| Message ID | 3a5d86b6-9f1a-a6cf-8af4-ef6bf3936996@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
2016-07-11 18:14+0800, Yang Zhang: > On 2016/7/11 15:43, Paolo Bonzini wrote: >> On 11/07/2016 08:07, Yang Zhang wrote: >> > > >> > > mutex_lock(&kvm->arch.apic_map_lock); >> > > >> > > + kvm_for_each_vcpu(i, vcpu, kvm) >> > > + if (kvm_apic_present(vcpu)) >> > > + max_id = max(max_id, kvm_apic_id(vcpu->arch.apic)); >> > > + >> > > + new = kzalloc(sizeof(struct kvm_apic_map) + >> > > + sizeof(struct kvm_lapic *) * (max_id + 1), >> > > GFP_KERNEL); >> > > + >> > >> > I think this may cause the host runs out of memory if a malicious guest >> > did follow thing: >> > 1. vcpu a is doing apic map recalculation. >> > 2. vcpu b write the apic id with 0xff >> > 3. then vcpu b enable the x2apic: in kvm_lapic_set_base(), we will set >> > apic_base to new value before reset the apic id. >> > 4. vcpu a may see the x2apic enabled in vcpu b plus an old apic >> > id(0xff), and max_id will become (0xff >> 24). Indeed, thanks. The guest doesn't even have to be malicious ... >> The bug is not really here but in patch 6---but you're right nevertheless! Yes. >> I guess the easiest solution is to replace kvm_apic_id with a field in >> struct kvm_lapic, which is already shifted right by 24 in xAPIC mode. (I guess the fewest LOC is to look at vcpu->vcpu_id, which is equal to x2apic id. xapic id cannot be greater than 255 and all of those are covered by the initial value of max_id.) > Or we can just simply put the assignment of apic_base to the end. Yes, this would work, I'd also remove recalculates from kvm_apic_set_*apic_id() and add a compiler barrier with comment for good measure, even though set_virtual_x2apic_mode() serves as one. (What makes a bit wary is that it doesn't avoid the same problem if we changed KVM to reset apic id to xapic id first when disabling apic.) Races in recalculation and APIC ID changes also lead to invalid physical maps, which haven't been taken care of properly ... Having apic id stored in big endian, or "0-7,8-31" format, would be safest. I wanted to change the apic map to do incremental updates with with respect to the APIC that has changed, instead of being completely recomputed, so maybe the time is now. :) -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On 11/07/2016 15:48, Radim Krčmář wrote: >>> I guess the easiest solution is to replace kvm_apic_id with a field in >>> struct kvm_lapic, which is already shifted right by 24 in xAPIC mode. > > (I guess the fewest LOC is to look at vcpu->vcpu_id, which is equal to > x2apic id. xapic id cannot be greater than 255 and all of those are > covered by the initial value of max_id.) Yes, this would work too. Or even better perhaps, look at vcpu->vcpu_id in kvm_apic_id? >> Or we can just simply put the assignment of apic_base to the end. > > Yes, this would work, I'd also remove recalculates from > kvm_apic_set_*apic_id() and add a compiler barrier with comment for good > measure, even though set_virtual_x2apic_mode() serves as one. Why a compiler barrier? > (What makes a bit wary is that it doesn't avoid the same problem if we > changed KVM to reset apic id to xapic id first when disabling apic.) Yes, this is why I prefer it fixed once and for all in kvm_apic_id... > Races in recalculation and APIC ID changes also lead to invalid physical > maps, which haven't been taken care of properly ... Hmm, true, but can be fixed separately. Probably the mutex should be renamed so that it can be taken outside recalculate_apic_map... Paolo > Having apic id stored in big endian, or "0-7,8-31" format, would be > safest. I wanted to change the apic map to do incremental updates with > with respect to the APIC that has changed, instead of being completely > recomputed, so maybe the time is now. :) > -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
2016-07-11 16:14+0200, Paolo Bonzini: > On 11/07/2016 15:48, Radim Krčmář wrote: >>>> I guess the easiest solution is to replace kvm_apic_id with a field in >>>> struct kvm_lapic, which is already shifted right by 24 in xAPIC mode. >> >> (I guess the fewest LOC is to look at vcpu->vcpu_id, which is equal to >> x2apic id. xapic id cannot be greater than 255 and all of those are >> covered by the initial value of max_id.) > > Yes, this would work too. Or even better perhaps, look at vcpu->vcpu_id > in kvm_apic_id? APIC ID is writeable in xAPIC mode, which would make the implementation weird without an extra variable. Always read-only APIC ID would be best, IMO. >>> Or we can just simply put the assignment of apic_base to the end. >> >> Yes, this would work, I'd also remove recalculates from >> kvm_apic_set_*apic_id() and add a compiler barrier with comment for good >> measure, even though set_virtual_x2apic_mode() serves as one. > > Why a compiler barrier? True, it should be a proper pair of smp_wmb() and smp_rmb() in recalculate ... and current kvm_apic_id() reads in a wrong order, so changing the apic_base alone update wouldn't get rid of this race. >> (What makes a bit wary is that it doesn't avoid the same problem if we >> changed KVM to reset apic id to xapic id first when disabling apic.) > > Yes, this is why I prefer it fixed once and for all in kvm_apic_id... Seems most reasonable. We'll need to be careful to have a correct value in the apic page, but there shouldn't be any races there. >> Races in recalculation and APIC ID changes also lead to invalid physical >> maps, which haven't been taken care of properly ... > > Hmm, true, but can be fixed separately. Probably the mutex should be > renamed so that it can be taken outside recalculate_apic_map... Good point, it'll make reasoning easier and shouldn't introduce any extra scalability issues. -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On 11/07/2016 17:52, Radim Krčmář wrote: > 2016-07-11 16:14+0200, Paolo Bonzini: >> On 11/07/2016 15:48, Radim Krčmář wrote: >>>>> I guess the easiest solution is to replace kvm_apic_id with a field in >>>>> struct kvm_lapic, which is already shifted right by 24 in xAPIC mode. >>> >>> (I guess the fewest LOC is to look at vcpu->vcpu_id, which is equal to >>> x2apic id. xapic id cannot be greater than 255 and all of those are >>> covered by the initial value of max_id.) >> >> Yes, this would work too. Or even better perhaps, look at vcpu->vcpu_id >> in kvm_apic_id? > > APIC ID is writeable in xAPIC mode, which would make the implementation > weird without an extra variable. Always read-only APIC ID would be > best, IMO. You can do if (x2apic mode) return lapic->vcpu->vcpu_id; else return get_reg(APIC_ID) >> 24; The point is to avoid returning a shifted APIC_ID without shifting it. The alternative of course is just caching it, which at this point is not particularly harder... Paolo >>> (What makes a bit wary is that it doesn't avoid the same problem if we >>> changed KVM to reset apic id to xapic id first when disabling apic.) >> >> Yes, this is why I prefer it fixed once and for all in kvm_apic_id... > > Seems most reasonable. We'll need to be careful to have a correct value > in the apic page, but there shouldn't be any races there. > >>> Races in recalculation and APIC ID changes also lead to invalid physical >>> maps, which haven't been taken care of properly ... >> >> Hmm, true, but can be fixed separately. Probably the mutex should be >> renamed so that it can be taken outside recalculate_apic_map... > > Good point, it'll make reasoning easier and shouldn't introduce any > extra scalability issues. -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On 2016/7/11 23:52, Radim Krčmář wrote: > 2016-07-11 16:14+0200, Paolo Bonzini: >> On 11/07/2016 15:48, Radim Krčmář wrote: >>>>> I guess the easiest solution is to replace kvm_apic_id with a field in >>>>> struct kvm_lapic, which is already shifted right by 24 in xAPIC mode. >>> >>> (I guess the fewest LOC is to look at vcpu->vcpu_id, which is equal to >>> x2apic id. xapic id cannot be greater than 255 and all of those are >>> covered by the initial value of max_id.) >> >> Yes, this would work too. Or even better perhaps, look at vcpu->vcpu_id >> in kvm_apic_id? > > APIC ID is writeable in xAPIC mode, which would make the implementation > weird without an extra variable. Always read-only APIC ID would be > best, IMO. > >>>> Or we can just simply put the assignment of apic_base to the end. >>> >>> Yes, this would work, I'd also remove recalculates from >>> kvm_apic_set_*apic_id() and add a compiler barrier with comment for good >>> measure, even though set_virtual_x2apic_mode() serves as one. >> >> Why a compiler barrier? > > True, it should be a proper pair of smp_wmb() and smp_rmb() in > recalculate ... and current kvm_apic_id() reads in a wrong order, so > changing the apic_base alone update wouldn't get rid of this race. > >>> (What makes a bit wary is that it doesn't avoid the same problem if we >>> changed KVM to reset apic id to xapic id first when disabling apic.) >> >> Yes, this is why I prefer it fixed once and for all in kvm_apic_id... > > Seems most reasonable. We'll need to be careful to have a correct value > in the apic page, but there shouldn't be any races there. Yes, it is more reasonable. > >>> Races in recalculation and APIC ID changes also lead to invalid physical >>> maps, which haven't been taken care of properly ... >> >> Hmm, true, but can be fixed separately. Probably the mutex should be >> renamed so that it can be taken outside recalculate_apic_map... > > Good point, it'll make reasoning easier and shouldn't introduce any > extra scalability issues. If we can ensure all the updates to LDR,DFR,ID and apic mode are in correct sequence and followed with apic map recalculation, it should be enough. It's guest's responsibility to ensure the apic updating must happen in right time(means no interrupt is in flying), otherwise the interrupt may deliver to wrong VCPU.
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c index fdc05ae..9c69059 100644 --- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -1745,7 +1745,6 @@ void kvm_lapic_set_base(struct kvm_vcpu *vcpu, u64 value) return; } - vcpu->arch.apic_base = value; /* update jump label if enable bit changes */