From patchwork Tue Nov 1 23:25:34 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: tip-bot2 for Thomas Gleixner X-Patchwork-Id: 13966 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp3277937wru; Tue, 1 Nov 2022 16:43:14 -0700 (PDT) X-Google-Smtp-Source: AMsMyM6sIUenOsm9KJi+KMsLJ71aapo/6Pv/rkJG/YcQcFUDL9cqnn+CsIPKbHptqoVREfaU0mWm X-Received: by 2002:a17:902:cf03:b0:179:b7fe:dc90 with SMTP id i3-20020a170902cf0300b00179b7fedc90mr22512799plg.112.1667346194092; Tue, 01 Nov 2022 16:43:14 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1667346194; cv=none; d=google.com; s=arc-20160816; b=E/nJLHNC2ga3toXidiPZIEPwd9S8ZJp5AZB01ePkfDmW7xiT52FDbrku3Z8AzhEpnN AbAHDdSE7GRmSzToSeP6zHD0vARIT1GwbNGJFWu+GIZnsfoDakMuAemCJUD0mih3MUel Ce4u+qZBVI7kApm86ACtjjGuUrSZ5Csj/HBhpzL0PneOrNRW19TpJ9SJ0JIphDnoNEH/ HwKa5hsiUPYiEJo9h7Kr8wAq4yu3KCtRp7iHvSzIOzwHlw2g+9mJjY4Cgu/UUDL2pEUd GT2Lga7+HA4fKsw6ZYZaNNSCAkUuOnqOqJOtUL3zseekCr5bZrqJfspQV1byCDkkL1QL g0RA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:robot-unsubscribe :robot-id:message-id:mime-version:cc:subject:to:reply-to:sender:from :dkim-signature:dkim-signature:date; bh=PgZ2saWcj12B2LGvN6+ymIA0OYwa1Zze0hs3Kr39gnw=; b=mWP7NamniTVm/1bPufCl04sXXbpXIazKgwK4tk6xghHkeSqs0jCY82kZ+nhlX16bXL 2J5UJDIdWL0AAX9fsI6xbzhVMl855fH1GENqUXx7ovsEg4cIVLElMeb6+oBFjA0GPZHR bkwwwSL2FDSXZoOcBIL4a+QNPatYA0dY97skHmO4RHRPnb2UQobVUrfM1H78qw+u8JWY 1Mje2QnSELkvVDbhOpHCdrul0FwSMiCh9i1zFQj9+rhTVpOa8SY6fe7tXN4wxaE9DoyY zxaZKkgGwnDoj6hjcJ3GtF9NBY/k/RfZyvRoik/GzCn4LFpwyo33Q82KourTXpHGXZhI xYJg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linutronix.de header.s=2020 header.b=bJSDssIl; dkim=neutral (no key) header.i=@linutronix.de; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=linutronix.de Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id c22-20020a63ea16000000b0046e9da89cebsi12711748pgi.532.2022.11.01.16.43.01; Tue, 01 Nov 2022 16:43:14 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linutronix.de header.s=2020 header.b=bJSDssIl; dkim=neutral (no key) header.i=@linutronix.de; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=linutronix.de Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230371AbiKAXZn (ORCPT + 99 others); Tue, 1 Nov 2022 19:25:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52926 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229871AbiKAXZj (ORCPT ); Tue, 1 Nov 2022 19:25:39 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 97E05F41; Tue, 1 Nov 2022 16:25:38 -0700 (PDT) Date: Tue, 01 Nov 2022 23:25:34 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1667345136; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=PgZ2saWcj12B2LGvN6+ymIA0OYwa1Zze0hs3Kr39gnw=; b=bJSDssIleaBpjovgILsQGlTqNzv8T8gAtoSpjJoI0/B6/DFl7suBk4wVLhd/S4L41ug3Yh KL128xi7nw0YYImRTujRguSE4FtltHeRzrbt1JazQv5rYhvj+ZG/qpeDE9eFMUcckuBSOs A1QPdX0cPPRiNgiiiSyrDTPwhVXqdcJVmPQyM5w73ljbF5ObXnU/sAKtfWdfWdoTrIRf2f A8kSgMFh0MnffEKdh96LymIbzGyok2KltrYSrfNqeWvsYEAPfRtrFnScsleNVHpaJvY/L0 yIta/xW1jE++rgehb+RsxuAiCQstHpOy5F97mNbY7zgCuD889BsmoFaR1XMkZA== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1667345136; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=PgZ2saWcj12B2LGvN6+ymIA0OYwa1Zze0hs3Kr39gnw=; b=97arwmJPxXD9DJleqtNiELngt4bkY+BpSss/wPtT35m39LVvetNNhwQE3mjSM3hZQETEhd aBmC46HzUA9fiwBg== From: "tip-bot2 for Kirill A. Shutemov" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: x86/urgent] x86/tdx: Panic on bad configs that #VE on "private" memory access Cc: ruogui.ygr@alibaba-inc.com, "Kirill A. Shutemov" , Dave Hansen , stable@vger.kernel.org, x86@kernel.org, linux-kernel@vger.kernel.org MIME-Version: 1.0 Message-ID: <166734513448.7716.12910026848446212237.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,SPF_HELO_NONE, SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1748339202732532890?= X-GMAIL-MSGID: =?utf-8?q?1748339202732532890?= The following commit has been merged into the x86/urgent branch of tip: Commit-ID: 373e715e31bf4e0f129befe87613a278fac228d3 Gitweb: https://git.kernel.org/tip/373e715e31bf4e0f129befe87613a278fac228d3 Author: Kirill A. Shutemov AuthorDate: Fri, 28 Oct 2022 17:12:20 +03:00 Committer: Dave Hansen CommitterDate: Tue, 01 Nov 2022 16:02:40 -07:00 x86/tdx: Panic on bad configs that #VE on "private" memory access All normal kernel memory is "TDX private memory". This includes everything from kernel stacks to kernel text. Handling exceptions on arbitrary accesses to kernel memory is essentially impossible because they can happen in horribly nasty places like kernel entry/exit. But, TDX hardware can theoretically _deliver_ a virtualization exception (#VE) on any access to private memory. But, it's not as bad as it sounds. TDX can be configured to never deliver these exceptions on private memory with a "TD attribute" called ATTR_SEPT_VE_DISABLE. The guest has no way to *set* this attribute, but it can check it. Ensure ATTR_SEPT_VE_DISABLE is set in early boot. panic() if it is unset. There is no sane way for Linux to run with this attribute clear so a panic() is appropriate. There's small window during boot before the check where kernel has an early #VE handler. But the handler is only for port I/O and will also panic() as soon as it sees any other #VE, such as a one generated by a private memory access. [ dhansen: Rewrite changelog and rebase on new tdx_parse_tdinfo(). Add Kirill's tested-by because I made changes since he wrote this. ] Fixes: 9a22bf6debbf ("x86/traps: Add #VE support for TDX guest") Reported-by: ruogui.ygr@alibaba-inc.com Signed-off-by: Kirill A. Shutemov Signed-off-by: Dave Hansen Tested-by: Kirill A. Shutemov Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20221028141220.29217-3-kirill.shutemov%40linux.intel.com --- arch/x86/coco/tdx/tdx.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c index 3fee969..b8998cf 100644 --- a/arch/x86/coco/tdx/tdx.c +++ b/arch/x86/coco/tdx/tdx.c @@ -34,6 +34,8 @@ #define VE_GET_PORT_NUM(e) ((e) >> 16) #define VE_IS_IO_STRING(e) ((e) & BIT(4)) +#define ATTR_SEPT_VE_DISABLE BIT(28) + /* * Wrapper for standard use of __tdx_hypercall with no output aside from * return code. @@ -102,6 +104,7 @@ static void tdx_parse_tdinfo(u64 *cc_mask) { struct tdx_module_output out; unsigned int gpa_width; + u64 td_attr; /* * TDINFO TDX module call is used to get the TD execution environment @@ -109,19 +112,27 @@ static void tdx_parse_tdinfo(u64 *cc_mask) * information, etc. More details about the ABI can be found in TDX * Guest-Host-Communication Interface (GHCI), section 2.4.2 TDCALL * [TDG.VP.INFO]. - * - * The GPA width that comes out of this call is critical. TDX guests - * can not meaningfully run without it. */ tdx_module_call(TDX_GET_INFO, 0, 0, 0, 0, &out); - gpa_width = out.rcx & GENMASK(5, 0); - /* * The highest bit of a guest physical address is the "sharing" bit. * Set it for shared pages and clear it for private pages. + * + * The GPA width that comes out of this call is critical. TDX guests + * can not meaningfully run without it. */ + gpa_width = out.rcx & GENMASK(5, 0); *cc_mask = BIT_ULL(gpa_width - 1); + + /* + * The kernel can not handle #VE's when accessing normal kernel + * memory. Ensure that no #VE will be delivered for accesses to + * TD-private memory. Only VMM-shared memory (MMIO) will #VE. + */ + td_attr = out.rdx; + if (!(td_attr & ATTR_SEPT_VE_DISABLE)) + panic("TD misconfiguration: SEPT_VE_DISABLE attibute must be set.\n"); } /*