qemu/accel
Chenyi Qiang e2e69f6bb9 i386: add notify VM exit support
There are cases that malicious virtual machine can cause CPU stuck (due
to event windows don't open up), e.g., infinite loop in microcode when
nested #AC (CVE-2015-5307). No event window means no event (NMI, SMI and
IRQ) can be delivered. It leads the CPU to be unavailable to host or
other VMs. Notify VM exit is introduced to mitigate such kind of
attacks, which will generate a VM exit if no event window occurs in VM
non-root mode for a specified amount of time (notify window).

A new KVM capability KVM_CAP_X86_NOTIFY_VMEXIT is exposed to user space
so that the user can query the capability and set the expected notify
window when creating VMs. The format of the argument when enabling this
capability is as follows:
  Bit 63:32 - notify window specified in qemu command
  Bit 31:0  - some flags (e.g. KVM_X86_NOTIFY_VMEXIT_ENABLED is set to
              enable the feature.)

Users can configure the feature by a new (x86 only) accel property:
    qemu -accel kvm,notify-vmexit=run|internal-error|disable,notify-window=n

The default option of notify-vmexit is run, which will enable the
capability and do nothing if the exit happens. The internal-error option
raises a KVM internal error if it happens. The disable option does not
enable the capability. The default value of notify-window is 0. It is valid
only when notify-vmexit is not disabled. The valid range of notify-window
is non-negative. It is even safe to set it to zero since there's an
internal hardware threshold to be added to ensure no false positive.

Because a notify VM exit may happen with VM_CONTEXT_INVALID set in exit
qualification (no cases are anticipated that would set this bit), which
means VM context is corrupted. It would be reflected in the flags of
KVM_EXIT_NOTIFY exit. If KVM_NOTIFY_CONTEXT_INVALID bit is set, raise a KVM
internal error unconditionally.

Acked-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Chenyi Qiang <chenyi.qiang@intel.com>
Message-Id: <20220929072014.20705-5-chenyi.qiang@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-10-11 09:36:00 +02:00
..
hvf Fix 'writeable' typos 2022-06-08 19:38:47 +01:00
kvm i386: add notify VM exit support 2022-10-11 09:36:00 +02:00
qtest misc: Remove unnecessary "sysemu/cpu-timers.h" include 2022-03-06 13:15:42 +01:00
stubs accel/kvm: move kvm_update_guest_debug to inline stub 2022-10-06 11:53:41 +01:00
tcg gdbstub: move guest debug support check to ops 2022-10-06 11:53:41 +01:00
xen sysemu: Let VMChangeStateHandler take boolean 'running' argument 2021-03-09 23:13:57 +01:00
accel-common.c gdbstub: move sstep flags probing into AccelClass 2022-10-06 11:53:41 +01:00
accel-softmmu.c accel: autoload modules 2021-07-09 18:21:33 +02:00
accel-softmmu.h accel: replace struct CpusAccel with AccelOpsClass 2021-02-05 10:24:15 -10:00
accel-user.c accel: extend AccelState and AccelClass to user-mode 2021-02-05 10:24:15 -10:00
dummy-cpus.c
Kconfig Add NVMM accelerator: configure and build logic 2021-05-04 14:15:34 +02:00
meson.build accel/meson: Only build hw virtualization with system emulation 2022-03-06 13:15:42 +01:00