From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752613AbbIQVLh (ORCPT ); Thu, 17 Sep 2015 17:11:37 -0400 Received: from mail.kernel.org ([198.145.29.136]:58489 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752257AbbIQVLI (ORCPT ); Thu, 17 Sep 2015 17:11:08 -0400 From: Andy Lutomirski To: x86@kernel.org Cc: Paolo Bonzini , Peter Zijlstra , KVM list , Arjan van de Ven , xen-devel , linux-kernel@vger.kernel.org, Linus Torvalds , Andrew Morton , Ingo Molnar , Thomas Gleixner , Andy Lutomirski Subject: [PATCH 1/2] x86/msr: Carry on after a non-"safe" MSR access fails without !panic_on_oops Date: Thu, 17 Sep 2015 14:11:01 -0700 Message-Id: <203bb8a52efae1781281fb70ccd45c3e164fbce2.1442523997.git.luto@kernel.org> X-Mailer: git-send-email 2.4.3 In-Reply-To: References: In-Reply-To: References: Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This demotes an OOPS and likely panic due to a failed non-"safe" MSR access to a WARN_ON_ONCE and a return of poisoned values (in the RDMSR case). We still write a pr_info entry unconditionally for debugging. To be clear, this type of failure should *not* happen. This patch exists to minimize the chance of nasty undebuggable failures due on systems that used to work due to a now-fixed CONFIG_PARAVIRT=y bug. Signed-off-by: Andy Lutomirski --- arch/x86/kernel/traps.c | 51 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c index 346eec73f7db..b7731765017a 100644 --- a/arch/x86/kernel/traps.c +++ b/arch/x86/kernel/traps.c @@ -437,6 +437,54 @@ exit_trap: do_trap(X86_TRAP_BR, SIGSEGV, "bounds", regs, error_code, NULL); } +static bool paper_over_kernel_gpf(struct pt_regs *regs) +{ + /* + * Try to decode the opcode that failed. So far, we only care + * about boring two-byte unprefixed opcodes, so we don't need + * the full instruction decoder machinery. + */ + u16 opcode; + + if (probe_kernel_read(&opcode, (const void *)regs->ip, sizeof(opcode))) + return false; + + if (opcode == 0x320f) { + /* RDMSR */ + pr_info("bad kernel RDMSR from non-existent MSR 0x%x", + (unsigned int)regs->cx); + if (!panic_on_oops) { + WARN_ON_ONCE(true); + + /* Patch it up with deterministic poison. */ + regs->ax = 0x5aadc0de; + regs->dx = 0x8badf00d; + regs->ip += 2; + return true; + } else { + /* Don't fix it up. */ + return false; + } + } else if (opcode == 0x300f) { + /* WRMSR */ + pr_info("bad kernel WRMSR writing 0x%08x%08x to MSR 0x%x", + (unsigned int)regs->dx, (unsigned int)regs->ax, + (unsigned int)regs->cx); + if (!panic_on_oops) { + WARN_ON_ONCE(true); + + /* Pretend it worked and carry on. */ + regs->ip += 2; + return true; + } else { + /* Don't fix it up. */ + return false; + } + } + + return false; +} + dotraplinkage void do_general_protection(struct pt_regs *regs, long error_code) { @@ -456,6 +504,9 @@ do_general_protection(struct pt_regs *regs, long error_code) if (fixup_exception(regs)) return; + if (paper_over_kernel_gpf(regs)) + return; + tsk->thread.error_code = error_code; tsk->thread.trap_nr = X86_TRAP_GP; if (notify_die(DIE_GPF, "general protection fault", regs, error_code, -- 2.4.3