KVM: SVM: Keep intercepting task switching with NPT enabled
PATCH 1/1 KVM: SVM: Keep intercepting task switching with NPT enabled
AMD processors apparently have a bug in the hardware task switching support when NPT is enabled. If the task switch triggers a NPF, we can get wrong EXITINTINFO along with that fault. On resume, spurious exceptions may then be injected into the guest.
We were able to reproduce this bug when our guest triggered #SS and the handler were supposed to run over a separate task with not yet touched stack pages.
Work around the issue by continuing to emulate task switches even in NPT mode.
--- arch/x86/kvm/svm.c | 1 - 1 files changed, 0 insertions(+), 1 deletions(-)
arch/x86/kvm/svm.c +0 -1
@@ -1084,7 +1084,6 @@ static void init_vmcb(struct vcpu_svm *svm)if (npt_enabled) {/* Setup VMCB for Nested Paging */ control->nested_ctl =1 ; -clr_intercept (svm,INTERCEPT_TASK_SWITCH );clr_intercept (svm,INTERCEPT_INVLPG );clr_exception_intercept (svm,PF_VECTOR );clr_cr_intercept (svm,INTERCEPT_CR3_READ );
Signature · 1 line
1.7.3.4
Quoted 5 lines · Jan Kiszka
AMD processors apparently have a bug in the hardware task switching support when NPT is enabled. If the task switch triggers a NPF, we can get wrong EXITINTINFO along with that fault. On resume, spurious exceptions may then be injected into the guest.
Quoted 8 lines
We were able to reproduce this bug when our guest triggered #SS and the handler were supposed to run over a separate task with not yet touched stack pages.
Work around the issue by continuing to emulate task switches even in NPT mode.
Signed-off-by Jan Kiszka <[email protected]>
Quoted 18 lines
--- arch/x86/kvm/svm.c | 1 - 1 files changed, 0 insertions(+), 1 deletions(-)arch/x86/kvm/svm.c +0
-1@@ -1084,7 +1084,6 @@ static void init_vmcb(struct vcpu_svm *svm)if (npt_enabled) {/* Setup VMCB for Nested Paging */ control->nested_ctl =1 ; -clr_intercept (svm,INTERCEPT_TASK_SWITCH );clr_intercept (svm,INTERCEPT_INVLPG );clr_exception_intercept (svm,PF_VECTOR );clr_cr_intercept (svm,INTERCEPT_CR3_READ );Signature · 1 line
1.7.3.4
Signature · 5 lines
AMD Operating System Research Center Advanced Micro Devices GmbH Einsteinring 24 85609 Dornach General Managers: Alberto Bozzo, Andrew Bowd Registration: Dornach, Landkr. Muenchen; Registerger. Muenchen, HRB Nr. 43632
Quoted 10 lines · Joerg
Quoted 9 lines · Jan Kiszka
AMD processors apparently have a bug in the hardware task switching support when NPT is enabled. If the task switch triggers a NPF, we can get wrong EXITINTINFO along with that fault. On resume, spurious exceptions may then be injected into the guest.
We were able to reproduce this bug when our guest triggered #SS and the handler were supposed to run over a separate task with not yet touched stack pages.
Quoted 7 lines
Quoted 4 lines
Work around the issue by continuing to emulate task switches even in NPT mode.
Signed-off-by Jan Kiszka <[email protected]>Acked-by Joerg Roedel <[email protected]>
Will there be an erratum published for this bug? Are all processors affected?
I'd like to limit this to just the buggy processors, if and when fixed processors become available.
Signature · 1 line
error compiling committee.c: too many arguments to function
Quoted 14 lines · Avi Kivity
Quoted 13 lines · Joerg
Quoted 12 lines · Jan Kiszka
AMD processors apparently have a bug in the hardware task switching support when NPT is enabled. If the task switch triggers a NPF, we can get wrong EXITINTINFO along with that fault. On resume, spurious exceptions may then be injected into the guest.
We were able to reproduce this bug when our guest triggered #SS and the handler were supposed to run over a separate task with not yet touched stack pages.
Work around the issue by continuing to emulate task switches even in NPT mode.
Quoted 7 lines
Quoted 4 lines
Quoted 1 line
Signed-off-by Jan Kiszka <[email protected]>Acked-by Joerg Roedel <[email protected]>Will there be an erratum published for this bug? Are all processors affected?
For now this behavior should be expected on all NPT capable processors.
Quoted 2 lines
I'd like to limit this to just the buggy processors, if and when fixed processors become available.
I don't know this yet, but I'll try to find out.
Thanks,
Joerg
Signature · 5 lines
AMD Operating System Research Center Advanced Micro Devices GmbH Einsteinring 24 85609 Dornach General Managers: Alberto Bozzo, Andrew Bowd Registration: Dornach, Landkr. Muenchen; Registerger. Muenchen, HRB Nr. 43632
Quoted 16 lines · Avi Kivity
Quoted 15 lines · Joerg
Quoted 13 lines · Jan Kiszka
AMD processors apparently have a bug in the hardware task switching support when NPT is enabled. If the task switch triggers a NPF, we can get wrong EXITINTINFO along with that fault. On resume, spurious exceptions may then be injected into the guest.
We were able to reproduce this bug when our guest triggered #SS and the handler were supposed to run over a separate task with not yet touched stack pages.
Work around the issue by continuing to emulate task switches even in NPT mode.
Signed-off-by Jan Kiszka <[email protected]>
Quoted 8 lines
Quoted 2 lines
Acked-by Joerg Roedel <[email protected]>Will there be an erratum published for this bug? Are all processors affected?
I'd like to limit this to just the buggy processors, if and when fixed processors become available.
Actually, this isn't a bug. Please have a look at section 15.2.6 of the APM2:
15.2.6 Restartable Instructions
SVM is designed to safely restart, with the exception of task switches, any intercepted instruction (either atomic or idempotent) after the intercept.
So SVM does not guarantee that an intercept during a task-switch can be restarted.
Joerg
Signature · 5 lines
AMD Operating System Research Center Advanced Micro Devices GmbH Einsteinring 24 85609 Dornach General Managers: Alberto Bozzo, Andrew Bowd Registration: Dornach, Landkr. Muenchen; Registerger. Muenchen, HRB Nr. 43632
Quoted 29 lines · Joerg
Quoted 16 lines · Avi Kivity
Quoted 15 lines · Joerg
Quoted 13 lines · Jan Kiszka
AMD processors apparently have a bug in the hardware task switching support when NPT is enabled. If the task switch triggers a NPF, we can get wrong EXITINTINFO along with that fault. On resume, spurious exceptions may then be injected into the guest.
We were able to reproduce this bug when our guest triggered #SS and the handler were supposed to run over a separate task with not yet touched stack pages.
Work around the issue by continuing to emulate task switches even in NPT mode.
Signed-off-by Jan Kiszka <[email protected]>Quoted 8 lines
Quoted 2 lines
Acked-by Joerg Roedel <[email protected]>Will there be an erratum published for this bug? Are all processors affected?
I'd like to limit this to just the buggy processors, if and when fixed processors become available.
Actually, this isn't a bug. Please have a look at section 15.2.6 of the APM2:
Quoted 8 lines
15.2.6 Restartable Instructions
SVM is designed to safely restart, with the exception of task switches, any intercepted instruction (either atomic or idempotent) after the intercept.
So SVM does not guarantee that an intercept during a task-switch can be restarted.
Not a bug but still a deficit as it makes hardware-assisted task switching practically useless, no?
Jan
Quoted 5 lines · Jan Kiszka
Quoted 2 lines
So SVM does not guarantee that an intercept during a task-switch can be restarted.
Not a bug but still a deficit as it makes hardware-assisted task switching practically useless, no?
Not entirely. For hypervisors that can guarantee that there will be no intercept (NPT pre-mapped, no exceptions intercepted) it will still work.
Joerg
Signature · 5 lines
AMD Operating System Research Center Advanced Micro Devices GmbH Einsteinring 24 85609 Dornach General Managers: Alberto Bozzo, Andrew Bowd Registration: Dornach, Landkr. Muenchen; Registerger. Muenchen, HRB Nr. 43632
Quoted 10 lines · Joerg
Quoted 5 lines · Jan Kiszka
Quoted 2 lines
So SVM does not guarantee that an intercept during a task-switch can be restarted.
Not a bug but still a deficit as it makes hardware-assisted task switching practically useless, no?
Not entirely. For hypervisors that can guarantee that there will be no intercept (NPT pre-mapped, no exceptions intercepted) it will still work.
Yes, but that only covers the niche of simple static ones (partitioning hypervisors).
Jan
Quoted 8 lines · Jan Kiszka
Quoted 7 lines · Joerg
Quoted 5 lines · Jan Kiszka
Quoted 2 lines
So SVM does not guarantee that an intercept during a task-switch can be restarted.
Not a bug but still a deficit as it makes hardware-assisted task switching practically useless, no?
Quoted 6 lines
Quoted 3 lines
Not entirely. For hypervisors that can guarantee that there will be no intercept (NPT pre-mapped, no exceptions intercepted) it will still work.
Yes, but that only covers the niche of simple static ones (partitioning hypervisors).
No, also a hypervisor that creates the nested page-page on advance falls into this category.
Joerg
Signature · 5 lines
AMD Operating System Research Center Advanced Micro Devices GmbH Einsteinring 24 85609 Dornach General Managers: Alberto Bozzo, Andrew Bowd Registration: Dornach, Landkr. Muenchen; Registerger. Muenchen, HRB Nr. 43632
Quoted 13 lines · Joerg
Quoted 12 lines · Jan Kiszka
Quoted 10 lines · Joerg
Quoted 5 lines · Jan Kiszka
Quoted 2 lines
So SVM does not guarantee that an intercept during a task-switch can be restarted.
Not a bug but still a deficit as it makes hardware-assisted task switching practically useless, no?
Not entirely. For hypervisors that can guarantee that there will be no intercept (NPT pre-mapped, no exceptions intercepted) it will still work.
Quoted 5 lines
Quoted 2 lines
Yes, but that only covers the niche of simple static ones (partitioning hypervisors).
No, also a hypervisor that creates the nested page-page on advance falls into this category.
Doesn't this means all guest memory has to be backed with host memory? That's what I meant with "static".
Jan
Quoted 6 lines · Jan Kiszka
Quoted 2 lines · Joerg
No, also a hypervisor that creates the nested page-page on advance falls into this category.
Doesn't this means all guest memory has to be backed with host memory? That's what I meant with "static".
Yes, but isn't Xen working this way? I wouldn't call Xen a simple partitioning hypervisor :)
Joerg
Signature · 5 lines
AMD Operating System Research Center Advanced Micro Devices GmbH Einsteinring 24 85609 Dornach General Managers: Alberto Bozzo, Andrew Bowd Registration: Dornach, Landkr. Muenchen; Registerger. Muenchen, HRB Nr. 43632
Quoted 10 lines · Joerg
Quoted 6 lines · Jan Kiszka
Quoted 2 lines · Joerg
No, also a hypervisor that creates the nested page-page on advance falls into this category.
Doesn't this means all guest memory has to be backed with host memory? That's what I meant with "static".
Yes, but isn't Xen working this way? I wouldn't call Xen a simple partitioning hypervisor :)
Not sure if they map ahead of time or lazily, at least they intercept task switching as well.
Jan
Quoted 10 lines · Joerg
Quoted 6 lines · Jan Kiszka
Quoted 2 lines · Joerg
No, also a hypervisor that creates the nested page-page on advance falls into this category.
Doesn't this means all guest memory has to be backed with host memory? That's what I meant with "static".
Yes, but isn't Xen working this way? I wouldn't call Xen a simple partitioning hypervisor :)
Xen is lazy, and these days they even page.
Signature · 1 line
error compiling committee.c: too many arguments to function
Marcelo Tosatti
AppliedQuoted 9 lines · Jan Kiszka
AMD processors apparently have a bug in the hardware task switching support when NPT is enabled. If the task switch triggers a NPF, we can get wrong EXITINTINFO along with that fault. On resume, spurious exceptions may then be injected into the guest.
We were able to reproduce this bug when our guest triggered #SS and the handler were supposed to run over a separate task with not yet touched stack pages.
Quoted 7 lines
Work around the issue by continuing to emulate task switches even in NPT mode.
Signed-off-by Jan Kiszka <[email protected]>--- arch/x86/kvm/svm.c | 1 - 1 files changed, 0 insertions(+), 1 deletions(-)
Applied, thanks.