Messages in this thread | | | Date | Fri, 3 Apr 2020 09:01:56 -0700 | From | Sean Christopherson <> | Subject | Re: [patch 1/2] x86,module: Detect VMX modules and disable Split-Lock-Detect |
| |
On Fri, Apr 03, 2020 at 05:21:58PM +0200, Peter Zijlstra wrote: > On Fri, Apr 03, 2020 at 04:35:00PM +0200, Jessica Yu wrote: > > +++ Rasmus Villemoes [03/04/20 01:42 +0200]: > > > On 02/04/2020 14.32, Thomas Gleixner wrote: > > > > From: Peter Zijlstra <peterz@infradead.org> > > > > > > > > It turns out that with Split-Lock-Detect enabled (default) any VMX > > > > hypervisor needs at least a little modification in order to not blindly > > > > inject the #AC into the guest without the guest being ready for it. > > > > > > > > Since there is no telling which module implements a hypervisor, scan the > > > > module text and look for the VMLAUNCH instruction. If found, the module is > > > > assumed to be a hypervisor of some sort and SLD is disabled. > > > > > > How long does that scan take/add to module load time? Would it make > > > sense to exempt in-tree modules? > > > > > > Rasmus > > > > I second Rasmus's question. It seems rather unfortunate that we have > > to do this text scan for every module load on x86, when it doesn't > > apply to the majority of them, and only to a handful of out-of-tree > > hypervisor modules (assuming kvm is taken care of already). > > > > I wonder if it would make sense then to limit the text scans to just > > out-of-tree modules (i.e., missing the intree modinfo flag)? > > It would; didn't know there was one.
Rather than scanning modules at all, what about hooking native_write_cr4() to kill SLD if CR4.VMXE is toggled on and the caller didn't increment a "sld safe" counter?
Partially tested patch incoming...
| |