[PATCH] KVM: VMX: Refresh available regs and IDT vectoring info before NMI handling

[PATCH] KVM: VMX: Refresh available regs and IDT vectoring info before NMI handling

[Sean Christopherson]

Reset the mask of available "registers" and refresh the IDT vectoring
info snapshot in vmx_vcpu_enter_exit(), before KVM potentially handles a
an NMI VM-Exit.  One of the "registers" that KVM VMX lazily loads is the
vmcs.VM_EXIT_INTR_INFO field, which is holds the vector+type on "exception
or NMI" VM-Exits, i.e. is needed to identify NMIs.  Clearing the available
registers bitmask after handling NMIs results in KVM querying info from
the last VM-Exit that read vmcs.VM_EXIT_INTR_INFO, and leads to both
missed NMIs and spurious NMIs in the host.

Opportunistically grab vmcs.IDT_VECTORING_INFO_FIELD early in the VM-Exit
path too, e.g. to guard against similar consumption of stale data.  The
field is read on every "normal" VM-Exit, and there's no point in delaying
the inevitable.

Reported-by: Like Xu <like.xu.linux@gmail.com>
Fixes: 11df586d774f ("KVM: VMX: Handle NMI VM-Exits in noinstr region")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
---

Like, this is lightly tested, any testing you can provide would be much
appreciated.  I definitely want to get coverage for this in selftests
and/or KUT, but I'm very short on cycles right now.

 arch/x86/kvm/vmx/vmx.c | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index e6849f780dba..d2b78ab7a9f2 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -7222,13 +7222,20 @@ static noinstr void vmx_vcpu_enter_exit(struct kvm_vcpu *vcpu,
 				   flags);
 
 	vcpu->arch.cr2 = native_read_cr2();
+	vcpu->arch.regs_avail &= ~VMX_REGS_LAZY_LOAD_SET;
+
+	vmx->idt_vectoring_info = 0;
 
 	vmx_enable_fb_clear(vmx);
 
-	if (unlikely(vmx->fail))
+	if (unlikely(vmx->fail)) {
 		vmx->exit_reason.full = 0xdead;
-	else
-		vmx->exit_reason.full = vmcs_read32(VM_EXIT_REASON);
+		goto out;
+	}
+
+	vmx->exit_reason.full = vmcs_read32(VM_EXIT_REASON);
+	if (likely(!vmx->exit_reason.failed_vmentry))
+		vmx->idt_vectoring_info = vmcs_read32(IDT_VECTORING_INFO_FIELD);
 
 	if ((u16)vmx->exit_reason.basic == EXIT_REASON_EXCEPTION_NMI &&
 	    is_nmi(vmx_get_intr_info(vcpu))) {
@@ -7237,6 +7244,7 @@ static noinstr void vmx_vcpu_enter_exit(struct kvm_vcpu *vcpu,
 		kvm_after_interrupt(vcpu);
 	}
 
+out:
 	guest_state_exit_irqoff();
 }
 
@@ -7358,8 +7366,6 @@ static fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu)
 	loadsegment(es, __USER_DS);
 #endif
 
-	vcpu->arch.regs_avail &= ~VMX_REGS_LAZY_LOAD_SET;
-
 	pt_guest_exit(vmx);
 
 	kvm_load_host_xsave_state(vcpu);
@@ -7376,17 +7382,12 @@ static fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu)
 		vmx->nested.nested_run_pending = 0;
 	}
 
-	vmx->idt_vectoring_info = 0;
-
 	if (unlikely(vmx->fail))
 		return EXIT_FASTPATH_NONE;
 
 	if (unlikely((u16)vmx->exit_reason.basic == EXIT_REASON_MCE_DURING_VMENTRY))
 		kvm_machine_check();
 
-	if (likely(!vmx->exit_reason.failed_vmentry))
-		vmx->idt_vectoring_info = vmcs_read32(IDT_VECTORING_INFO_FIELD);
-
 	trace_kvm_exit(vcpu, KVM_ISA_VMX);
 
 	if (unlikely(vmx->exit_reason.failed_vmentry))

base-commit: fff2e47e6c3b8050ca26656693caa857e3a8b740
-- 
2.42.0.rc2.253.gd59a3bf2b4-goog

Re: [PATCH] KVM: VMX: Refresh available regs and IDT vectoring info before NMI handling

[Sean Christopherson]

On Thu, 24 Aug 2023 18:45:32 -0700, Sean Christopherson wrote:
> Reset the mask of available "registers" and refresh the IDT vectoring
> info snapshot in vmx_vcpu_enter_exit(), before KVM potentially handles a
> an NMI VM-Exit.  One of the "registers" that KVM VMX lazily loads is the
> vmcs.VM_EXIT_INTR_INFO field, which is holds the vector+type on "exception
> or NMI" VM-Exits, i.e. is needed to identify NMIs.  Clearing the available
> registers bitmask after handling NMIs results in KVM querying info from
> the last VM-Exit that read vmcs.VM_EXIT_INTR_INFO, and leads to both
> missed NMIs and spurious NMIs in the host.
> 
> [...]

Applied to kvm-x86 vmx, gonna try to squeeze this into the initial 6.6 pull
request as I got confirmation from another reporter that this fixed their
problem[*].  I'll make sure to make note of this patch in the pull request to
Paolo, worst case scenario I'll drop this one commit if Paolo spots something.

https://lore.kernel.org/all/SY4P282MB10841E53BAF421675FCE991D9DE0A@SY4P282MB1084.AUSP282.PROD.OUTLOOK.COM/

[1/1] KVM: VMX: Refresh available regs and IDT vectoring info before NMI handling
      https://github.com/kvm-x86/linux/commit/50011c2a2457

--
https://github.com/kvm-x86/linux/tree/next
https://github.com/kvm-x86/linux/tree/fixes

Re: [PATCH] KVM: VMX: Refresh available regs and IDT vectoring info before NMI handling

[Paolo Bonzini]

On 8/29/23 05:11, Sean Christopherson wrote:
> Applied to kvm-x86 vmx, gonna try to squeeze this into the initial 6.6 pull
> request as I got confirmation from another reporter that this fixed their
> problem[*].  I'll make sure to make note of this patch in the pull request to
> Paolo, worst case scenario I'll drop this one commit if Paolo spots something.
> 
> https://lore.kernel.org/all/SY4P282MB10841E53BAF421675FCE991D9DE0A@SY4P282MB1084.AUSP282.PROD.OUTLOOK.COM/
> 
> [1/1] KVM: VMX: Refresh available regs and IDT vectoring info before NMI handling
>        https://github.com/kvm-x86/linux/commit/50011c2a2457

I'm back, so feel free to add even the

Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

Paolo

Re: [PATCH] KVM: VMX: Refresh available regs and IDT vectoring info before NMI handling

[Sean Christopherson]

On Tue, Aug 29, 2023, Paolo Bonzini wrote:
> On 8/29/23 05:11, Sean Christopherson wrote:
> > Applied to kvm-x86 vmx, gonna try to squeeze this into the initial 6.6 pull
> > request as I got confirmation from another reporter that this fixed their
> > problem[*].  I'll make sure to make note of this patch in the pull request to
> > Paolo, worst case scenario I'll drop this one commit if Paolo spots something.
> > 
> > https://lore.kernel.org/all/SY4P282MB10841E53BAF421675FCE991D9DE0A@SY4P282MB1084.AUSP282.PROD.OUTLOOK.COM/
> > 
> > [1/1] KVM: VMX: Refresh available regs and IDT vectoring info before NMI handling
> >        https://github.com/kvm-x86/linux/commit/50011c2a2457
> 
> I'm back, so feel free to add even the

/wave

I'll get pull requests sent out later today.