Due to a widespread Intel erratum (e.g. EMR158), programming the VMX-preemption timer with certain large values may cause the timer to expire earlier than expected. The recommended workaround is to cap the VMX-preemption timer value to strictly less than 2^25 * CPUID.15H:EBX[31:0] / CPUID.15H:EAX[31:0]. Calculate preemption_timer_limit during hardware setup based on CPUID 15H when available, and return -ERANGE in vmx_set_hv_timer() if the shifted delta_tsc reaches or exceeds preemption_timer_limit. Reported-by: Sean Christopherson Closes: https://lore.kernel.org/all/Zn9X0yFxZi_Mrlnt@google.com/ Suggested-by: Chao Gao Assisted-by: Gemini:Gemini-Next Signed-off-by: Jim Mattson --- arch/x86/kvm/vmx/vmx.c | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-) diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index cc75feec05da..1e958c1032ce 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -151,6 +151,7 @@ module_param(dump_invalid_vmcs, bool, 0644); /* Guest_tsc -> host_tsc conversion requires 64-bit division. */ static int __read_mostly cpu_preemption_timer_multi; static bool __read_mostly enable_preemption_timer = 1; +static u64 __read_mostly preemption_timer_limit = 1ULL << 32; #ifdef CONFIG_X86_64 module_param_named(preemption_timer, enable_preemption_timer, bool, S_IRUGO); #endif @@ -8338,12 +8339,12 @@ int vmx_set_hv_timer(struct kvm_vcpu *vcpu, u64 guest_deadline_tsc, return -ERANGE; /* - * If the delta tsc can't fit in the 32 bit after the multi shift, - * we can't use the preemption timer. + * If the delta tsc exceeds the preemption timer limit after the + * multi shift, we can't use the preemption timer. * It's possible that it fits on later vmentries, but checking * on every vmentry is costly so we just use an hrtimer. */ - if (delta_tsc >> (cpu_preemption_timer_multi + 32)) + if ((delta_tsc >> cpu_preemption_timer_multi) >= preemption_timer_limit) return -ERANGE; vmx->hv_deadline_tsc = tscl + delta_tsc; @@ -8585,6 +8586,26 @@ static void __init vmx_setup_me_spte_mask(void) kvm_mmu_set_me_spte_mask(0, me_mask); } +/* + * Workaround for a widespread Intel erratum (e.g. EMR158) where the + * VMX-preemption timer may expire earlier than expected when programmed + * with large values. The workaround is to cap the timer value to strictly + * less than 2^25 * CPUID.15H:EBX / CPUID.15H:EAX. + */ +static __init u64 calc_preemption_timer_limit(void) +{ + u32 eax, ebx, ecx, edx; + + if (cpuid_eax(0) < 0x15) + return 1ULL << 32; + + cpuid(0x15, &eax, &ebx, &ecx, &edx); + if (!eax || !ebx) + return 1ULL << 32; + + return min_t(u64, 1ULL << 32, ((u64)ebx << 25) / eax); +} + __init int vmx_hardware_setup(void) { unsigned long host_bndcfgs; @@ -8726,6 +8747,8 @@ __init int vmx_hardware_setup(void) cpu_preemption_timer_multi = vmx_misc_preemption_timer_rate(vmcs_config.misc); + preemption_timer_limit = calc_preemption_timer_limit(); + if (tsc_khz) use_timer_freq = (u64)tsc_khz * 1000; use_timer_freq >>= cpu_preemption_timer_multi; -- 2.55.0.229.g6434b31f56-goog