Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1358835
| From | Jiri Slaby <jslaby@suse.cz> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.12 37/58] KVM: VMX: disable PEBS before a guest entry |
| Date | 2016-03-16 12:10 +0100 |
| Message-ID | <rdhuW-896-19@gated-at.bofh.it> (permalink) |
| References | <rdhlg-7Px-15@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
From: Radim Krčmář <rkrcmar@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 7099e2e1f4d9051f31bbfa5803adf954bb5d76ef upstream.
Linux guests on Haswell (and also SandyBridge and Broadwell, at least)
would crash if you decided to run a host command that uses PEBS, like
perf record -e 'cpu/mem-stores/pp' -a
This happens because KVM is using VMX MSR switching to disable PEBS, but
SDM [2015-12] 18.4.4.4 Re-configuring PEBS Facilities explains why it
isn't safe:
When software needs to reconfigure PEBS facilities, it should allow a
quiescent period between stopping the prior event counting and setting
up a new PEBS event. The quiescent period is to allow any latent
residual PEBS records to complete its capture at their previously
specified buffer address (provided by IA32_DS_AREA).
There might not be a quiescent period after the MSR switch, so a CPU
ends up using host's MSR_IA32_DS_AREA to access an area in guest's
memory. (Or MSR switching is just buggy on some models.)
The guest can learn something about the host this way:
If the guest doesn't map address pointed by MSR_IA32_DS_AREA, it results
in #PF where we leak host's MSR_IA32_DS_AREA through CR2.
After that, a malicious guest can map and configure memory where
MSR_IA32_DS_AREA is pointing and can therefore get an output from
host's tracing.
This is not a critical leak as the host must initiate with PEBS tracing
and I have not been able to get a record from more than one instruction
before vmentry in vmx_vcpu_run() (that place has most registers already
overwritten with guest's).
We could disable PEBS just few instructions before vmentry, but
disabling it earlier shouldn't affect host tracing too much.
We also don't need to switch MSR_IA32_PEBS_ENABLE on VMENTRY, but that
optimization isn't worth its code, IMO.
(If you are implementing PEBS for guests, be sure to handle the case
where both host and guest enable PEBS, because this patch doesn't.)
Fixes: 26a4f3c08de4 ("perf/x86: disable PEBS on a guest entry.")
Reported-by: Jiří Olša <jolsa@redhat.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/x86/kvm/vmx.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 53fede68963d..9e439266554d 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -1492,6 +1492,13 @@ static void add_atomic_switch_msr(struct vcpu_vmx *vmx, unsigned msr,
return;
}
break;
+ case MSR_IA32_PEBS_ENABLE:
+ /* PEBS needs a quiescent period after being disabled (to write
+ * a record). Disabling PEBS through VMX MSR swapping doesn't
+ * provide that period, so a CPU could write host's record into
+ * guest's memory.
+ */
+ wrmsrl(MSR_IA32_PEBS_ENABLE, 0);
}
for (i = 0; i < m->nr; ++i)
--
2.7.3
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 3.12 00/58] 3.12.57-stable review Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:00 +0100
[PATCH 3.12 01/58] nfsd: fix problem with setting ACL on directories Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:00 +0100
[PATCH 3.12 44/58] KVM: x86: move steal time initialization to vcpu entry time Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 48/58] efi: Make our variable validation list include the guid Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 15/58] x86/entry/compat: Add missing CLAC to entry_INT80_32 Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 34/58] MIPS: traps: Fix SIGFPE information leak from `do_ov' and `do_trap_or_bp' Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 29/58] ALSA: hdspm: Fix zero-division Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 43/58] powerpc: Fix dedotify for binutils >= 2.26 Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 40/58] ASoC: wm8958: Fix enum ctl accesses in a wrong type Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 37/58] KVM: VMX: disable PEBS before a guest entry Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 42/58] mac80211: minstrel_ht: set default tx aggregation timeout to 0 Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 47/58] efi: Do variable name validation tests in utf8 Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 33/58] USB: serial: option: add support for Quectel UC20 Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 57/58] xen/pciback: Don't allow MSI-X ops if PCI_COMMAND_MEMORY is not set. Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 27/58] ALSA: hdspm: Fix wrong boolean ctl value accesses Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 13/58] CIFS: Fix SMB2+ interim response processing for read requests Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 46/58] efi: Use ucs2_as_utf8 in efivarfs instead of open coding a bad version Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 20/58] Revert "jffs2: Fix lock acquisition order bug in jffs2_write_begin" Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 45/58] lib/ucs2_string: Add ucs2 -> utf8 helper functions Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 38/58] tracing: Fix check for cpu online when event is disabled Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 12/58] cifs: fix out-of-bounds access in lease parsing Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 28/58] ALSA: hdsp: Fix wrong boolean ctl value accesses Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 36/58] Revert "drm/radeon: hold reference to fences in radeon_sa_bo_new" Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
Re: [PATCH 3.12 36/58] Revert "drm/radeon: hold reference to fences in radeon_sa_bo_new" Nicolai Hähnle <nicolai.haehnle@amd.com> - 2016-03-16 20:50 +0100
[PATCH 3.12 53/58] xen/pciback: Return error on XEN_PCI_OP_enable_msi when device has MSI or MSI-X enabled Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 56/58] xen/pciback: For XEN_PCI_OP_disable_msi[|x] only disable if device has MSI(X) enabled. Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 39/58] ASoC: wm8994: Fix enum ctl accesses in a wrong type Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 50/58] efi: Add pstore variables to the deletion whitelist Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 58/58] xen/pciback: Check PF instead of VF for PCI_COMMAND_MEMORY Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 55/58] xen/pciback: Do not install an IRQ handler for MSI interrupts. Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 32/58] USB: serial: option: add support for Telit LE922 PID 0x1045 Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 35/58] ubi: Fix out of bounds write in volume update code Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 41/58] wext: fix message delay/ordering Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 49/58] efi: Make efivarfs entries immutable by default Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 31/58] USB: cp210x: Add ID for Parrot NMEA GPS Flight Recorder Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 54/58] xen/pciback: Return error on XEN_PCI_OP_enable_msix when device has MSI or MSI-X enabled Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 52/58] modules: fix longstanding /proc/kallsyms vs module insertion race. Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 51/58] lib/ucs2_string: Correct ucs2 -> utf8 conversion Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:10 +0100
[PATCH 3.12 16/58] drm/ast: Fix incorrect register check for DRAM width Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:20 +0100
[PATCH 3.12 21/58] jffs2: Fix page lock / f->sem deadlock Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:20 +0100
[PATCH 3.12 07/58] [media] usbvision fix overflow of interfaces array Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:20 +0100
[PATCH 3.12 04/58] USB: cp210x: flush device queues at close Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:20 +0100
[PATCH 3.12 18/58] libata: Align ata_device's id on a cacheline Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:20 +0100
[PATCH 3.12 11/58] genksyms: Handle string literals with spaces in reference files Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:20 +0100
[PATCH 3.12 17/58] libata: fix HDIO_GET_32BIT ioctl Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:20 +0100
[PATCH 3.12 09/58] ixgbe: use correct FCoE DDP max check Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:20 +0100
[PATCH 3.12 10/58] ixgbe: fix broken PFC with X550 Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:20 +0100
[PATCH 3.12 26/58] ALSA: seq: oss: Don't drain at closing a client Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:20 +0100
[PATCH 3.12 23/58] ALSA: ctl: Fix ioctls for X32 ABI Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:20 +0100
[PATCH 3.12 02/58] unix: properly account for FDs passed over unix sockets Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:20 +0100
[PATCH 3.12 25/58] ALSA: timer: Fix ioctls for X32 ABI Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:20 +0100
[PATCH 3.12 05/58] USB: cp210x: relocate private data from USB interface to port Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:20 +0100
[PATCH 3.12 19/58] PM / sleep / x86: Fix crash on graph trace through x86 suspend Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:20 +0100
[PATCH 3.12 24/58] ALSA: rawmidi: Fix ioctls X32 ABI Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:20 +0100
[PATCH 3.12 14/58] iommu/amd: Fix boot warning when device 00:00.0 is not iommu covered Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:20 +0100
[PATCH 3.12 22/58] Fix directory hardlinks from deleted directories Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:20 +0100
[PATCH 3.12 30/58] ALSA: timer: Fix broken compat timer user status ioctl Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:20 +0100
[PATCH 3.12 06/58] USB: cp210x: work around cp2108 GET_LINE_CTL bug Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:20 +0100
[PATCH 3.12 08/58] usb: Add connected retry on resume for non SS devices Jiri Slaby <jslaby@suse.cz> - 2016-03-16 12:20 +0100
Re: [PATCH 3.12 01/58] nfsd: fix problem with setting ACL on directories Sergio Gelato <Sergio.Gelato@astro.su.se> - 2016-03-16 13:40 +0100
Re: [PATCH 3.12 00/58] 3.12.57-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-03-16 16:50 +0100
Re: [PATCH 3.12 00/58] 3.12.57-stable review Guenter Roeck <linux@roeck-us.net> - 2016-03-16 19:00 +0100
Re: [PATCH 3.12 00/58] 3.12.57-stable review Jiri Slaby <jslaby@suse.cz> - 2016-03-16 19:20 +0100
Re: [PATCH 3.12 00/58] 3.12.57-stable review Guenter Roeck <linux@roeck-us.net> - 2016-03-17 04:30 +0100
csiph-web