linux-kernel - Re: [PATCH] KVM: x86/pmu: Disallow legacy LBRs if architectural LBRs are available

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 3 Feb 2023 13:59:40 +0800
From:   Like Xu <like.xu.linux@...il.com>
To:     Sean Christopherson <seanjc@...gle.com>
Cc:     kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
        Yang Weijiang <weijiang.yang@...el.com>,
        Paolo Bonzini <pbonzini@...hat.com>
Subject: Re: [PATCH] KVM: x86/pmu: Disallow legacy LBRs if architectural LBRs
 are available

On 3/2/2023 3:11 am, Sean Christopherson wrote:
> On Tue, Jan 31, 2023, Like Xu wrote:
>> On 28/1/2023 8:14 am, Sean Christopherson wrote:
>>> Disallow enabling LBR support if the CPU supports architectural LBRs.
>>> Traditional LBR support is absent on CPU models that have architectural
>>> LBRs, and KVM doesn't yet support arch LBRs, i.e. KVM will pass through
>>> non-existent MSRs if userspace enables LBRs for the guest.
>>
>> True, we have call_trace due to MSR_ARCH_LBR_FROM_0 (0x1500) for example.
>>
>>>
>>> Cc: stable@...r.kernel.org
>>> Cc: Yang Weijiang <weijiang.yang@...el.com>
>>> Cc: Like Xu <like.xu.linux@...il.com>
>>
>> Tested-by: Like Xu <likexu@...cent.com>
>>
>>> Reported-by: Paolo Bonzini <pbonzini@...hat.com>
>>
>> Fixes: 145dfad998ea ("KVM: VMX: Advertise PMU LBRs if and only if perf
>> supports LBRs")
> 
> If we want a fixes, I'd argue this is more appropriate:
> 
>    Fixes: be635e34c284 ("KVM: vmx/pmu: Expose LBR_FMT in the MSR_IA32_PERF_CAPABILITIES")
> 
> Though I'd prefer not to blame KVM, there's not much we could have done in KVM
> to know that Intel would effectively break backwards compatibility.

Personally, I assume the bigger role of the Fix tag is to help the stable tree's
bots make it easier to back port patches automatically, and there will be less
sense of blame for the developers. In pmu scope, if a feature is not "architecture",
I'm not surprised that a new arrival will break compatibility, and sometimes
kernel developers need to plan ahead.

> 
>>> Signed-off-by: Sean Christopherson <seanjc@...gle.com>
>>> ---
>>>
>>> Am I missing something that would prevent this scenario?
>>>
>>>    arch/x86/kvm/vmx/vmx.c | 8 +++++---
>>>    1 file changed, 5 insertions(+), 3 deletions(-)
>>>
>>> diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
>>> index 8f0f67c75f35..77ee6b4a5ec4 100644
>>> --- a/arch/x86/kvm/vmx/vmx.c
>>> +++ b/arch/x86/kvm/vmx/vmx.c
>>> @@ -7761,9 +7761,11 @@ static u64 vmx_get_perf_capabilities(void)
>>>    	if (boot_cpu_has(X86_FEATURE_PDCM))
>>>    		rdmsrl(MSR_IA32_PERF_CAPABILITIES, host_perf_cap);
>>> -	x86_perf_get_lbr(&lbr);
>>> -	if (lbr.nr)
>>> -		perf_cap |= host_perf_cap & PMU_CAP_LBR_FMT;
>>> +	if (!cpu_feature_enabled(X86_FEATURE_ARCH_LBR)) {
>>
>> To avoid changing this again in the Arch lbr enabling part, how about:
>>
>> 	x86_perf_get_lbr(&lbr);
>> 	if (lbr.nr && cpu_feature_enabled(X86_FEATURE_ARCH_LBR) ==
>> 	    kvm_cpu_cap_has(X86_FEATURE_ARCH_LBR))
>> 		perf_cap |= host_perf_cap & PMU_CAP_LBR_FMT;
>>
>> ?
> 
> I'd rather force arch LBR enabling to explicitly update this code.  And I'd prefer
> that KVM explicitly clear PMU_CAP_LBR_FMT when KVM can't use arch LBRs for whatever
> reason, both for documentation purposes and to avoid ordering dependencies between
> consuming vmx_get_perf_capabilities() and updating kvm_cpu_cap_has(X86_FEATURE_ARCH_LBR).

Indeed, we have too many assumptions about the order of function calls in the 
kernel world.
"Avoid ordering dependencies" looks good to me. Thanks.