From: Xiaoyao Li <xiaoyao.li@intel.com>
To: Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
"H. Peter Anvin" <hpa@zytor.com>,
Paolo Bonzini <pbonzini@redhat.com>,
Sean Christopherson <sean.j.christopherson@intel.com>
Cc: Xiaoyao Li <xiaoyao.li@intel.com>,
x86@kernel.org, linux-kernel@vger.kernel.org,
kvm@vger.kernel.org
Subject: [PATCH 2/2] KVM: VMX: Extend VMX's #AC handding
Date: Thu, 30 Jan 2020 20:19:39 +0800 [thread overview]
Message-ID: <20200130121939.22383-3-xiaoyao.li@intel.com> (raw)
In-Reply-To: <20200130121939.22383-1-xiaoyao.li@intel.com>
There are two types of #AC can be generated in Intel CPUs:
1. legacy alignment check #AC;
2. split lock #AC;
Legacy alignment check #AC can be injected to guest if guest has enabled
alignemnet check.
When host enables split lock detection, i.e., split_lock_detect!=off,
guest will receive an unexpected #AC when there is a split_lock happens in
guest since KVM doesn't virtualize this feature to guest.
Since the old guests lack split_lock #AC handler and may have split lock
buges. To make guest survive from split lock, applying the similar policy
as host's split lock detect configuration:
- host split lock detect is sld_warn:
warning the split lock happened in guest, and disabling split lock
detect around VM-enter;
- host split lock detect is sld_fatal:
forwarding #AC to userspace. (Usually userspace dump the #AC
exception and kill the guest).
Note, if sld_warn and SMT is enabled, the split lock in guest's vcpu
leads the disabling of split lock detect on the sibling CPU thread during
the vcpu is running.
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
---
arch/x86/include/asm/cpu.h | 1 +
arch/x86/kernel/cpu/intel.c | 6 ++++++
arch/x86/kvm/vmx/vmx.c | 42 ++++++++++++++++++++++++++++++++++---
arch/x86/kvm/vmx/vmx.h | 3 +++
4 files changed, 49 insertions(+), 3 deletions(-)
diff --git a/arch/x86/include/asm/cpu.h b/arch/x86/include/asm/cpu.h
index 167d0539e0ad..b46262afa6c1 100644
--- a/arch/x86/include/asm/cpu.h
+++ b/arch/x86/include/asm/cpu.h
@@ -52,6 +52,7 @@ extern enum split_lock_detect_state get_split_lock_detect_state(void);
extern void __init cpu_set_core_cap_bits(struct cpuinfo_x86 *c);
extern void switch_to_sld(unsigned long tifn);
extern bool handle_user_split_lock(struct pt_regs *regs, long error_code);
+extern void split_lock_detect_set(bool on);
#else
static inline enum split_lock_detect_state get_split_lock_detect_state(void)
{
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index 2f9c48e91caf..889469b54b5a 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -1124,6 +1124,12 @@ void switch_to_sld(unsigned long tifn)
__sld_msr_set(!(tifn & _TIF_SLD));
}
+void split_lock_detect_set(bool on)
+{
+ __sld_msr_set(on);
+}
+EXPORT_SYMBOL_GPL(split_lock_detect_set);
+
#define SPLIT_LOCK_CPU(model) {X86_VENDOR_INTEL, 6, model, X86_FEATURE_ANY}
/*
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index cdb4bf50ee14..402a9152c6ee 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -4553,6 +4553,12 @@ static int handle_machine_check(struct kvm_vcpu *vcpu)
return 1;
}
+static bool guest_cpu_alignment_check_enabled(struct kvm_vcpu *vcpu)
+{
+ return vmx_get_cpl(vcpu) == 3 && kvm_read_cr0_bits(vcpu, X86_CR0_AM) &&
+ (kvm_get_rflags(vcpu) & X86_EFLAGS_AC);
+}
+
static int handle_exception_nmi(struct kvm_vcpu *vcpu)
{
struct vcpu_vmx *vmx = to_vmx(vcpu);
@@ -4618,9 +4624,6 @@ static int handle_exception_nmi(struct kvm_vcpu *vcpu)
return handle_rmode_exception(vcpu, ex_no, error_code);
switch (ex_no) {
- case AC_VECTOR:
- kvm_queue_exception_e(vcpu, AC_VECTOR, error_code);
- return 1;
case DB_VECTOR:
dr6 = vmcs_readl(EXIT_QUALIFICATION);
if (!(vcpu->guest_debug &
@@ -4649,6 +4652,29 @@ static int handle_exception_nmi(struct kvm_vcpu *vcpu)
kvm_run->debug.arch.pc = vmcs_readl(GUEST_CS_BASE) + rip;
kvm_run->debug.arch.exception = ex_no;
break;
+ case AC_VECTOR:
+ /*
+ * Inject #AC back to guest only when legacy alignment check
+ * enabled.
+ * Otherwise, it must be a split-lock #AC.
+ * - If sld_state == sld_warn, it can let guest survive by
+ * setting the vcpu's diasble_split_lock_detect to true so
+ * that it will toggle MSR_TEST.SPLIT_LOCK_DETECT bit during
+ * every following VM Entry and Exit;
+ * - If sld_state == sld_fatal, it forwards #AC to userspace;
+ */
+ if (guest_cpu_alignment_check_enabled(vcpu) ||
+ WARN_ON(get_split_lock_detect_state() == sld_off)) {
+ kvm_queue_exception_e(vcpu, AC_VECTOR, error_code);
+ return 1;
+ }
+ if (get_split_lock_detect_state() == sld_warn) {
+ pr_warn("kvm: split lock #AC happened in %s [%d]\n",
+ current->comm, current->pid);
+ vmx->disable_split_lock_detect = true;
+ return 1;
+ }
+ /* fall through*/
default:
kvm_run->exit_reason = KVM_EXIT_EXCEPTION;
kvm_run->ex.exception = ex_no;
@@ -6511,6 +6537,11 @@ static void vmx_vcpu_run(struct kvm_vcpu *vcpu)
*/
x86_spec_ctrl_set_guest(vmx->spec_ctrl, 0);
+ if (static_cpu_has(X86_FEATURE_SPLIT_LOCK_DETECT) &&
+ !test_tsk_thread_flag(current, TIF_SLD) &&
+ unlikely(vmx->disable_split_lock_detect))
+ split_lock_detect_set(false);
+
/* L1D Flush includes CPU buffer clear to mitigate MDS */
if (static_branch_unlikely(&vmx_l1d_should_flush))
vmx_l1d_flush(vcpu);
@@ -6545,6 +6576,11 @@ static void vmx_vcpu_run(struct kvm_vcpu *vcpu)
x86_spec_ctrl_restore_host(vmx->spec_ctrl, 0);
+ if (static_cpu_has(X86_FEATURE_SPLIT_LOCK_DETECT) &&
+ !test_tsk_thread_flag(current, TIF_SLD) &&
+ unlikely(vmx->disable_split_lock_detect))
+ split_lock_detect_set(true);
+
/* All fields are clean at this point */
if (static_branch_unlikely(&enable_evmcs))
current_evmcs->hv_clean_fields |=
diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h
index 7f42cf3dcd70..912eba66c5d5 100644
--- a/arch/x86/kvm/vmx/vmx.h
+++ b/arch/x86/kvm/vmx/vmx.h
@@ -274,6 +274,9 @@ struct vcpu_vmx {
bool req_immediate_exit;
+ /* Disable split-lock detection when running the vCPU */
+ bool disable_split_lock_detect;
+
/* Support for PML */
#define PML_ENTITY_NUM 512
struct page *pml_pg;
--
2.23.0
next prev parent reply other threads:[~2020-01-30 12:24 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-30 12:19 [PATCH 0/2] kvm: split_lock: Fix emulator and extend #AC handler Xiaoyao Li
2020-01-30 12:19 ` [PATCH 1/2] KVM: x86: Emulate split-lock access as a write Xiaoyao Li
2020-01-30 12:31 ` David Laight
2020-01-30 15:16 ` Andy Lutomirski
2020-01-31 20:01 ` Sean Christopherson
2020-02-04 14:47 ` Vitaly Kuznetsov
2020-02-10 21:59 ` Sean Christopherson
2020-01-30 12:19 ` Xiaoyao Li [this message]
2020-01-30 15:18 ` [PATCH 2/2] KVM: VMX: Extend VMX's #AC handding Andy Lutomirski
2020-01-30 16:29 ` Xiaoyao Li
2020-01-30 17:16 ` Andy Lutomirski
2020-01-31 7:22 ` Xiaoyao Li
2020-01-31 15:37 ` Andy Lutomirski
2020-01-31 17:47 ` Xiaoyao Li
2020-01-31 20:17 ` Sean Christopherson
2020-01-31 20:57 ` Andy Lutomirski
2020-01-31 21:04 ` Sean Christopherson
2020-01-31 21:33 ` Andy Lutomirski
2020-02-01 16:58 ` Xiaoyao Li
2020-02-01 17:56 ` Andy Lutomirski
2020-02-02 4:33 ` Xiaoyao Li
2020-02-03 18:49 ` Andy Lutomirski
2020-02-04 6:03 ` Sean Christopherson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200130121939.22383-3-xiaoyao.li@intel.com \
--to=xiaoyao.li@intel.com \
--cc=bp@alien8.de \
--cc=hpa@zytor.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=pbonzini@redhat.com \
--cc=sean.j.christopherson@intel.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).