From: Sean Christopherson <sean.j.christopherson@intel.com>
To: Thomas Gleixner <tglx@linutronix.de>
Cc: LKML <linux-kernel@vger.kernel.org>,
x86@kernel.org, "Kenneth R. Crudup" <kenny@panix.com>,
Paolo Bonzini <pbonzini@redhat.com>,
Fenghua Yu <fenghua.yu@intel.com>,
Xiaoyao Li <xiaoyao.li@intel.com>, Nadav Amit <namit@vmware.com>,
Thomas Hellstrom <thellstrom@vmware.com>,
Tony Luck <tony.luck@intel.com>,
"Peter Zijlstra (Intel)" <peterz@infradead.org>,
Jessica Yu <jeyu@kernel.org>,
Steven Rostedt <rostedt@goodmis.org>
Subject: Re: [patch 2/2] x86/kvm/vmx: Prevent split lock detection induced #AC wreckage
Date: Thu, 2 Apr 2020 08:30:35 -0700 [thread overview]
Message-ID: <20200402153035.GA13879@linux.intel.com> (raw)
In-Reply-To: <20200402124205.334622628@linutronix.de>
On Thu, Apr 02, 2020 at 02:33:00PM +0200, Thomas Gleixner wrote:
> Without at least minimal handling for split lock detection induced #AC, VMX
> will just run into the same problem as the VMWare hypervisor, which was
> reported by Kenneth.
>
> It will inject the #AC blindly into the guest whether the guest is prepared
> or not.
>
> Add the minimal required handling for it:
>
> - Check guest state whether CR0.AM is enabled and EFLAGS.AC is set. If
> so, then the #AC originated from CPL3 and the guest has is prepared to
> handle it. In this case it does not matter whether the #AC is due to a
> split lock or a regular unaligned check.
>
> - Invoke a minimal split lock detection handler. If the host SLD mode is
> sld_warn, then handle it in the same way as user space handling works:
> Emit a warning, disable SLD and mark the current task with TIF_SLD.
> With that resume the guest without injecting #AC.
>
> If the host mode is sld_fatal or sld_off, emit a warning and deliver
> the exception to user space which can crash and burn itself.
>
> Mark the module with MOD_INFO(sld_safe, "Y") so the module loader does not
> force SLD off.
Some comments below. But, any objection to taking Xiaoyao's patches that
do effectively the same things, minus the MOD_INFO()? I'll repost them in
reply to this thread.
> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> Cc: "Kenneth R. Crudup" <kenny@panix.com>
> Cc: Paolo Bonzini <pbonzini@redhat.com>
> Cc: Fenghua Yu <fenghua.yu@intel.com>
> Cc: Xiaoyao Li <xiaoyao.li@intel.com>
> Cc: Nadav Amit <namit@vmware.com>
> Cc: Thomas Hellstrom <thellstrom@vmware.com>
> Cc: Sean Christopherson <sean.j.christopherson@intel.com>
> Cc: Tony Luck <tony.luck@intel.com>
> ---
> arch/x86/include/asm/cpu.h | 1 +
> arch/x86/kernel/cpu/intel.c | 28 +++++++++++++++++++++++-----
> arch/x86/kvm/vmx/vmx.c | 40 +++++++++++++++++++++++++++++++++++++---
> 3 files changed, 61 insertions(+), 8 deletions(-)
>
> --- a/arch/x86/include/asm/cpu.h
> +++ b/arch/x86/include/asm/cpu.h
> @@ -44,6 +44,7 @@ unsigned int x86_stepping(unsigned int s
> extern void __init cpu_set_core_cap_bits(struct cpuinfo_x86 *c);
> extern void switch_to_sld(unsigned long tifn);
> extern bool handle_user_split_lock(struct pt_regs *regs, long error_code);
> +extern bool handle_guest_split_lock(unsigned long ip);
> extern void split_lock_validate_module_text(struct module *me, void *text, void *text_end);
> #else
> static inline void __init cpu_set_core_cap_bits(struct cpuinfo_x86 *c) {}
> --- a/arch/x86/kernel/cpu/intel.c
> +++ b/arch/x86/kernel/cpu/intel.c
> @@ -1102,13 +1102,10 @@ static void split_lock_init(void)
> split_lock_verify_msr(sld_state != sld_off);
> }
>
> -bool handle_user_split_lock(struct pt_regs *regs, long error_code)
> +static void split_lock_warn(unsigned long ip)
> {
> - if ((regs->flags & X86_EFLAGS_AC) || sld_state == sld_fatal)
> - return false;
> -
> pr_warn_ratelimited("#AC: %s/%d took a split_lock trap at address: 0x%lx\n",
> - current->comm, current->pid, regs->ip);
> + current->comm, current->pid, ip);
>
> /*
> * Disable the split lock detection for this task so it can make
> @@ -1117,6 +1114,27 @@ bool handle_user_split_lock(struct pt_re
> */
> sld_update_msr(false);
> set_tsk_thread_flag(current, TIF_SLD);
> +}
> +
> +bool handle_guest_split_lock(unsigned long ip)
> +{
> + if (sld_state == sld_warn) {
> + split_lock_warn(ip);
> + return true;
> + }
> +
> + pr_warn_once("#AC: %s/%d %s split_lock trap at address: 0x%lx\n",
> + current->comm, current->pid,
> + sld_state == sld_fatal ? "fatal" : "bogus", ip);
> + return false;
> +}
> +EXPORT_SYMBOL_GPL(handle_guest_split_lock);
> +
> +bool handle_user_split_lock(struct pt_regs *regs, long error_code)
> +{
> + if ((regs->flags & X86_EFLAGS_AC) || sld_state == sld_fatal)
> + return false;
> + split_lock_warn(regs->ip);
> return true;
> }
>
> --- a/arch/x86/kvm/vmx/vmx.c
> +++ b/arch/x86/kvm/vmx/vmx.c
> @@ -65,6 +65,7 @@
>
> MODULE_AUTHOR("Qumranet");
> MODULE_LICENSE("GPL");
> +MODULE_INFO(sld_safe, "Y");
>
> #ifdef MODULE
> static const struct x86_cpu_id vmx_cpu_id[] = {
> @@ -4623,6 +4624,22 @@ static int handle_machine_check(struct k
> return 1;
> }
>
> +static bool guest_handles_ac(struct kvm_vcpu *vcpu)
> +{
> + /*
> + * If guest has alignment checking enabled in CR0 and activated in
> + * eflags, then the #AC originated from CPL3 and the guest is able
> + * to handle it. It does not matter whether this is a regular or
> + * a split lock operation induced #AC.
> + */
> + if (vcpu->arch.cr0 & X86_CR0_AM &&
Technically not required since KVM doesn't let the gets toggle CR0.AM at
will, but going through kvm_read_cr0{_bits}() is preferred.
> + vmx_get_rflags(vcpu) & X86_EFLAGS_AC)
I don't think this is correct. A guest could trigger a split-lock #AC at
CPL0 with EFLAGS.AC=1 and CR0.AM=1, and then panic because it didn't expect
#AC at CPL0.
> + return true;
> +
> + /* Add guest SLD handling checks here once it's supported */
> + return false;
> +}
> +
> static int handle_exception_nmi(struct kvm_vcpu *vcpu)
> {
> struct vcpu_vmx *vmx = to_vmx(vcpu);
> @@ -4688,9 +4705,6 @@ static int handle_exception_nmi(struct k
> return handle_rmode_exception(vcpu, ex_no, error_code);
>
> switch (ex_no) {
> - case AC_VECTOR:
> - kvm_queue_exception_e(vcpu, AC_VECTOR, error_code);
> - return 1;
> case DB_VECTOR:
> dr6 = vmcs_readl(EXIT_QUALIFICATION);
> if (!(vcpu->guest_debug &
> @@ -4719,6 +4733,26 @@ static int handle_exception_nmi(struct k
> kvm_run->debug.arch.pc = vmcs_readl(GUEST_CS_BASE) + rip;
> kvm_run->debug.arch.exception = ex_no;
> break;
> + case AC_VECTOR:
> + if (guest_handles_ac(vcpu)) {
> + kvm_queue_exception_e(vcpu, AC_VECTOR, error_code);
> + return 1;
> + }
> + /*
> + * Handle #AC caused by split lock detection. If the host
> + * mode is sld_warn, then it warns, marks current with
> + * TIF_SLD and disables split lock detection. So the guest
> + * can just continue.
> + *
> + * If the host mode is fatal, the handling code warned. Let
> + * qemu kill itself.
> + *
> + * If the host mode is off, then this #AC is bonkers and
> + * something is badly wrong. Let it fail as well.
> + */
> + if (handle_guest_split_lock(kvm_rip_read(vcpu)))
> + return 1;
> + /* fall through */
> default:
> kvm_run->exit_reason = KVM_EXIT_EXCEPTION;
> kvm_run->ex.exception = ex_no;
>
next prev parent reply other threads:[~2020-04-02 15:30 UTC|newest]
Thread overview: 76+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-02 12:32 [patch 0/2] x86: Prevent Split-Lock-Detection wreckage on VMX hypervisors Thomas Gleixner
2020-04-02 12:32 ` [patch 1/2] x86,module: Detect VMX modules and disable Split-Lock-Detect Thomas Gleixner
2020-04-02 15:23 ` [patch v2 " Peter Zijlstra
2020-04-02 16:20 ` Xiaoyao Li
2020-04-02 16:25 ` Peter Zijlstra
2020-04-02 16:39 ` Nadav Amit
2020-04-02 16:41 ` Xiaoyao Li
2020-04-02 17:34 ` Thomas Gleixner
2020-04-02 17:51 ` Sean Christopherson
2020-04-02 18:51 ` Peter Zijlstra
2020-04-02 20:23 ` Sean Christopherson
2020-04-02 21:04 ` Thomas Gleixner
2020-04-02 21:16 ` Sean Christopherson
2020-04-03 8:09 ` David Laight
2020-04-03 14:33 ` Peter Zijlstra
2020-04-02 23:42 ` [patch " Rasmus Villemoes
2020-04-03 14:35 ` Jessica Yu
2020-04-03 15:21 ` Peter Zijlstra
2020-04-03 16:01 ` Sean Christopherson
2020-04-03 16:12 ` Peter Zijlstra
2020-04-03 16:16 ` David Laight
2020-04-03 16:39 ` Peter Zijlstra
2020-04-03 16:25 ` Sean Christopherson
2020-04-03 16:40 ` Peter Zijlstra
2020-04-03 16:48 ` Nadav Amit
2020-04-03 17:21 ` Sean Christopherson
2020-04-03 18:53 ` Thomas Gleixner
2020-04-03 20:58 ` Andy Lutomirski
2020-04-03 21:49 ` Thomas Gleixner
2020-04-03 11:29 ` kbuild test robot
2020-04-03 14:43 ` kbuild test robot
2020-04-03 16:36 ` Sean Christopherson
2020-04-03 16:41 ` Peter Zijlstra
2020-04-03 18:35 ` Jessica Yu
2020-04-06 12:23 ` Christoph Hellwig
2020-04-06 14:40 ` Peter Zijlstra
2020-04-06 15:18 ` Christoph Hellwig
2020-04-06 15:22 ` Peter Zijlstra
2020-04-06 18:27 ` Steven Rostedt
2020-04-02 12:33 ` [patch 2/2] x86/kvm/vmx: Prevent split lock detection induced #AC wreckage Thomas Gleixner
2020-04-02 15:30 ` Sean Christopherson [this message]
2020-04-02 15:44 ` Nadav Amit
2020-04-02 16:04 ` Sean Christopherson
2020-04-02 16:56 ` Thomas Gleixner
2020-04-02 15:55 ` [PATCH 0/3] x86: KVM: VMX: Add basic split-lock #AC handling Sean Christopherson
2020-04-02 15:55 ` [PATCH 1/3] KVM: x86: Emulate split-lock access as a write in emulator Sean Christopherson
2020-04-02 15:55 ` [PATCH 2/3] x86/split_lock: Refactor and export handle_user_split_lock() for KVM Sean Christopherson
2020-04-02 17:01 ` Thomas Gleixner
2020-04-02 17:19 ` Sean Christopherson
2020-04-02 19:06 ` Thomas Gleixner
2020-04-10 4:39 ` Xiaoyao Li
2020-04-10 10:21 ` Paolo Bonzini
2020-04-02 15:55 ` [PATCH 3/3] KVM: VMX: Extend VMX's #AC interceptor to handle split lock #AC in guest Sean Christopherson
2020-04-02 17:19 ` Thomas Gleixner
2020-04-02 17:40 ` Sean Christopherson
2020-04-02 20:07 ` Thomas Gleixner
2020-04-02 20:36 ` Andy Lutomirski
2020-04-02 20:48 ` Peter Zijlstra
2020-04-02 20:51 ` Sean Christopherson
2020-04-02 22:27 ` Thomas Gleixner
2020-04-02 22:40 ` Nadav Amit
2020-04-02 23:03 ` Thomas Gleixner
2020-04-02 23:08 ` Steven Rostedt
2020-04-02 23:16 ` Kenneth R. Crudup
2020-04-02 23:18 ` Jim Mattson
2020-04-03 12:16 ` Thomas Gleixner
2020-04-10 10:23 ` [PATCH 0/3] x86: KVM: VMX: Add basic split-lock #AC handling Paolo Bonzini
2020-04-10 11:14 ` Thomas Gleixner
2020-04-02 13:43 ` [patch 0/2] x86: Prevent Split-Lock-Detection wreckage on VMX hypervisors Kenneth R. Crudup
2020-04-02 14:32 ` Peter Zijlstra
2020-04-02 14:41 ` Kenneth R. Crudup
2020-04-02 14:46 ` Peter Zijlstra
2020-04-02 14:53 ` Kenneth R. Crudup
2020-04-02 14:37 ` Thomas Gleixner
2020-04-02 14:47 ` Nadav Amit
2020-04-02 15:11 ` Peter Zijlstra
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200402153035.GA13879@linux.intel.com \
--to=sean.j.christopherson@intel.com \
--cc=fenghua.yu@intel.com \
--cc=jeyu@kernel.org \
--cc=kenny@panix.com \
--cc=linux-kernel@vger.kernel.org \
--cc=namit@vmware.com \
--cc=pbonzini@redhat.com \
--cc=peterz@infradead.org \
--cc=rostedt@goodmis.org \
--cc=tglx@linutronix.de \
--cc=thellstrom@vmware.com \
--cc=tony.luck@intel.com \
--cc=x86@kernel.org \
--cc=xiaoyao.li@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).