support Date: Tue, 24 May 2022 22:03:02 +0800 Message-Id: <20220524140302.23272-4-chenyi.qiang@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20220524140302.23272-1-chenyi.qiang@intel.com> References: <20220524140302.23272-1-chenyi.qiang@intel.com> Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer2=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=192.55.52.43; envelope-from=chenyi.qiang@intel.com; helo=mga05.intel.com X-Spam_score_int: -44 X-Spam_score: -4.5 X-Spam_bar: ---- X-Spam_report: (-4.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.082, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer2=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: pass (identity @intel.com) X-ZM-MESSAGEID: 1653401213235100001 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" There are cases that malicious virtual machine can cause CPU stuck (due to event windows don't open up), e.g., infinite loop in microcode when nested #AC (CVE-2015-5307). No event window means no event (NMI, SMI and IRQ) can be delivered. It leads the CPU to be unavailable to host or other VMs. Notify VM exit is introduced to mitigate such kind of attacks, which will generate a VM exit if no event window occurs in VM non-root mode for a specified amount of time (notify window). A new KVM capability KVM_CAP_X86_NOTIFY_VMEXIT is exposed to user space so that the user can query the capability and set the expected notify window when creating VMs. The format of the argument when enabling this capability is as follows: Bit 63:32 - notify window specified in qemu command Bit 31:0 - some flags (e.g. KVM_X86_NOTIFY_VMEXIT_ENABLED is set to enable the feature.) Because there are some concerns, e.g. a notify VM exit may happen with VM_CONTEXT_INVALID set in exit qualification (no cases are anticipated that would set this bit), which means VM context is corrupted. To avoid the false positive and a well-behaved guest gets killed, make this feature disabled by default. Users can enable the feature by a new machine property: qemu -machine notify_vmexit=3Don,notify_window=3D0 ... A new KVM exit reason KVM_EXIT_NOTIFY is defined for notify VM exit. If it happens with VM_INVALID_CONTEXT, hypervisor exits to user space to inform the fatal case. Then user space can inject a SHUTDOWN event to the target vcpu. This is implemented by injecting a sythesized triple fault event. Signed-off-by: Chenyi Qiang --- hw/i386/x86.c | 45 +++++++++++++++++++++++++++++ include/hw/i386/x86.h | 5 ++++ target/i386/kvm/kvm.c | 66 ++++++++++++++++++++++++++++++------------- 3 files changed, 96 insertions(+), 20 deletions(-) diff --git a/hw/i386/x86.c b/hw/i386/x86.c index 4cf107baea..a82f959cb9 100644 --- a/hw/i386/x86.c +++ b/hw/i386/x86.c @@ -1296,6 +1296,37 @@ static void machine_set_sgx_epc(Object *obj, Visitor= *v, const char *name, qapi_free_SgxEPCList(list); } =20 +static bool x86_machine_get_notify_vmexit(Object *obj, Error **errp) +{ + X86MachineState *x86ms =3D X86_MACHINE(obj); + + return x86ms->notify_vmexit; +} + +static void x86_machine_set_notify_vmexit(Object *obj, bool value, Error *= *errp) +{ + X86MachineState *x86ms =3D X86_MACHINE(obj); + + x86ms->notify_vmexit =3D value; +} + +static void x86_machine_get_notify_window(Object *obj, Visitor *v, + const char *name, void *opaque, Error **er= rp) +{ + X86MachineState *x86ms =3D X86_MACHINE(obj); + uint32_t notify_window =3D x86ms->notify_window; + + visit_type_uint32(v, name, ¬ify_window, errp); +} + +static void x86_machine_set_notify_window(Object *obj, Visitor *v, + const char *name, void *opaque, Error **err= p) +{ + X86MachineState *x86ms =3D X86_MACHINE(obj); + + visit_type_uint32(v, name, &x86ms->notify_window, errp); +} + static void x86_machine_initfn(Object *obj) { X86MachineState *x86ms =3D X86_MACHINE(obj); @@ -1306,6 +1337,8 @@ static void x86_machine_initfn(Object *obj) x86ms->oem_id =3D g_strndup(ACPI_BUILD_APPNAME6, 6); x86ms->oem_table_id =3D g_strndup(ACPI_BUILD_APPNAME8, 8); x86ms->bus_lock_ratelimit =3D 0; + x86ms->notify_vmexit =3D false; + x86ms->notify_window =3D 0; } =20 static void x86_machine_class_init(ObjectClass *oc, void *data) @@ -1361,6 +1394,18 @@ static void x86_machine_class_init(ObjectClass *oc, = void *data) NULL, NULL); object_class_property_set_description(oc, "sgx-epc", "SGX EPC device"); + + object_class_property_add(oc, X86_MACHINE_NOTIFY_WINDOW, "uint32_t", + x86_machine_get_notify_window, + x86_machine_set_notify_window, NULL, NULL); + object_class_property_set_description(oc, X86_MACHINE_NOTIFY_WINDOW, + "Set the notify window required by notify VM exit"); + + object_class_property_add_bool(oc, X86_MACHINE_NOTIFY_VMEXIT, + x86_machine_get_notify_vmexit, + x86_machine_set_notify_vmexit); + object_class_property_set_description(oc, X86_MACHINE_NOTIFY_VMEXIT, + "Enable notify VM exit"); } =20 static const TypeInfo x86_machine_info =3D { diff --git a/include/hw/i386/x86.h b/include/hw/i386/x86.h index 916cc325ee..571ee8b667 100644 --- a/include/hw/i386/x86.h +++ b/include/hw/i386/x86.h @@ -80,6 +80,9 @@ struct X86MachineState { * which means no limitation on the guest's bus locks. */ uint64_t bus_lock_ratelimit; + + bool notify_vmexit; + uint32_t notify_window; }; =20 #define X86_MACHINE_SMM "smm" @@ -87,6 +90,8 @@ struct X86MachineState { #define X86_MACHINE_OEM_ID "x-oem-id" #define X86_MACHINE_OEM_TABLE_ID "x-oem-table-id" #define X86_MACHINE_BUS_LOCK_RATELIMIT "bus-lock-ratelimit" +#define X86_MACHINE_NOTIFY_VMEXIT "notify-vmexit" +#define X86_MACHINE_NOTIFY_WINDOW "notify-window" =20 #define TYPE_X86_MACHINE MACHINE_TYPE_NAME("x86") OBJECT_DECLARE_TYPE(X86MachineState, X86MachineClass, X86_MACHINE) diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c index 2f2fc18b4f..6aaedf3412 100644 --- a/target/i386/kvm/kvm.c +++ b/target/i386/kvm/kvm.c @@ -2345,6 +2345,10 @@ int kvm_arch_init(MachineState *ms, KVMState *s) int ret; struct utsname utsname; Error *local_err =3D NULL; + X86MachineState *x86ms; + + assert(object_dynamic_cast(OBJECT(ms), TYPE_X86_MACHINE)); + x86ms =3D X86_MACHINE(ms); =20 /* * Initialize SEV context, if required @@ -2450,8 +2454,7 @@ int kvm_arch_init(MachineState *ms, KVMState *s) } =20 if (kvm_check_extension(s, KVM_CAP_X86_SMM) && - object_dynamic_cast(OBJECT(ms), TYPE_X86_MACHINE) && - x86_machine_is_smm_enabled(X86_MACHINE(ms))) { + x86_machine_is_smm_enabled(x86ms)) { smram_machine_done.notify =3D register_smram_listener; qemu_add_machine_init_done_notifier(&smram_machine_done); } @@ -2479,25 +2482,34 @@ int kvm_arch_init(MachineState *ms, KVMState *s) } } =20 - if (object_dynamic_cast(OBJECT(ms), TYPE_X86_MACHINE)) { - X86MachineState *x86ms =3D X86_MACHINE(ms); + if (x86ms->bus_lock_ratelimit > 0) { + ret =3D kvm_check_extension(s, KVM_CAP_X86_BUS_LOCK_EXIT); + if (!(ret & KVM_BUS_LOCK_DETECTION_EXIT)) { + error_report("kvm: bus lock detection unsupported"); + return -ENOTSUP; + } + ret =3D kvm_vm_enable_cap(s, KVM_CAP_X86_BUS_LOCK_EXIT, 0, + KVM_BUS_LOCK_DETECTION_EXIT); + if (ret < 0) { + error_report("kvm: Failed to enable bus lock detection cap: %s= ", + strerror(-ret)); + return ret; + } + ratelimit_init(&bus_lock_ratelimit_ctrl); + ratelimit_set_speed(&bus_lock_ratelimit_ctrl, + x86ms->bus_lock_ratelimit, BUS_LOCK_SLICE_TIME= ); + } =20 - if (x86ms->bus_lock_ratelimit > 0) { - ret =3D kvm_check_extension(s, KVM_CAP_X86_BUS_LOCK_EXIT); - if (!(ret & KVM_BUS_LOCK_DETECTION_EXIT)) { - error_report("kvm: bus lock detection unsupported"); - return -ENOTSUP; - } - ret =3D kvm_vm_enable_cap(s, KVM_CAP_X86_BUS_LOCK_EXIT, 0, - KVM_BUS_LOCK_DETECTION_EXIT); - if (ret < 0) { - error_report("kvm: Failed to enable bus lock detection cap= : %s", - strerror(-ret)); - return ret; - } - ratelimit_init(&bus_lock_ratelimit_ctrl); - ratelimit_set_speed(&bus_lock_ratelimit_ctrl, - x86ms->bus_lock_ratelimit, BUS_LOCK_SLICE_= TIME); + if (x86ms->notify_vmexit && kvm_check_extension(s, KVM_CAP_X86_NOTIFY_= VMEXIT)) { + uint64_t notify_window_flags =3D ((uint64_t)x86ms->notify_window <= < 32) | + KVM_X86_NOTIFY_VMEXIT_ENABLED | + KVM_X86_NOTIFY_VMEXIT_USER; + ret =3D kvm_vm_enable_cap(s, KVM_CAP_X86_NOTIFY_VMEXIT, 0, + notify_window_flags); + if (ret < 0) { + error_report("kvm: Failed to enable notify vmexit cap: %s", + strerror(-ret)); + return ret; } } =20 @@ -4940,6 +4952,7 @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run= *run) X86CPU *cpu =3D X86_CPU(cs); uint64_t code; int ret; + struct kvm_vcpu_events events =3D {}; =20 switch (run->exit_reason) { case KVM_EXIT_HLT: @@ -4995,6 +5008,19 @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_ru= n *run) /* already handled in kvm_arch_post_run */ ret =3D 0; break; + case KVM_EXIT_NOTIFY: + ret =3D 0; + if (run->notify.flags & KVM_NOTIFY_CONTEXT_INVALID) { + warn_report("KVM: invalid context due to notify vmexit"); + if (has_triple_fault_event) { + events.flags |=3D KVM_VCPUEVENT_VALID_TRIPLE_FAULT; + events.triple_fault.pending =3D true; + ret =3D kvm_vcpu_ioctl(cs, KVM_SET_VCPU_EVENTS, &events); + } else { + ret =3D -1; + } + } + break; default: fprintf(stderr, "KVM: unknown exit reason %d\n", run->exit_reason); ret =3D -1; --=20 2.17.1