From nobody Sun Sep 28 15:58:40 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1758891616104790.9166037568388; Fri, 26 Sep 2025 06:00:16 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1v27tj-00037d-Qc; Fri, 26 Sep 2025 08:50:04 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1v27tJ-0002ZY-6E; Fri, 26 Sep 2025 08:49:37 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1v27t7-0007Dq-Kl; Fri, 26 Sep 2025 08:49:36 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id E7CEF157F5F; Fri, 26 Sep 2025 15:45:41 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 55630290F1D; Fri, 26 Sep 2025 15:45:43 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Xiaoyao Li , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Paolo Bonzini , Michael Tokarev Subject: [Stable-10.0.5 23/38] multiboot: Fix the split lock Date: Fri, 26 Sep 2025 15:45:23 +0300 Message-ID: <20250926124540.2221746-23-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1758891616970116600 From: Xiaoyao Li While running the kvm-unit-tests on Intel platforms with "split lock disable" feature, every test triggers a kernel warning of x86/split lock detection: #AC: qemu-system-x86_64/373232 took a split_loc= k trap at address: 0x1e3 Hack KVM by exiting to QEMU on split lock #AC, we get KVM: exception 17 exit (error code 0x0) EAX=3D00000001 EBX=3D00000000 ECX=3D00000014 EDX=3D0001fb80 ESI=3D00000000 EDI=3D000000a8 EBP=3D00000000 ESP=3D00006f10 EIP=3D000001e3 EFL=3D00010002 [-------] CPL=3D0 II=3D0 A20=3D1 SMM=3D0 HLT= =3D0 ES =3D0900 00009000 0000ffff 00009300 DPL=3D0 DS16 [-WA] CS =3Dc000 000c0000 0000ffff 00009b00 DPL=3D0 CS16 [-RA] SS =3D0000 00000000 0000ffff 00009300 DPL=3D0 DS16 [-WA] DS =3Dc000 000c0000 0000ffff 00009300 DPL=3D0 DS16 [-WA] FS =3D0950 00009500 0000ffff 00009300 DPL=3D0 DS16 [-WA] GS =3D06f2 00006f20 0000ffff 00009300 DPL=3D0 DS16 [-WA] LDT=3D0000 00000000 0000ffff 00008200 DPL=3D0 LDT TR =3D0000 00000000 0000ffff 00008b00 DPL=3D0 TSS32-busy GDT=3D 000c02b4 00000027 IDT=3D 00000000 000003ff CR0=3D00000011 CR2=3D00000000 CR3=3D00000000 CR4=3D00000000 DR0=3D0000000000000000 DR1=3D0000000000000000 DR2=3D0000000000000000 DR3=3D= 0000000000000000 DR6=3D00000000ffff0ff0 DR7=3D0000000000000400 EFER=3D0000000000000000 Code=3D89 16 08 00 65 66 0f 01 16 06 00 66 b8 01 00 00 00 0f 22 c0 <65> 66 = ff 2e 00 00 b8 10 00 00 00 8e d0 8e d8 8e c0 8e e0 8e e8 66 b8 08 00 66 ba = 10 05 66 And it matches with what disassembled from multiboo_dma.bin: #objdump -b binary -m i386 -D pc-bios/multiboot_dma.bin 1d1: 08 00 or %al,(%eax) 1d3: 65 66 0f 01 16 lgdtw %gs:(%esi) 1d8: 06 push %es 1d9: 00 66 b8 add %ah,-0x48(%esi) 1dc: 01 00 add %eax,(%eax) 1de: 00 00 add %al,(%eax) 1e0: 0f 22 c0 mov %eax,%cr0 > 1e3: 65 66 ff 2e ljmpw *%gs:(%esi) 1e7: 00 00 add %al,(%eax) 1e9: b8 10 00 00 00 mov $0x10,%eax 1ee: 8e d0 mov %eax,%ss 1f0: 8e d8 mov %eax,%ds 1f2: 8e c0 mov %eax,%es 1f4: 8e e0 mov %eax,%fs 1f6: 8e e8 mov %eax,%gs 1f8: 66 b8 08 00 mov $0x8,%ax 1fc: 66 ba 10 05 mov $0x510,%dx We can see that the instruction at 0x1e3 is a far jmp through the GDT. However, the GDT is not 8 byte aligned, the base is 0xc02b4. Intel processors follow the LOCK semantics to set the accessed flag of the segment descriptor when loading a segment descriptor. If the the segment descriptor crosses two cache line, it causes split lock. Fix it by aligning the GDT on 8 bytes, so that segment descriptor cannot span two cache lines. Signed-off-by: Xiaoyao Li Reviewed-by: Philippe Mathieu-Daud=C3=A9 Link: https://lore.kernel.org/r/20250808035027.2194673-1-xiaoyao.li@intel.c= om Signed-off-by: Paolo Bonzini (cherry picked from commit 4c8f69b94839f72314c69902312068d0b9b05a34) Signed-off-by: Michael Tokarev diff --git a/pc-bios/multiboot_dma.bin b/pc-bios/multiboot_dma.bin index c0e2c3102a..e6d0c97093 100644 Binary files a/pc-bios/multiboot_dma.bin and b/pc-bios/multiboot_dma.bin di= ffer diff --git a/pc-bios/optionrom/multiboot.S b/pc-bios/optionrom/multiboot.S index 181a4b03a3..c95e35c9cb 100644 --- a/pc-bios/optionrom/multiboot.S +++ b/pc-bios/optionrom/multiboot.S @@ -208,7 +208,7 @@ ljmp2: prot_jump: .long prot_mode .short 8 =20 -.align 4, 0 +.align 8, 0 gdt: /* 0x00 */ .byte 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 --=20 2.47.3