From nobody Sun Dec 14 20:30:53 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass header.i=@intel.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1754625657; cv=none; d=zohomail.com; s=zohoarc; b=JIUrsjkW9FVmgeimYQKfk80watf1SqC5JDO5J8prMxLTNdKnHYsZb+cEprAGMf9uFzD+KP3XYl1JvMpIDtqLdCVJIRud0y9pYb76IjDzoGwD+IjEgs80lH0ibRFgskI8enj4XAiXkAz9dymBXCCvvI7cm1jzTyU77VdxjlHMucE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1754625657; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=17zfbOZT3uHiIzDSm9HUwad4qd5j5Qsv0dSYp7inNMk=; b=N7MmJjmHyWhT665jUcv1H9BGGpAUgOcBZoNCEWfKqPxh1xGumPsPETkEh3pnI1Lf2VPH3nCnum0+mHFT3PRniKkvyUy2WBvZuU9Ib7Dm/tS+AFpaHtFQ7nf2FJTUyZIV0Rk1ePBWDyaTI3j227hmofgEF3TOAJz+QLZ/eComYz4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=@intel.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1754625657586827.3725699514672; Thu, 7 Aug 2025 21:00:57 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ukEGy-0001f5-6v; Fri, 08 Aug 2025 00:00:04 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ukEGv-0001SZ-1o for qemu-devel@nongnu.org; Fri, 08 Aug 2025 00:00:01 -0400 Received: from mgamail.intel.com ([198.175.65.11]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ukEGr-0007rN-8z for qemu-devel@nongnu.org; Fri, 08 Aug 2025 00:00:00 -0400 Received: from orviesa001.jf.intel.com ([10.64.159.141]) by orvoesa103.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 07 Aug 2025 20:59:49 -0700 Received: from lxy-clx-4s.sh.intel.com ([10.239.48.52]) by orviesa001.jf.intel.com with ESMTP; 07 Aug 2025 20:59:47 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1754625598; x=1786161598; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=H0oj78qMARfoPCMsvV/I2EmpS1UbBd3NDK4oaELIIhc=; b=cbpp8zp2EBXfy9TJM7wRtAmHuAvYAL3XZyf8tjuApNsrWdpK142VVX70 aXItPlidE54n7dJiw76I2JjGQenCFK13ennqoHE/uEyuuCJVcM05GVuLL iwpIWzd05stKpkACR0Zb4vAkblj9iQUDwijb3kxG+EXqva0sPcvvOfFbF F70Jqt3dwVpnWFZWCO2S9q7HeJXb5Jx/r3ludLqOXvb42OTh4nL8cJxRD 2IMk6/dfdRnZ+LxgYJNdGNC2AaKcZ/SqfdoQ/3lxn0p+fhxVFF2l1IUn6 /QSOqTubIGGdz1FVmRfeiHUT2xeltEV2qulAzJpy3xp3bfs2viq6jQ81g g==; X-CSE-ConnectionGUID: 0dYCEeE4QbWYnhM8qNskRg== X-CSE-MsgGUID: N034E+kZRWK3QBr859ee+A== X-IronPort-AV: E=McAfee;i="6800,10657,11514"; a="67241039" X-IronPort-AV: E=Sophos;i="6.17,274,1747724400"; d="scan'208";a="67241039" X-CSE-ConnectionGUID: uwm4WDHzQoyOKSrrW7UDOw== X-CSE-MsgGUID: JOemxBgrSKeE/ZaY0dCpMQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.17,274,1747724400"; d="scan'208";a="202394866" From: Xiaoyao Li To: Paolo Bonzini Cc: qemu-devel@nongnu.org, Chenyi Qiang , Xiaoyao Li Subject: [PATCH] multiboot: Fix the split lock Date: Fri, 8 Aug 2025 11:50:27 +0800 Message-ID: <20250808035027.2194673-1-xiaoyao.li@intel.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=198.175.65.11; envelope-from=xiaoyao.li@intel.com; helo=mgamail.intel.com X-Spam_score_int: -43 X-Spam_score: -4.4 X-Spam_bar: ---- X-Spam_report: (-4.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HK_RANDOM_ENVFROM=0.001, HK_RANDOM_FROM=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @intel.com) X-ZM-MESSAGEID: 1754625662347124100 Content-Type: text/plain; charset="utf-8" While running the kvm-unit-tests on Intel platforms with "split lock disable" feature, every test triggers a kernel warning of x86/split lock detection: #AC: qemu-system-x86_64/373232 took a split_loc= k trap at address: 0x1e3 Hack KVM by exiting to QEMU on split lock #AC, we get KVM: exception 17 exit (error code 0x0) EAX=3D00000001 EBX=3D00000000 ECX=3D00000014 EDX=3D0001fb80 ESI=3D00000000 EDI=3D000000a8 EBP=3D00000000 ESP=3D00006f10 EIP=3D000001e3 EFL=3D00010002 [-------] CPL=3D0 II=3D0 A20=3D1 SMM=3D0 HLT= =3D0 ES =3D0900 00009000 0000ffff 00009300 DPL=3D0 DS16 [-WA] CS =3Dc000 000c0000 0000ffff 00009b00 DPL=3D0 CS16 [-RA] SS =3D0000 00000000 0000ffff 00009300 DPL=3D0 DS16 [-WA] DS =3Dc000 000c0000 0000ffff 00009300 DPL=3D0 DS16 [-WA] FS =3D0950 00009500 0000ffff 00009300 DPL=3D0 DS16 [-WA] GS =3D06f2 00006f20 0000ffff 00009300 DPL=3D0 DS16 [-WA] LDT=3D0000 00000000 0000ffff 00008200 DPL=3D0 LDT TR =3D0000 00000000 0000ffff 00008b00 DPL=3D0 TSS32-busy GDT=3D 000c02b4 00000027 IDT=3D 00000000 000003ff CR0=3D00000011 CR2=3D00000000 CR3=3D00000000 CR4=3D00000000 DR0=3D0000000000000000 DR1=3D0000000000000000 DR2=3D0000000000000000 DR3=3D= 0000000000000000 DR6=3D00000000ffff0ff0 DR7=3D0000000000000400 EFER=3D0000000000000000 Code=3D89 16 08 00 65 66 0f 01 16 06 00 66 b8 01 00 00 00 0f 22 c0 <65> 66 = ff 2e 00 00 b8 10 00 00 00 8e d0 8e d8 8e c0 8e e0 8e e8 66 b8 08 00 66 ba = 10 05 66 And it matches with what disassembled from multiboo_dma.bin: #objdump -b binary -m i386 -D pc-bios/multiboot_dma.bin 1d1: 08 00 or %al,(%eax) 1d3: 65 66 0f 01 16 lgdtw %gs:(%esi) 1d8: 06 push %es 1d9: 00 66 b8 add %ah,-0x48(%esi) 1dc: 01 00 add %eax,(%eax) 1de: 00 00 add %al,(%eax) 1e0: 0f 22 c0 mov %eax,%cr0 > 1e3: 65 66 ff 2e ljmpw *%gs:(%esi) 1e7: 00 00 add %al,(%eax) 1e9: b8 10 00 00 00 mov $0x10,%eax 1ee: 8e d0 mov %eax,%ss 1f0: 8e d8 mov %eax,%ds 1f2: 8e c0 mov %eax,%es 1f4: 8e e0 mov %eax,%fs 1f6: 8e e8 mov %eax,%gs 1f8: 66 b8 08 00 mov $0x8,%ax 1fc: 66 ba 10 05 mov $0x510,%dx We can see that the instruction at 0x1e3 is a far jmp through the GDT. However, the GDT is not 8 byte aligned, the base is 0xc02b4. Intel processors follow the LOCK semantics to set the accessed flag of the segment descriptor when loading a segment descriptor. If the the segment descriptor crosses two cache line, it causes split lock. Fix it by aligning the GDT on 8 bytes, so that segment descriptor cannot span two cache lines. Signed-off-by: Xiaoyao Li Reviewed-by: Philippe Mathieu-Daud=C3=A9 --- pc-bios/multiboot_dma.bin | Bin 1024 -> 1024 bytes pc-bios/optionrom/multiboot.S | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/pc-bios/multiboot_dma.bin b/pc-bios/multiboot_dma.bin index c0e2c3102a3358207c61d3ae113524fb6007abc3..e6d0c97093b4fc11bc87fd58cbe= 6e577c2841cd0 100644 GIT binary patch delta 42 zcmV+_0M-A12!IHXDg)*M>ya%_3*Z7}i5><3W{V!;v4=3DGRlehvV0l2f@0vrJWTRMsk AMgRZ+ delta 46 zcmV+}0MY+|2!IHXDg)vI=3DaDT>3)})_i5><3W{V!)v4=3DGRlfVKZ0kpH@0vrL85Ca4O EZ**7=3D_y7O^ diff --git a/pc-bios/optionrom/multiboot.S b/pc-bios/optionrom/multiboot.S index 181a4b03a3f2..c95e35c9cb62 100644 --- a/pc-bios/optionrom/multiboot.S +++ b/pc-bios/optionrom/multiboot.S @@ -208,7 +208,7 @@ ljmp2: prot_jump: .long prot_mode .short 8 =20 -.align 4, 0 +.align 8, 0 gdt: /* 0x00 */ .byte 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 --=20 2.43.0