From patchwork Thu Jan 26 22:11:58 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Kirill A. Shutemov" X-Patchwork-Id: 48931 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:eb09:0:0:0:0:0 with SMTP id s9csp520889wrn; Thu, 26 Jan 2023 14:33:48 -0800 (PST) X-Google-Smtp-Source: AK7set8tpo8GAoKww4GILBBeHmgZWIKMprTB9ZuuPgl3TkO+VbYizGpRGXWffuPq1acowyh5OtHj X-Received: by 2002:a17:902:ec88:b0:196:1d60:b1b8 with SMTP id x8-20020a170902ec8800b001961d60b1b8mr11579519plg.34.1674772428672; Thu, 26 Jan 2023 14:33:48 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1674772428; cv=none; d=google.com; s=arc-20160816; b=EL643CuEgTrunjF6o/LrN9Vuqv5xr+wdmwTAl8540fwNa1VkbxlBm6waH5k82Q8PU9 OViyEIVJmqXtugZF4jBWf5IIfCBHAWJXAifYkvX86Zj6LqK70iWky1EvWMR/NK73mNtS OyozzyMeL9xEeVYvhVNUUS+bDUBX3RTISs1f8fD9ku/q/GZ9YmW1hPLgXLkpH0UjcE/2 5DhgoEq/WGRjRjjwvqbDEXJiXlaztQFdFGVcJHJ2Yd3T6mhKFbmYfFhdzVyDdAzPHxxl xsz5ZsWoZ3YhyiDlyqCeMd1Z64inZovsAsZdAWQCostITQ2rrw50t00SjUJyUCmxG7Zo bYYQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=2/2RT6w24OSEpb9Zg2Wgs6ykrrHIReJ95I556F9dTwg=; b=t0QAAtjL0LAggjqVexD582AmIXT1/j98RXFECUUuHPIpHzOujqg419OfPHZj//mysv w8/YrAluj8+Ypt/AcORGkzF/yFjZdjSWhABhb3lvhl1AXx0RSAPKaUCOWKyqiEhAHzbA yCy/Na25bz1vLdUMx2RvmOYUJlq7QZuadxni6avOPEnSjpLQ0XYnfcRQTdLNW0XaJcls cnH5ktLiSIWr3HhiR+NdnyQ979jTjWx/DNN5TpJyTvWyNjVvBrZfcTDD0vwxFsDkcTk7 kFnf9u8eKnxysocl/rLr7k9if4rnFueW7n8Om41Mfj1T5Ql/Ber3VKXvNa7TdBscyCg6 HCAw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=QsVeZz4r; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id s3-20020a170902b18300b001944785f248si2601743plr.84.2023.01.26.14.33.36; Thu, 26 Jan 2023 14:33:48 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=QsVeZz4r; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233034AbjAZWag (ORCPT + 99 others); Thu, 26 Jan 2023 17:30:36 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59162 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232615AbjAZWa0 (ORCPT ); Thu, 26 Jan 2023 17:30:26 -0500 Received: from mga06.intel.com (mga06b.intel.com [134.134.136.31]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3E0A337563 for ; Thu, 26 Jan 2023 14:30:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1674772225; x=1706308225; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=2AzGLZYLQWFgYy7oKSA95MapwehtT7MvaycJ/ZjTtEU=; b=QsVeZz4rv1JoO157TBpM0ZYQKv4k7Jo4i6JuMlyW/7ScW+3uB2iWlf8I wVBVlyAz+7p4PPy7FTdBhiNAeXO4OPtIty4DeER9N6ZVBSR/6xvFAjNlr eQaKszdfKxPwalw1/UTj5oTs0eYB2Gpa+nr15H6vnT2RAqJ3Vtt/C3npm SwVCa0h0+wISkeJ3V6o91eXFFQpPvCXQ8vvAz5RSKJeHUO6umR+qsmh6o yGwwaqWrZlNtrdd2oMnJoUN37xwxPLzbuRJmDFCqg50tKoU3WAbPxsP7b CsDGS+Ho6Cw+E2qlyJ0pY/FdMa7wA0ZVbgHUQK7ag1tswwgPDNgXWOts8 w==; X-IronPort-AV: E=McAfee;i="6500,9779,10602"; a="389342102" X-IronPort-AV: E=Sophos;i="5.97,249,1669104000"; d="scan'208";a="389342102" Received: from fmsmga003.fm.intel.com ([10.253.24.29]) by orsmga104.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 26 Jan 2023 14:12:13 -0800 X-IronPort-AV: E=McAfee;i="6500,9779,10602"; a="751770955" X-IronPort-AV: E=Sophos;i="5.97,249,1669104000"; d="scan'208";a="751770955" Received: from smadjatx-mobl1.ger.corp.intel.com (HELO box.shutemov.name) ([10.251.210.179]) by fmsmga003-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 26 Jan 2023 14:12:11 -0800 Received: by box.shutemov.name (Postfix, from userid 1000) id 7A10710DCB5; Fri, 27 Jan 2023 01:12:03 +0300 (+03) From: "Kirill A. Shutemov" To: Dave Hansen , Borislav Petkov , Andy Lutomirski Cc: Kuppuswamy Sathyanarayanan , Thomas Gleixner , Elena Reshetova , x86@kernel.org, linux-coco@lists.linux.dev, linux-kernel@vger.kernel.org, "Kirill A. Shutemov" Subject: [PATCHv2, RESEND 6/7] x86/tdx: Relax SEPT_VE_DISABLE check for debug TD Date: Fri, 27 Jan 2023 01:11:58 +0300 Message-Id: <20230126221159.8635-7-kirill.shutemov@linux.intel.com> X-Mailer: git-send-email 2.39.1 In-Reply-To: <20230126221159.8635-1-kirill.shutemov@linux.intel.com> References: <20230126221159.8635-1-kirill.shutemov@linux.intel.com> MIME-Version: 1.0 X-Spam-Status: No, score=-4.3 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,SPF_HELO_NONE, SPF_NONE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1756126173809562435?= X-GMAIL-MSGID: =?utf-8?q?1756126173809562435?= A "SEPT #VE" occurs when a TDX guest touches memory that is not properly mapped into the "secure EPT". This can be the result of hypervisor attacks or bugs, *OR* guest bugs. Most notably, buggy guests might touch unaccepted memory for lots of different memory safety bugs like buffer overflows. TDX guests do not want to continue in the face of hypervisor attacks or hypervisor bugs. They want to terminate as fast and safely as possible. SEPT_VE_DISABLE ensures that TDX guests *can't* continue in the face of these kinds of issues. But, that causes a problem. TDX guests that can't continue can't spit out oopses or other debugging info. In essence SEPT_VE_DISABLE=1 guests are not debuggable. Relax the SEPT_VE_DISABLE check to warning on debug TD and panic() in the #VE handler on EPT-violation on private memory. It will produce useful backtrace. Signed-off-by: Kirill A. Shutemov --- arch/x86/coco/tdx/tdx.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c index 56accf653709..2f4fbb7cd990 100644 --- a/arch/x86/coco/tdx/tdx.c +++ b/arch/x86/coco/tdx/tdx.c @@ -38,6 +38,7 @@ #define VE_GET_PORT_NUM(e) ((e) >> 16) #define VE_IS_IO_STRING(e) ((e) & BIT(4)) +#define ATTR_DEBUG BIT(0) #define ATTR_SEPT_VE_DISABLE BIT(28) /* TDX Module call error codes */ @@ -207,8 +208,15 @@ static void tdx_parse_tdinfo(u64 *cc_mask) * TD-private memory. Only VMM-shared memory (MMIO) will #VE. */ td_attr = out.rdx; - if (!(td_attr & ATTR_SEPT_VE_DISABLE)) - tdx_panic("TD misconfiguration: SEPT_VE_DISABLE attribute must be set."); + if (!(td_attr & ATTR_SEPT_VE_DISABLE)) { + const char *msg = "TD misconfiguration: SEPT_VE_DISABLE attribute must be set."; + + /* Relax SEPT_VE_DISABLE check for debug TD. */ + if (td_attr & ATTR_DEBUG) + pr_warn("%s\n", msg); + else + tdx_panic(msg); + } } /* @@ -664,6 +672,11 @@ static int virt_exception_user(struct pt_regs *regs, struct ve_info *ve) } } +static inline bool is_private_gpa(u64 gpa) +{ + return gpa == cc_mkenc(gpa); +} + /* * Handle the kernel #VE. * @@ -682,6 +695,8 @@ static int virt_exception_kernel(struct pt_regs *regs, struct ve_info *ve) case EXIT_REASON_CPUID: return handle_cpuid(regs, ve); case EXIT_REASON_EPT_VIOLATION: + if (is_private_gpa(ve->gpa)) + panic("Unexpected EPT-violation on private memory."); return handle_mmio(regs, ve); case EXIT_REASON_IO_INSTRUCTION: return handle_io(regs, ve);