From: Fenghua Yu <email@example.com>
To: "Thomas Gleixner" <firstname.lastname@example.org>,
"Ingo Molnar" <email@example.com>,
"Borislav Petkov" <firstname.lastname@example.org>, "H Peter Anvin" <email@example.com>,
"Paolo Bonzini" <firstname.lastname@example.org>,
"Dave Hansen" <email@example.com>,
"Ashok Raj" <firstname.lastname@example.org>,
"Peter Zijlstra" <email@example.com>,
"Ravi V Shankar" <firstname.lastname@example.org>,
"Xiaoyao Li " <email@example.com>,
"Christopherson Sean J" <firstname.lastname@example.org>,
"Kalle Valo" <email@example.com>,
"Michael Chan" <firstname.lastname@example.org>
Cc: "linux-kernel" <email@example.com>,
firstname.lastname@example.org, Fenghua Yu <email@example.com>
Subject: [PATCH v7 00/21] x86/split_lock: Enable split lock detection
Date: Wed, 17 Apr 2019 14:33:50 -0700 [thread overview]
Message-ID: <firstname.lastname@example.org> (raw)
A split lock is any atomic operation whose operand crosses two cache
lines. Since the operand spans two cache lines and the operation must
be atomic, the system locks the bus while the CPU accesses the two cache
During bus locking, request from other CPUs or bus agents for control
of the bus are blocked. Blocking bus access from other CPUs plus
overhead of configuring bus locking protocol degrade not only performance
on one CPU but also overall system performance.
If the operand is cacheable and completely contained in one cache line,
the atomic operation is optimized by less expensive cache locking on
Intel P6 and recent processors. If a split lock operation is detected
and a developer fixes the issue so that the operand can be operated in one
cache line, cache locking instead of more expensive bus locking will be
used for the atomic operation. Removing the split lock can improve overall
Instructions that may cause split lock issue include lock add, lock btc,
xchg, lsl, far call, ltr, etc.
More information about split lock, bus locking, and cache locking can be
found in the latest Intel 64 and IA-32 Architecture Software Developer's
==Split lock detection==
Currently Linux can trace split lock event counter sq_misc.split_lock
for debug purpose. But for system deployed in the field, this event
counter after the fact is insufficient. We need a mechanism that
detects split lock before it happens to ensure that bus lock is never
incurred due to split lock.
Intel introduces a mechanism to detect split lock via Alignment Check
(#AC) exception before badly aligned atomic instructions might impact
whole system performance in Tremont and other future processors.
This capability is critical for real time system designers who build
consolidated real time systems. These systems run hard real time
code on some cores and run "untrusted" user processes on some
other cores. The hard real time cannot afford to have any bus lock from
the untrusted processes to hurt real time performance. To date the
designers have been unable to deploy these solutions as they have no
way to prevent the "untrusted" user code from generating split lock and
bus lock to block the hard real time code to access memory during bus
This capability may also find usage in cloud. A user process with split
lock running in one guest can block other cores from accessing shared
memory during its split locked memory access. That may cause overall
system performance degradation.
Split lock may open a security hole where malicious user code may slow
down overall system by executing instructions with split lock.
==Enumerate split lock detection feature==
A control bit (bit 29) in MSR_TEST_CTL (0x33) will be introduced in
future x86 processors. When the bit 29 is set, the processor causes
#AC exception for split locked accesses at all CPL.
The split lock detection feature is enumerated through bit 5 in
MSR_IA32_CORE_CAPABILITY (0xcf). The MSR 0xcf itself is enumerated by
The enumeration method is published in the latest Intel 64 and IA-32
Architecture Software Developer's Manual.
A few processors have the split lock detection feature. But they don't
have MSR_IA32_CORE_CAPABILITY to enumerate the feature. On those
processors, enumerate the split lock detection feature based on their
==Handle split lock===
There may be different considerations to handle split lock, e.g. how
to handle split lock issue in firmware after kernel enables the feature.
But this patch set uses a simple way to handle split lock which is
suggested by Thomas Gleixner and Dave Hansen:
- If split lock happens in kernel, a warning is issued and split lock
detection is disabled on the current CPU. The split lock issue should
be fixed in kernel.
- If split lock happens in user process, the process is killed by
SIGBUS. Unless the issue is fixed, the process cannot run in the
- If split lock happens in firmware, system may hang in firmware. The
issue should be fixed in firmware.
- Enable split lock detection by default once the feature is enumerated.
- Disable split lock detection by "clearcpuid=split_lock_detect" during
- Disable/enable split lock detection by interface
/sys/devices/system/cpu/split_lock_detect during run time.
==Expose to guest==
To expose this feature to guest, need to
1. Report the new CPUID bit to guest.
2. Emulate IA32_CORE_CAPABILITIES MSR.
3. Emulate TEST_CTL MSR. Since this patch series enable split lock
detection in host kernel by default, if do not emulate MSR_TEST_CTL
for guest, guest will run with the value set by host without knowing
that. So guest will run with split lock detection enabled due to the
host's value. Thus guest running with buggy firmware and old kernel
will fail because they lack the ability to handle #AC for split lock.
So need to emulate MSR_TEST_CTL and separate its value between host
Patch 1-4: Fix a few existing split lock issues.
Patch 5-10: Enumerate features and define MSR_TEST_CTL.
Patch 11: Handle #AC for split lock
Patch 12-13: Enable split lock detection in KVM.
Patch 14: Enable split lock detection by default after #AC handler and KVM
Patch 15-16: Define a sysfs interface to enable/disable split lock
Patch 17-21: Extend "clearcpuid=" option.
- Add per cpu variable to cach MSR TEST_CTL. Suggested by Thomas Gleixner.
- Change a few other changes including locking, simplifying code, work
flow, KVM fixes, etc. Suggested by Thomas Gleixner.
- Fix KVM issues pointed out by Sean Christopherson.
- Fix #AC handler issues pointed out by Dave Hansen
- Add doc for the sysfs interface pointed out by Dave Hansen
- Fix a lock issue around wrmsr during split lock init, pointed out by Dave
- Update descriptions and comments suggested by Dave Hansen
- Fix __le32 issue in wlcore raised by Kalle Valo
- Add feature enumeration based on family/model/stepping for Icelake mobile
- Fix wlcore issue from Paolo Bonzini
- Fix b44 issue from Peter Zijlstra
- Change init sequence by Dave Hansen
- Fix KVM issues from Paolo Bonzini
- Re-order patch sequence
- Remove "setcpuid=" option
- Enable IA32_CORE_CAPABILITY enumeration for split lock
- Handle CPUID faulting by Peter Zijlstra
- Enable /sys interface to enable/disable split lock detection
- Handle split lock as suggested by Thomas Gleixner.
- Fix a few potential spit lock issues suggested by Thomas Gleixner.
- Support kernel option "setcpuid=" suggested by Dave Hanson and Thomas
- Support flag string in "clearcpuid=" suggested by Dave Hanson and
- Remove code that handles split lock issue in firmware and fix
x86_capability issue mainly based on comments from Thomas Gleixner and
In previous version:
Comments from Dave Hansen:
- Enumerate feature in X86_FEATURE_SPLIT_LOCK_AC
- Separate #AC handler from do_error_trap
- Use CONFIG to configure inherit BIOS setting, enable, or disable split
lock. Remove kernel parameter "split_lock_ac="
- Change config interface to debugfs from sysfs
- Fix a few bisectable issues
- Other changes.
Comment from Tony Luck and Dave Hansen:
- Dump right information in #AC handler
Comment from Alan Cox and Dave Hansen:
- Description of split lock in patch 0
- Remove tracing because we can trace split lock in existing
- Add CONFIG to configure either panic or re-execute faulting instruction
for split lock in kernel.
- other minor changes.
Fenghua Yu (16):
x86/common: Align cpu_caps_cleared and cpu_caps_set to unsigned long
x86/split_lock: Align x86_capability to unsigned long to avoid split
x86/msr-index: Define MSR_IA32_CORE_CAPABILITY and split lock
x86/cpufeatures: Enumerate MSR_IA32_CORE_CAPABILITY
x86/split_lock: Enumerate split lock detection by
x86/split_lock: Enumerate split lock detection on Icelake mobile
x86/split_lock: Define MSR TEST_CTL register
x86/split_lock: Define per CPU variable to cache MSR TEST_CTL
x86/split_lock: Handle #AC exception for split lock
x86/split_lock: Enable split lock detection by default
x86/split_lock: Add a sysfs interface to enable/disable split lock
detection during run time
x86/split_lock: Document the new sysfs file for split lock detection
x86/clearcpuid: Support multiple clearcpuid options
x86/clearcpuid: Support feature flag string in kernel option
x86/clearcpuid: Apply cleared feature bits that are forced set before
x86/clearcpuid: Change document for kernel option clearcpuid
Paolo Bonzini (1):
wlcore: simplify/fix/optimize reg_ch_conf_pending operations
Peter Zijlstra (2):
drivers/net/b44: Align pwol_mask to unsigned long for better
x86/clearcpuid: Clear CPUID bit in CPUID faulting
Xiaoyao Li (2):
kvm/x86: Emulate MSR IA32_CORE_CAPABILITY
kvm/vmx: Emulate MSR TEST_CTL
.../ABI/testing/sysfs-devices-system-cpu | 22 +++
.../admin-guide/kernel-parameters.txt | 18 +-
arch/x86/include/asm/cmdline.h | 3 +
arch/x86/include/asm/cpu.h | 8 +
arch/x86/include/asm/cpufeature.h | 5 +
arch/x86/include/asm/cpufeatures.h | 2 +
arch/x86/include/asm/kvm_host.h | 1 +
arch/x86/include/asm/msr-index.h | 7 +
arch/x86/include/asm/processor.h | 4 +-
arch/x86/kernel/cpu/common.c | 14 +-
arch/x86/kernel/cpu/cpuid-deps.c | 157 ++++++++++++----
arch/x86/kernel/cpu/intel.c | 169 +++++++++++++++++-
arch/x86/kernel/cpu/scattered.c | 17 ++
arch/x86/kernel/fpu/init.c | 33 ++--
arch/x86/kernel/process.c | 3 +
arch/x86/kernel/traps.c | 46 ++++-
arch/x86/kvm/cpuid.c | 6 +
arch/x86/kvm/vmx/vmx.c | 42 +++++
arch/x86/kvm/vmx/vmx.h | 2 +
arch/x86/kvm/x86.c | 39 ++++
arch/x86/lib/cmdline.c | 17 +-
drivers/net/ethernet/broadcom/b44.c | 4 +-
drivers/net/wireless/ti/wlcore/cmd.c | 15 +-
drivers/net/wireless/ti/wlcore/wlcore.h | 4 +-
24 files changed, 558 insertions(+), 80 deletions(-)
next reply other threads:[~2019-04-17 21:45 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-04-17 21:33 Fenghua Yu [this message]
2019-04-17 21:33 ` [PATCH v7 01/21] x86/common: Align cpu_caps_cleared and cpu_caps_set to unsigned long Fenghua Yu
2019-04-17 21:33 ` [PATCH v7 02/21] drivers/net/b44: Align pwol_mask to unsigned long for better performance Fenghua Yu
2019-04-17 21:33 ` [PATCH v7 03/21] wlcore: simplify/fix/optimize reg_ch_conf_pending operations Fenghua Yu
2019-04-17 21:33 ` [PATCH v7 04/21] x86/split_lock: Align x86_capability to unsigned long to avoid split locked access Fenghua Yu
2019-04-18 9:20 ` David Laight
2019-04-18 11:08 ` David Laight
2019-04-18 11:49 ` Thomas Gleixner
2019-04-18 13:14 ` David Laight
2019-04-18 13:26 ` David Laight
2019-04-17 21:33 ` [PATCH v7 05/21] x86/msr-index: Define MSR_IA32_CORE_CAPABILITY and split lock detection bit Fenghua Yu
2019-04-17 21:33 ` [PATCH v7 06/21] x86/cpufeatures: Enumerate MSR_IA32_CORE_CAPABILITY Fenghua Yu
2019-04-17 21:33 ` [PATCH v7 07/21] x86/split_lock: Enumerate split lock detection by MSR_IA32_CORE_CAPABILITY Fenghua Yu
2019-04-17 21:33 ` [PATCH v7 08/21] x86/split_lock: Enumerate split lock detection on Icelake mobile processor Fenghua Yu
2019-04-17 21:33 ` [PATCH v7 09/21] x86/split_lock: Define MSR TEST_CTL register Fenghua Yu
2019-04-17 21:34 ` [PATCH v7 10/21] x86/split_lock: Define per CPU variable to cache MSR TEST_CTL Fenghua Yu
2019-04-17 22:14 ` Thomas Gleixner
2019-04-18 1:28 ` Fenghua Yu
2019-04-18 6:31 ` Thomas Gleixner
2019-04-17 21:34 ` [PATCH v7 11/21] x86/split_lock: Handle #AC exception for split lock Fenghua Yu
2019-04-17 21:34 ` [PATCH v7 12/21] kvm/x86: Emulate MSR IA32_CORE_CAPABILITY Fenghua Yu
2019-04-17 21:34 ` [PATCH v7 13/21] kvm/vmx: Emulate MSR TEST_CTL Fenghua Yu
2019-04-17 21:34 ` [PATCH v7 14/21] x86/split_lock: Enable split lock detection by default Fenghua Yu
2019-04-17 22:41 ` Thomas Gleixner
2019-04-17 21:34 ` [PATCH v7 15/21] x86/split_lock: Add a sysfs interface to enable/disable split lock detection during run time Fenghua Yu
2019-04-17 22:47 ` Thomas Gleixner
2019-04-18 0:57 ` Fenghua Yu
2019-04-18 6:41 ` Thomas Gleixner
2019-04-23 20:48 ` Fenghua Yu
2019-04-24 13:45 ` David Laight
2019-04-17 21:34 ` [PATCH v7 16/21] x86/split_lock: Document the new sysfs file for split lock detection Fenghua Yu
2019-04-17 21:34 ` [PATCH v7 17/21] x86/clearcpuid: Support multiple clearcpuid options Fenghua Yu
2019-04-17 23:05 ` Thomas Gleixner
2019-04-17 21:34 ` [PATCH v7 18/21] x86/clearcpuid: Support feature flag string in kernel option clearcpuid Fenghua Yu
2019-04-17 23:19 ` Thomas Gleixner
2019-04-17 23:47 ` Fenghua Yu
2019-04-18 6:16 ` Thomas Gleixner
2019-04-17 21:34 ` [PATCH v7 19/21] x86/clearcpuid: Apply cleared feature bits that are forced set before Fenghua Yu
2019-04-17 21:34 ` [PATCH v7 20/21] x86/clearcpuid: Clear CPUID bit in CPUID faulting Fenghua Yu
2019-04-17 21:34 ` [PATCH v7 21/21] x86/clearcpuid: Change document for kernel option clearcpuid Fenghua Yu
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.