linux-kernel - Re: [PATCH v8 08/26] KVM: x86/pmu: Disallow "fast" RDPMC for architectural Intel PMUs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZU69h65HwvnpjhjX@google.com>
Date:   Fri, 10 Nov 2023 15:32:23 -0800
From:   Sean Christopherson <seanjc@...gle.com>
To:     Dapeng Mi <dapeng1.mi@...ux.intel.com>
Cc:     Paolo Bonzini <pbonzini@...hat.com>, kvm@...r.kernel.org,
        linux-kernel@...r.kernel.org,
        Kan Liang <kan.liang@...ux.intel.com>,
        Jim Mattson <jmattson@...gle.com>,
        Jinrong Liang <cloudliang@...cent.com>,
        Aaron Lewis <aaronlewis@...gle.com>,
        Like Xu <likexu@...cent.com>
Subject: Re: [PATCH v8 08/26] KVM: x86/pmu: Disallow "fast" RDPMC for
 architectural Intel PMUs

On Fri, Nov 10, 2023, Dapeng Mi wrote:
> On 11/10/2023 10:12 AM, Sean Christopherson wrote:
> > Inject #GP on RDPMC if the "fast" flag is set for architectural Intel
> > PMUs, i.e. if the PMU version is non-zero.  Per Intel's SDM, and confirmed
> > on bare metal, the "fast" flag is supported only for non-architectural
> > PMUs, and is reserved for architectural PMUs.
> > 
> >    If the processor does not support architectural performance monitoring
> >    (CPUID.0AH:EAX[7:0]=0), ECX[30:0] specifies the index of the PMC to be
> >    read. Setting ECX[31] selects “fast” read mode if supported. In this mode,
> >    RDPMC returns bits 31:0 of the PMC in EAX while clearing EDX to zero.
> > 
> >    If the processor does support architectural performance monitoring
> >    (CPUID.0AH:EAX[7:0] ≠ 0), ECX[31:16] specifies type of PMC while ECX[15:0]
> >    specifies the index of the PMC to be read within that type. The following
> >    PMC types are currently defined:
> >    — General-purpose counters use type 0. The index x (to read IA32_PMCx)
> >      must be less than the value enumerated by CPUID.0AH.EAX[15:8] (thus
> >      ECX[15:8] must be zero).
> >    — Fixed-function counters use type 4000H. The index x (to read
> >      IA32_FIXED_CTRx) can be used if either CPUID.0AH.EDX[4:0] > x or
> >      CPUID.0AH.ECX[x] = 1 (thus ECX[15:5] must be 0).
> >    — Performance metrics use type 2000H. This type can be used only if
> >      IA32_PERF_CAPABILITIES.PERF_METRICS_AVAILABLE[bit 15]=1. For this type,
> >      the index in ECX[15:0] is implementation specific.
> > 
> > WARN if KVM ever actually tries to complete RDPMC for a non-architectural
> > PMU as KVM doesn't support such PMUs, i.e. kvm_pmu_rdpmc() should reject
> > the RDPMC before getting to the Intel code.
> > 
> > Fixes: f5132b01386b ("KVM: Expose a version 2 architectural PMU to a guests")
> > Fixes: 67f4d4288c35 ("KVM: x86: rdpmc emulation checks the counter incorrectly")
> > Signed-off-by: Sean Christopherson <seanjc@...gle.com>
> > ---
> >   arch/x86/kvm/vmx/pmu_intel.c | 14 +++++++++++++-
> >   1 file changed, 13 insertions(+), 1 deletion(-)
> > 
> > diff --git a/arch/x86/kvm/vmx/pmu_intel.c b/arch/x86/kvm/vmx/pmu_intel.c
> > index c6ea128ea7c8..80255f86072e 100644
> > --- a/arch/x86/kvm/vmx/pmu_intel.c
> > +++ b/arch/x86/kvm/vmx/pmu_intel.c
> > @@ -61,7 +61,19 @@ static struct kvm_pmc *intel_pmc_idx_to_pmc(struct kvm_pmu *pmu, int pmc_idx)
> >   static u32 intel_rdpmc_get_masked_idx(struct kvm_pmu *pmu, u32 idx)
> >   {
> > -	return idx & ~(INTEL_RDPMC_FIXED | INTEL_RDPMC_FAST);
> > +	/*
> > +	 * Fast RDPMC is only supported on non-architectural PMUs, which KVM
> > +	 * doesn't support.
> > +	 */
> > +	if (WARN_ON_ONCE(!pmu->version))

Gah, this WARN fires when the emulator pre-checks RDPMC via emulator_check_pmc()
-> kvm_pmu_is_valid_rdpmc_ecx.  I suspect I missed the splat due to split-lock
detection spamming my kernel log (I'm running a sliiiightly old OVMF build).

If this is the only issue with v8, I'll just drop the WARN and the changelog
paragraph when applying.