From: Xiaoyao Li <xiaoyao.li@intel.com>
To: Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
hpa@zytor.com, Paolo Bonzini <pbonzini@redhat.com>,
Sean Christopherson <sean.j.christopherson@intel.com>,
Andy Lutomirski <luto@kernel.org>,
tony.luck@intel.com
Cc: peterz@infradead.org, fenghua.yu@intel.com,
Arvind Sankar <nivedita@alum.mit.edu>,
Vitaly Kuznetsov <vkuznets@redhat.com>,
Jim Mattson <jmattson@google.com>,
x86@kernel.org, kvm@vger.kernel.org,
linux-kernel@vger.kernel.org, Xiaoyao Li <xiaoyao.li@intel.com>
Subject: [PATCH v4 06/10] kvm: x86: Emulate split-lock access as a write
Date: Sat, 14 Mar 2020 15:34:10 +0800 [thread overview]
Message-ID: <20200314073414.184213-7-xiaoyao.li@intel.com> (raw)
In-Reply-To: <20200314073414.184213-1-xiaoyao.li@intel.com>
If split lock detect is enabled (warn/fatal), #AC handler calls die()
when split lock happens in kernel.
Malicous guest can exploit the KVM emulator to trigger split lock #AC
in kernel[1]. So just emulating the access as a write if it's a
split-lock access (the same as access spans page) to avoid malicious
attacking kernel.
More discussion can be found [2][3].
[1] https://lore.kernel.org/lkml/8c5b11c9-58df-38e7-a514-dc12d687b198@redhat.com/
[2] https://lkml.kernel.org/r/20200131200134.GD18946@linux.intel.com
[3] https://lkml.kernel.org/r/20200227001117.GX9940@linux.intel.com
Suggested-by: Sean Christopherson <sean.j.christopherson@intel.com>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
---
arch/x86/kvm/x86.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 5de200663f51..1a0e6c0b1b39 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -5873,6 +5873,7 @@ static int emulator_cmpxchg_emulated(struct x86_emulate_ctxt *ctxt,
{
struct kvm_host_map map;
struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt);
+ u64 page_line_mask = PAGE_MASK;
gpa_t gpa;
char *kaddr;
bool exchanged;
@@ -5887,7 +5888,11 @@ static int emulator_cmpxchg_emulated(struct x86_emulate_ctxt *ctxt,
(gpa & PAGE_MASK) == APIC_DEFAULT_PHYS_BASE)
goto emul_write;
- if (((gpa + bytes - 1) & PAGE_MASK) != (gpa & PAGE_MASK))
+ if (split_lock_detect_on())
+ page_line_mask = ~(cache_line_size() - 1);
+
+ /* when write spans page or spans cache when SLD enabled */
+ if (((gpa + bytes - 1) & page_line_mask) != (gpa & page_line_mask))
goto emul_write;
if (kvm_vcpu_map(vcpu, gpa_to_gfn(gpa), &map))
--
2.20.1
next prev parent reply other threads:[~2020-03-15 2:13 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-14 7:34 [PATCH v4 00/10] x86/split_lock: Add feature split lock detection support in kvm Xiaoyao Li
2020-03-14 7:34 ` [PATCH v4 01/10] x86/split_lock: Rework the initialization flow of split lock detection Xiaoyao Li
2020-03-14 7:34 ` [PATCH v4 02/10] x86/split_lock: Avoid runtime reads of the TEST_CTRL MSR Xiaoyao Li
2020-03-14 7:34 ` [PATCH v4 03/10] x86/split_lock: Re-define the kernel param option for split_lock_detect Xiaoyao Li
2020-03-14 7:34 ` [PATCH v4 04/10] x86/split_lock: Export handle_user_split_lock() Xiaoyao Li
2020-03-14 7:34 ` [PATCH v4 05/10] x86/split_lock: Add and export several functions for KVM Xiaoyao Li
2020-03-14 7:34 ` Xiaoyao Li [this message]
2020-03-14 7:34 ` [PATCH v4 07/10] kvm: vmx: Extend VMX's #AC interceptor to handle split lock #AC happens in guest Xiaoyao Li
2020-03-14 7:34 ` [PATCH v4 08/10] kvm: x86: Emulate MSR IA32_CORE_CAPABILITIES Xiaoyao Li
2020-03-14 7:34 ` [PATCH v4 09/10] kvm: vmx: Enable MSR_TEST_CTRL for intel guest Xiaoyao Li
2020-03-14 7:34 ` [PATCH v4 10/10] x86: vmx: virtualize split lock detection Xiaoyao Li
2020-03-15 2:56 ` Xiaoyao Li
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200314073414.184213-7-xiaoyao.li@intel.com \
--to=xiaoyao.li@intel.com \
--cc=bp@alien8.de \
--cc=fenghua.yu@intel.com \
--cc=hpa@zytor.com \
--cc=jmattson@google.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mingo@redhat.com \
--cc=nivedita@alum.mit.edu \
--cc=pbonzini@redhat.com \
--cc=peterz@infradead.org \
--cc=sean.j.christopherson@intel.com \
--cc=tglx@linutronix.de \
--cc=tony.luck@intel.com \
--cc=vkuznets@redhat.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.