From: Thomas Gleixner <tglx@linutronix.de>
To: LKML <linux-kernel@vger.kernel.org>
Cc: x86@kernel.org,
Sean Christopherson <sean.j.christopherson@intel.com>,
Xiaoyao Li <xiaoyao.li@intel.com>,
"Kenneth R. Crudup" <kenny@panix.com>,
Paolo Bonzini <pbonzini@redhat.com>,
Fenghua Yu <fenghua.yu@intel.com>, Nadav Amit <namit@vmware.com>,
Thomas Hellstrom <thellstrom@vmware.com>,
Tony Luck <tony.luck@intel.com>
Subject: [patch 2/3] KVM: x86: Emulate split-lock access as a write in emulator
Date: Fri, 10 Apr 2020 13:54:01 +0200
Message-ID: <20200410115517.084300242@linutronix.de> (raw)
In-Reply-To: <20200410115359.242241855@linutronix.de>
From: Xiaoyao Li <xiaoyao.li@intel.com>
Emulate split-lock accesses as writes if split lock detection is on to
avoid #AC during emulation, which will result in a panic(). This should
never occur for a well behaved guest, but a malicious guest can
manipulate the TLB to trigger emulation of a locked instruction[1].
More discussion can be found [2][3].
[1] https://lkml.kernel.org/r/8c5b11c9-58df-38e7-a514-dc12d687b198@redhat.com
[2] https://lkml.kernel.org/r/20200131200134.GD18946@linux.intel.com
[3] https://lkml.kernel.org/r/20200227001117.GX9940@linux.intel.com
Suggested-by: Sean Christopherson <sean.j.christopherson@intel.com>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
---
arch/x86/kvm/x86.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -5838,6 +5838,7 @@ static int emulator_cmpxchg_emulated(str
{
struct kvm_host_map map;
struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt);
+ u64 page_line_mask;
gpa_t gpa;
char *kaddr;
bool exchanged;
@@ -5852,7 +5853,16 @@ static int emulator_cmpxchg_emulated(str
(gpa & PAGE_MASK) == APIC_DEFAULT_PHYS_BASE)
goto emul_write;
- if (((gpa + bytes - 1) & PAGE_MASK) != (gpa & PAGE_MASK))
+ /*
+ * Emulate the atomic as a straight write to avoid #AC if SLD is
+ * enabled in the host and the access splits a cache line.
+ */
+ if (boot_cpu_has(X86_FEATURE_SPLIT_LOCK_DETECT))
+ page_line_mask = ~(cache_line_size() - 1);
+ else
+ page_line_mask = PAGE_MASK;
+
+ if (((gpa + bytes - 1) & page_line_mask) != (gpa & page_line_mask))
goto emul_write;
if (kvm_vcpu_map(vcpu, gpa_to_gfn(gpa), &map))
next prev parent reply index
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-10 11:53 [patch 0/3] x86/kvm: Basic split lock #AC handling Thomas Gleixner
2020-04-10 11:54 ` [patch 1/3] x86/split_lock: Provide handle_guest_split_lock() Thomas Gleixner
2020-04-11 16:04 ` [tip: x86/urgent] " tip-bot2 for Thomas Gleixner
2020-04-10 11:54 ` Thomas Gleixner [this message]
2020-04-11 16:04 ` [tip: x86/urgent] KVM: x86: Emulate split-lock access as a write in emulator tip-bot2 for Xiaoyao Li
2020-04-10 11:54 ` [patch 3/3] KVM: VMX: Extend VMXs #AC interceptor to handle split lock #AC in guest Thomas Gleixner
2020-04-11 16:04 ` [tip: x86/urgent] " tip-bot2 for Xiaoyao Li
2020-04-10 15:15 ` [patch 0/3] x86/kvm: Basic split lock #AC handling Paolo Bonzini
2020-04-10 19:02 ` Sean Christopherson
2020-04-14 7:38 ` Thomas Gleixner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200410115517.084300242@linutronix.de \
--to=tglx@linutronix.de \
--cc=fenghua.yu@intel.com \
--cc=kenny@panix.com \
--cc=linux-kernel@vger.kernel.org \
--cc=namit@vmware.com \
--cc=pbonzini@redhat.com \
--cc=sean.j.christopherson@intel.com \
--cc=thellstrom@vmware.com \
--cc=tony.luck@intel.com \
--cc=x86@kernel.org \
--cc=xiaoyao.li@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
LKML Archive on lore.kernel.org
Archives are clonable:
git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git
git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git
git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git
git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git
git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git
git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git
git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git
git clone --mirror https://lore.kernel.org/lkml/7 lkml/git/7.git
git clone --mirror https://lore.kernel.org/lkml/8 lkml/git/8.git
git clone --mirror https://lore.kernel.org/lkml/9 lkml/git/9.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \
linux-kernel@vger.kernel.org
public-inbox-index lkml
Example config snippet for mirrors
Newsgroup available over NNTP:
nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git