lkml.org 
[lkml]   [2022]   [Sep]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v4 1/9] KVM: x86/mmu: Bug the VM if KVM attempts to double count an NX huge page
On Wed, Sep 21, 2022, Vitaly Kuznetsov wrote:
> Sean Christopherson <seanjc@google.com> writes:
>
> > On Wed, Sep 21, 2022, Sean Christopherson wrote:
> >> On Wed, Sep 21, 2022, Vitaly Kuznetsov wrote:
> >> > [ 962.257992] ept_fetch+0x504/0x5a0 [kvm]
> >> > [ 962.261959] ept_page_fault+0x2d7/0x300 [kvm]
> >> > [ 962.287701] kvm_mmu_page_fault+0x258/0x290 [kvm]
> >> > [ 962.292451] vmx_handle_exit+0xe/0x40 [kvm_intel]
> >> > [ 962.297173] vcpu_enter_guest+0x665/0xfc0 [kvm]
> >> > [ 962.307580] vcpu_run+0x33/0x250 [kvm]
> >> > [ 962.311367] kvm_arch_vcpu_ioctl_run+0xf7/0x460 [kvm]
> >> > [ 962.316456] kvm_vcpu_ioctl+0x271/0x670 [kvm]
> >> > [ 962.320843] __x64_sys_ioctl+0x87/0xc0
> >> > [ 962.324602] do_syscall_64+0x38/0x90
> >> > [ 962.328192] entry_SYSCALL_64_after_hwframe+0x63/0xcd
> >>
> >> Ugh, past me completely forgot the basics of shadow paging[*]. The shadow MMU
> >> can reuse existing shadow pages, whereas the TDP MMU always links in new pages.
> >>
> >> I got turned around by the "doesn't exist" check, which only means "is there
> >> already a _SPTE_ here", not "is there an existing SP for the target gfn+role that
> >> can be used".
> >>
> >> I'll drop the series from the queue, send a new pull request, and spin a v5
> >> targeting 6.2, which amusing will look a lot like v1...
> >
> > Huh. I was expecting more churn, but dropping the offending patch and then
> > "reworking" the series yields a very trivial overall diff.
> >
> > Vitaly, can you easily re-test with the below, i.e. simply delete the
> > KVM_BUG_ON()?
>
> This seems to work! At least, I haven't noticed anything weird when
> booting my beloved Win11 + WSL2 guest.

I finally figured out why I didn't see this in testing. It _should_ have fired
during kernel boot when testing legacy shadow paging, i.e. ept=0, as the bug requires
nothing more than executing from two GVAs pointing at the same huge 2mb GPA.

I did test ept=0, but all of my normal test systems aren't susceptible to L1TF
(KVM guest, all AMD, and ICX), i.e. don't enable the mitigation by default. I
also tested those systems with the mitigation forced on and ept=0, but never
booted a VM with that combination, and neither KUT nor selftests does the requisite
aliasing with huge pages.

Death was instantaneous once I forced the mitigation on with ept=0 and booted a VM.

*sigh*

\
 
 \ /
  Last update: 2022-09-30 06:35    [W:0.760 / U:0.576 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site