From patchwork Wed Sep 27 08:50:27 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: tip-bot2 for Thomas Gleixner X-Patchwork-Id: 145377 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:cae8:0:b0:403:3b70:6f57 with SMTP id r8csp2629585vqu; Wed, 27 Sep 2023 06:28:20 -0700 (PDT) X-Google-Smtp-Source: AGHT+IEeyaxzEIjbvbr73bOXmE8UtcK/v02+hhAWa3d01X4zXv4O0v62D2OeCuY/wLx58dq0BnXQ X-Received: by 2002:a05:6a21:19f:b0:14b:8b82:867f with SMTP id le31-20020a056a21019f00b0014b8b82867fmr1986720pzb.50.1695821300526; Wed, 27 Sep 2023 06:28:20 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1695821300; cv=none; d=google.com; s=arc-20160816; b=d9dc5HwK81uvXHn//nB07qEJfzLmGMepi/wP6ow0Irjhs3zXHaNhhZp24w+AdPXqPe 4JwABhTw1TCAnLi4ioX4ZRx/Z1LKoXd18Ca2IDAw3OMVGswdBWeDPlW8XnNbO5/p7xZR ncI3Pwfk5gTWDpuvjUxppUqPxBAfe8ktA/P4vjN5aSzmky1IkgjwaNVGdnlGikt57h+m GVVA7ZxY/AEGeKn84yJYHjCVwf85cwlHYVhjw71SUn5DkOqBlC6VkiTyG4F8P+PsZxdk DCLPBoibgjtyM1GEYh0YY+I1H/rFyUOPPKM/DgwNNoFHYoaCaIW5Y2PY3ZPf7I4PzJTx QvFg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:robot-unsubscribe :robot-id:message-id:mime-version:references:in-reply-to:cc:subject :to:reply-to:sender:from:dkim-signature:dkim-signature:date; bh=e1tHVIYqE+sMaIp+HZXJZahZO0rDZZ9msFdB3oXvodU=; fh=pNOBOFSWWd5UshWaFYuXziKxI7kF4UNYYuOYgQnmb48=; b=ZUBieEaUF56EOIGtXgaOnoRtSiOb6KPOR43dHKTGwF6EGEEqM3OxX3IaCE4lbqY8L8 wV4yaJJ1TBT4GNJM9tTunYktQqxLk89u1i2ogpFDKXs1p4d7846FmBMKAz6WK70kvfIL auJ0iaH1Fa97Jio30Tv4+37LatI2c9VKNKxqXSmeWrZXPAJk1huycZd0Rcg+JUR9lSDE 4p4D6Uw9ZgrjmeuNzwtXlW3+uB7QCO9JUf4AHnrC6qWDiop+cfHpB8hjDPE6tlMBHep1 xIBS6KAUuFmn7Q4QEO+lB57q+9r18gLU5oXumPdgAzd6GbSjSSPrY/Sjr8mKc8Xw1fO/ 1Vcg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linutronix.de header.s=2020 header.b=PTnWb0JX; dkim=neutral (no key) header.i=@linutronix.de header.s=2020e; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.33 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=linutronix.de Received: from lipwig.vger.email (lipwig.vger.email. [23.128.96.33]) by mx.google.com with ESMTPS id kp11-20020a170903280b00b001bf095dfb7asi14796002plb.231.2023.09.27.06.28.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 27 Sep 2023 06:28:20 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.33 as permitted sender) client-ip=23.128.96.33; Authentication-Results: mx.google.com; dkim=pass header.i=@linutronix.de header.s=2020 header.b=PTnWb0JX; dkim=neutral (no key) header.i=@linutronix.de header.s=2020e; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.33 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=linutronix.de Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by lipwig.vger.email (Postfix) with ESMTP id 7B6FC80CC220; Wed, 27 Sep 2023 01:51:04 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at lipwig.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230149AbjI0Iue (ORCPT + 23 others); Wed, 27 Sep 2023 04:50:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49692 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230000AbjI0Iuc (ORCPT ); Wed, 27 Sep 2023 04:50:32 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 696DA95; Wed, 27 Sep 2023 01:50:30 -0700 (PDT) Date: Wed, 27 Sep 2023 08:50:27 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1695804628; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=e1tHVIYqE+sMaIp+HZXJZahZO0rDZZ9msFdB3oXvodU=; b=PTnWb0JXmCt3bGUd/C5hCnGTrPitCe8BS44PR/op1m0y/gbhb5DpmCzn1JG0wBOzGii5ur uZOI9+xotnj3IcTtxcOIMeodA1lmMf9VzukeentvPdD/YN/M+/aAQwm3c4aX6x9DZtY2Pu SEYiSfbAXcb9+Fmhe50p4V5eyTto7GYqofk0FoFhMDI5rDAN/OvLY24FA06zmPmuED7ZqL P3DsElOYsWk9mNZjXnEV6V7r4qMP/fjGbFPIgDbkArfn7a/1IZhS8QOUMwztzY5OAvHQb0 MQcGnsKFB0TsS7a14FVUbTyTf+XW9ovYOs16Lte7yzsGJDa0kKpDF7340F0+Jg== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1695804628; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=e1tHVIYqE+sMaIp+HZXJZahZO0rDZZ9msFdB3oXvodU=; b=NbSdLbhlLhiFWAwf5xNHCcP6bY/y9EjwlFlynk+Cd23JCF7aMQl6hBzCiL7ybet5pjgzr6 lxy7Y5plkylZC2BA== From: "tip-bot2 for Alexey Kardashevskiy" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: x86/mm] x86/sev: Reduce #VC nesting for intercepted CPUID for SEV-SNP guest, to fix nesting crash Cc: Alexey Kardashevskiy , Ingo Molnar , Tom Lendacky , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <20230926040526.957240-1-aik@amd.com> References: <20230926040526.957240-1-aik@amd.com> MIME-Version: 1.0 Message-ID: <169580462768.27769.7125064834981635334.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lipwig.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (lipwig.vger.email [0.0.0.0]); Wed, 27 Sep 2023 01:51:04 -0700 (PDT) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1778197516099331566 X-GMAIL-MSGID: 1778197516099331566 The following commit has been merged into the x86/mm branch of tip: Commit-ID: 00541d61e7c68071fa589bdb045e7f5024f67713 Gitweb: https://git.kernel.org/tip/00541d61e7c68071fa589bdb045e7f5024f67713 Author: Alexey Kardashevskiy AuthorDate: Tue, 26 Sep 2023 14:05:26 +10:00 Committer: Ingo Molnar CommitterDate: Wed, 27 Sep 2023 10:46:22 +02:00 x86/sev: Reduce #VC nesting for intercepted CPUID for SEV-SNP guest, to fix nesting crash For certain intercepts an SNP guest uses the GHCB protocol to talk to the hypervisor from the #VC handler. The protocol requires a shared page so there is one per vCPU. In case NMI arrives in a middle of #VC or the NMI handler triggers a #VC, there is another "backup" GHCB page which stores the content of the first one while SVM_VMGEXIT_NMI_COMPLETE is sent. The vc_raw_handle_exception() handler manages main and backup GHCB pages via __sev_get_ghcb/__sev_put_ghcb. This works fine for #VC and occasional NMIs. This does not work so fine if the #VC handler causes intercept + another #VC, if NMI arrives during the second #VC, there are no more pages for SVM_VMGEXIT_NMI_COMPLETE. The problem place is the #VC CPUID handler. Running perf in the SNP guest crashes with: Kernel panic - not syncing: Unable to handle #VC exception! GHCB and Backup GHCB are already in use vc_raw_handle_exception #1: exit_code 72 (CPUID) eax d ecx 1 We lock the main GHCB and while it is locked we get to snp_cpuid_postprocess() which executes "rdmsr" of MSR_IA32_XSS==0xda0 which triggers: vc_raw_handle_exception #2: exit_code 7c (MSR) ecx da0 Here we lock the backup ghcb. And then PMC NMI comes which cannot complete as there is no GHCB page left to use: CPU: 5 PID: 566 Comm: touch Not tainted 6.5.0-rc2-aik-ad9c-g7413e71d3dcf-dirty #27 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown unknown Call Trace: dump_stack_lvl+0x44/0x60 panic+0x222/0x310 ____sev_get_ghcb+0x21e/0x220 __sev_es_nmi_complete+0x28/0xf0 exc_nmi+0x1ac/0x1c0 end_repeat_nmi+0x16/0x67 ... vc_raw_handle_exception+0x9e/0x2c0 kernel_exc_vmm_communication+0x4d/0xa0 asm_exc_vmm_communication+0x31/0x60 RIP: 0010:snp_cpuid+0x2ad/0x420 Add a helper similar to rdmsr_safe() for making a direct hypercall in the SEV-ES environment. Use the new helper instead of the raw "rdmsr" to avoid the extra #VC event. Fixes: ee0bfa08a345 ("x86/compressed/64: Add support for SEV-SNP CPUID table in #VC handlers") Signed-off-by: Alexey Kardashevskiy Signed-off-by: Ingo Molnar Acked-by: Tom Lendacky Link: https://lore.kernel.org/r/20230926040526.957240-1-aik@amd.com --- arch/x86/include/asm/svm.h | 14 ++++++++++++++ arch/x86/kernel/sev-shared.c | 5 +++-- 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/arch/x86/include/asm/svm.h b/arch/x86/include/asm/svm.h index 19bf955..4416a8b 100644 --- a/arch/x86/include/asm/svm.h +++ b/arch/x86/include/asm/svm.h @@ -679,4 +679,18 @@ DEFINE_GHCB_ACCESSORS(sw_exit_info_2) DEFINE_GHCB_ACCESSORS(sw_scratch) DEFINE_GHCB_ACCESSORS(xcr0) +/* Paravirt SEV-ES rdmsr which avoids extra #VC event */ +#define rdmsr_safe_GHCB(msr, low, high, ghcb, ctxt) ({ \ + int __ret; \ + \ + ghcb_set_rcx((ghcb), (msr)); \ + __ret = sev_es_ghcb_hv_call((ghcb), (ctxt), SVM_EXIT_MSR, 0, 0); \ + if (__ret == ES_OK) { \ + low = (ghcb)->save.rax; \ + high = (ghcb)->save.rdx; \ + /* Invalidate qwords for likely another following GHCB call */ \ + vc_ghcb_invalidate(ghcb); \ + } \ + __ret; }) + #endif diff --git a/arch/x86/kernel/sev-shared.c b/arch/x86/kernel/sev-shared.c index 2eabccd..31f79da 100644 --- a/arch/x86/kernel/sev-shared.c +++ b/arch/x86/kernel/sev-shared.c @@ -439,8 +439,9 @@ static int snp_cpuid_postprocess(struct cpuid_leaf *leaf) if (leaf->eax & BIT(3)) { unsigned long lo, hi; - asm volatile("rdmsr" : "=a" (lo), "=d" (hi) - : "c" (MSR_IA32_XSS)); + if (rdmsr_safe_GHCB(MSR_IA32_XSS, lo, hi, ghcb, ctxt) != ES_OK) + return -EINVAL; + xss = (hi << 32) | lo; }