Due to a widespread Intel erratum (e.g. EMR158), programming the VMX-preemption timer with certain large values may cause the timer to expire earlier than expected. The recommended workaround is to cap the VMX-preemption timer value to strictly less than 2^25 * CPUID.15H:EBX[31:0] / CPUID.15H:EAX[31:0]. Calculate preemption_timer_limit during hardware setup based on CPUID 15H when available, and return -ERANGE in vmx_set_hv_timer() if the shifted delta_tsc reaches or exceeds preemption_timer_limit. Use preemption_timer_limit - 1 instead of 0xffffffff when soft-disabling the timer and when checking the timer frequency limit in hardware setup. Reported-by: Sean Christopherson Closes: https://lore.kernel.org/all/Zn9X0yFxZi_Mrlnt@google.com/ Suggested-by: Chao Gao Assisted-by: Gemini:Gemini-Next Reviewed-by: Chao Gao Signed-off-by: Jim Mattson --- v4: Disable preemption timer if preemption_timer_limit is 0 [Sashiko] v3: https://lore.kernel.org/all/20260722040311.3369898-1-jmattson@google.com/ v2: https://lore.kernel.org/all/20260720231639.1592848-1-jmattson@google.com/ v1: https://lore.kernel.org/all/20260720205230.1457146-1-jmattson@google.com/ arch/x86/kvm/vmx/vmx.c | 34 +++++++++++++++++++++++++++++----- 1 file changed, 29 insertions(+), 5 deletions(-) diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index cc75feec05da..61017f759d61 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -151,6 +151,7 @@ module_param(dump_invalid_vmcs, bool, 0644); /* Guest_tsc -> host_tsc conversion requires 64-bit division. */ static int __read_mostly cpu_preemption_timer_multi; static bool __read_mostly enable_preemption_timer = 1; +static u64 __ro_after_init preemption_timer_limit; #ifdef CONFIG_X86_64 module_param_named(preemption_timer, enable_preemption_timer, bool, S_IRUGO); #endif @@ -7412,7 +7413,7 @@ static void vmx_update_hv_timer(struct kvm_vcpu *vcpu, bool force_immediate_exit vmcs_write32(VMX_PREEMPTION_TIMER_VALUE, delta_tsc); vmx->loaded_vmcs->hv_timer_soft_disabled = false; } else if (!vmx->loaded_vmcs->hv_timer_soft_disabled) { - vmcs_write32(VMX_PREEMPTION_TIMER_VALUE, -1); + vmcs_write32(VMX_PREEMPTION_TIMER_VALUE, preemption_timer_limit - 1); vmx->loaded_vmcs->hv_timer_soft_disabled = true; } } @@ -8338,12 +8339,12 @@ int vmx_set_hv_timer(struct kvm_vcpu *vcpu, u64 guest_deadline_tsc, return -ERANGE; /* - * If the delta tsc can't fit in the 32 bit after the multi shift, - * we can't use the preemption timer. + * If the delta tsc exceeds the preemption timer limit after the + * multi shift, we can't use the preemption timer. * It's possible that it fits on later vmentries, but checking * on every vmentry is costly so we just use an hrtimer. */ - if (delta_tsc >> (cpu_preemption_timer_multi + 32)) + if ((delta_tsc >> cpu_preemption_timer_multi) >= preemption_timer_limit) return -ERANGE; vmx->hv_deadline_tsc = tscl + delta_tsc; @@ -8585,6 +8586,26 @@ static void __init vmx_setup_me_spte_mask(void) kvm_mmu_set_me_spte_mask(0, me_mask); } +/* + * Workaround for a widespread Intel erratum (e.g. EMR158) where the + * VMX-preemption timer may expire earlier than expected when programmed + * with large values. The workaround is to cap the timer value to strictly + * less than 2^25 * CPUID.15H:EBX / CPUID.15H:EAX. + */ +static __init u64 calc_preemption_timer_limit(void) +{ + u32 eax, ebx, ecx, edx; + + if (cpuid_eax(0) < 0x15) + return 1ULL << 32; + + cpuid(0x15, &eax, &ebx, &ecx, &edx); + if (!eax || !ebx) + return 1ULL << 32; + + return min_t(u64, 1ULL << 32, div_u64((u64)ebx << 25, eax)); +} + __init int vmx_hardware_setup(void) { unsigned long host_bndcfgs; @@ -8726,6 +8747,8 @@ __init int vmx_hardware_setup(void) cpu_preemption_timer_multi = vmx_misc_preemption_timer_rate(vmcs_config.misc); + preemption_timer_limit = calc_preemption_timer_limit(); + if (tsc_khz) use_timer_freq = (u64)tsc_khz * 1000; use_timer_freq >>= cpu_preemption_timer_multi; @@ -8735,7 +8758,8 @@ __init int vmx_hardware_setup(void) * value. Don't use the timer if it might cause spurious exits * at a rate faster than 0.1 Hz (of uninterrupted guest time). */ - if (use_timer_freq > 0xffffffffu / 10) + if (!preemption_timer_limit || + use_timer_freq > (preemption_timer_limit - 1) / 10) enable_preemption_timer = false; } -- 2.55.0.229.g6434b31f56-goog