From patchwork Wed Nov 30 23:36:47 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sean Christopherson X-Patchwork-Id: 28083 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp1215199wrr; Wed, 30 Nov 2022 15:59:41 -0800 (PST) X-Google-Smtp-Source: AA0mqf4zNDVwqV8KXb5ZHcGVNrz8gykPuKyim+5dDZG7pAfeAEwjZ35Sj5rfsqbiOGr66ne7v/gk X-Received: by 2002:a17:906:65c4:b0:7ad:d250:b907 with SMTP id z4-20020a17090665c400b007add250b907mr53331656ejn.737.1669852781393; Wed, 30 Nov 2022 15:59:41 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1669852781; cv=none; d=google.com; s=arc-20160816; b=v1cCHH6G+HEYdjxbzbFEt7O4ErSpTKCe0kKAmIMBEDQMz01pjTUYLy7wY7gHEYKhpa xNEV87EmDHYtq9kddk4kGq/tXnorK01I8hdDKvtBNkXQAGKspkZKkuWU5uyJPwVnSJMW hD8hrFyCwbYsX9tfRDh3WEVooif4NApmf4XbwSoKCZf+41UYJ6Qdiy/3zKpHouOVsyET y7f1gwC8+nLTvKFdfDz7G0YUGkV4iDe+8uYm6YvzelVMRhNP1bvoUFKkhThL54G3ZXhU Rdo3v38Nuy6KGpZvJuMY5YLXwoUQsR1KQpD3uTWiaM4ECB2K0JEXDRec+JEAV7VHBsna VnvQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:reply-to:dkim-signature; bh=I8FwrRgfmd2UuwKL7ywz+/7+wS6AMaBUpFIfke29fZA=; b=gLZBCdnDkQKq9cqF+h+c4X5q3UTtuELa5umRy9S2uk7DrRZCyM9Pxo2FcL06i+Af8E yyCXA+JuXy1WaCoAQ0n5XnrK0sWTiEnAEVNV36hZMsE9C8s4ZWo0KIN9aMSunCKZPaqf H6S8nzcT/eNAl3oXU2VnmNdUY43EX5TAuEyoDW9JT46K9BR5P0QYxdXXueo9HTAMyyVg NmPjbl5TMcC+aVfWK+dRQVVJfavR/vm75UKahDrFjbG7UmMF7h/NM9PTPikewBb4qoy8 WjOJcRvO+y9FwftfbzO9E4MGzL9tLaj7+lKNWUYNzzduvtVyLt5NcfGeBBrPS3GYK0sR DwLw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20210112 header.b=PNHfGcWV; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id cw28-20020a056402229c00b0046b5aff3c95si2188564edb.311.2022.11.30.15.59.16; Wed, 30 Nov 2022 15:59:41 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20210112 header.b=PNHfGcWV; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229801AbiK3Xg7 (ORCPT + 99 others); Wed, 30 Nov 2022 18:36:59 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55050 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229566AbiK3Xgz (ORCPT ); Wed, 30 Nov 2022 18:36:55 -0500 Received: from mail-pj1-x104a.google.com (mail-pj1-x104a.google.com [IPv6:2607:f8b0:4864:20::104a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A32071128 for ; Wed, 30 Nov 2022 15:36:54 -0800 (PST) Received: by mail-pj1-x104a.google.com with SMTP id l2-20020a17090add8200b00218daa1a812so222177pjv.3 for ; Wed, 30 Nov 2022 15:36:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=I8FwrRgfmd2UuwKL7ywz+/7+wS6AMaBUpFIfke29fZA=; b=PNHfGcWVuJ5EEApzCw9+x7W5a3m55Zv7MFPYgUAebhkNCmmO6tTohmCwEgw8WX9ps6 zoZT3no8rG4d0/DJFD/5rLzRcgGPMwLRSZqORTwbOBep4v/52sxg1tyUZM29i8iKITFG fa+73uOueAh2lPT0ISJfsQvpBmyjceWy18CJovXZisAFMLvvPd/clsPg1QO+1I5SNL+D FtLAz136RsueNj4MfQJ98AYiSJ0WtopplRvlsqet/EvgVruROuKUWQGF4HEn4K65BF9o 2XKVqUbHmf84ebktMA/jtRpsQY7yhjg24PERH1/ksa49K5IQ2z+ag3Pq5aiew26OWBke PDJA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=I8FwrRgfmd2UuwKL7ywz+/7+wS6AMaBUpFIfke29fZA=; b=ofKJaXYS4FvZintDhVUrGNFW3lLmKUopNtUuxtgWI9agJyPxf91+AKv4xGiBuPhgtm FjU0Dui+fGZ0Tnyr8uiUp/JCBULkT/1nKSVdLwD+fy9SzmYUBCz02K+EN0IOfyfJtmBx 2zslPD/yYuG/a3cxr7tZRZ2LFPoeTeTZdmAhVCyrRbB7JISBX0zX8plVAQXuUUh0Z/F2 bL2wU9wJUslo47o1S1CPGW2kPqTBOa3++MuVekDAmj74+gdHki+y+S8Ca7oADBK+/1r5 3d72DaEC+sTpaEtpRio6KiKoHyJ+/x6zFobriXNLUYZvjdv1mph0ITMIaK6Hj7N2Feyy +/tw== X-Gm-Message-State: ANoB5pk/05zZPo5D/WeSvqbOYy7ueWfVv5jutzWuWAfLGoDEjNy+YK+f +zdgB2JVX/GBlLYamoXNiMTbOjeQrrM= X-Received: from zagreus.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:5c37]) (user=seanjc job=sendgmr) by 2002:a17:902:e550:b0:184:dc59:cc9f with SMTP id n16-20020a170902e55000b00184dc59cc9fmr47087289plf.89.1669851414240; Wed, 30 Nov 2022 15:36:54 -0800 (PST) Reply-To: Sean Christopherson Date: Wed, 30 Nov 2022 23:36:47 +0000 In-Reply-To: <20221130233650.1404148-1-seanjc@google.com> Mime-Version: 1.0 References: <20221130233650.1404148-1-seanjc@google.com> X-Mailer: git-send-email 2.38.1.584.g0f3c55d4c2-goog Message-ID: <20221130233650.1404148-2-seanjc@google.com> Subject: [PATCH v4 1/4] x86/crash: Disable virt in core NMI crash handler to avoid double shootdown From: Sean Christopherson To: Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org Cc: "H. Peter Anvin" , linux-kernel@vger.kernel.org, "Guilherme G . Piccoli" , Vitaly Kuznetsov , Paolo Bonzini , Sean Christopherson , Andrew Cooper , Tom Lendacky , stable@vger.kernel X-Spam-Status: No, score=-9.6 required=5.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1750967550134386439?= X-GMAIL-MSGID: =?utf-8?q?1750967550134386439?= Disable virtualization in crash_nmi_callback() and rework the emergency_vmx_disable_all() path to do an NMI shootdown if and only if a shootdown has not already occurred. NMI crash shootdown fundamentally can't support multiple invocations as responding CPUs are deliberately put into halt state without unblocking NMIs. But, the emergency reboot path doesn't have any work of its own, it simply cares about disabling virtualization, i.e. so long as a shootdown occurred, emergency reboot doesn't care who initiated the shootdown, or when. If "crash_kexec_post_notifiers" is specified on the kernel command line, panic() will invoke crash_smp_send_stop() and result in a second call to nmi_shootdown_cpus() during native_machine_emergency_restart(). Invoke the callback _before_ disabling virtualization, as the current VMCS needs to be cleared before doing VMXOFF. Note, this results in a subtle change in ordering between disabling virtualization and stopping Intel PT on the responding CPUs. While VMX and Intel PT do interact, VMXOFF and writes to MSR_IA32_RTIT_CTL do not induce faults between one another, which is all that matters when panicking. Harden nmi_shootdown_cpus() against multiple invocations to try and capture any such kernel bugs via a WARN instead of hanging the system during a crash/dump, e.g. prior to the recent hardening of register_nmi_handler(), re-registering the NMI handler would trigger a double list_add() and hang the system if CONFIG_BUG_ON_DATA_CORRUPTION=y. list_add double add: new=ffffffff82220800, prev=ffffffff8221cfe8, next=ffffffff82220800. WARNING: CPU: 2 PID: 1319 at lib/list_debug.c:29 __list_add_valid+0x67/0x70 Call Trace: __register_nmi_handler+0xcf/0x130 nmi_shootdown_cpus+0x39/0x90 native_machine_emergency_restart+0x1c9/0x1d0 panic+0x237/0x29b Extract the disabling logic to a common helper to deduplicate code, and to prepare for doing the shootdown in the emergency reboot path if SVM is supported. Note, prior to commit ed72736183c4 ("x86/reboot: Force all cpus to exit VMX root if VMX is supported"), nmi_shootdown_cpus() was subtly protected against a second invocation by a cpu_vmx_enabled() check as the kdump handler would disable VMX if it ran first. Fixes: ed72736183c4 ("x86/reboot: Force all cpus to exit VMX root if VMX is supported) Cc: stable@vger.kernel.org Reported-by: Guilherme G. Piccoli Cc: Vitaly Kuznetsov Cc: Paolo Bonzini Link: https://lore.kernel.org/all/20220427224924.592546-2-gpiccoli@igalia.com Signed-off-by: Sean Christopherson Tested-by: Guilherme G. Piccoli --- arch/x86/include/asm/reboot.h | 2 ++ arch/x86/kernel/crash.c | 17 +-------- arch/x86/kernel/reboot.c | 65 ++++++++++++++++++++++++++++------- 3 files changed, 56 insertions(+), 28 deletions(-) diff --git a/arch/x86/include/asm/reboot.h b/arch/x86/include/asm/reboot.h index 04c17be9b5fd..bc5b4d788c08 100644 --- a/arch/x86/include/asm/reboot.h +++ b/arch/x86/include/asm/reboot.h @@ -25,6 +25,8 @@ void __noreturn machine_real_restart(unsigned int type); #define MRR_BIOS 0 #define MRR_APM 1 +void cpu_emergency_disable_virtualization(void); + typedef void (*nmi_shootdown_cb)(int, struct pt_regs*); void nmi_panic_self_stop(struct pt_regs *regs); void nmi_shootdown_cpus(nmi_shootdown_cb callback); diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c index 9730c88530fc..6b8a6aae02e3 100644 --- a/arch/x86/kernel/crash.c +++ b/arch/x86/kernel/crash.c @@ -37,7 +37,6 @@ #include #include #include -#include #include #include #include @@ -81,15 +80,6 @@ static void kdump_nmi_callback(int cpu, struct pt_regs *regs) */ cpu_crash_vmclear_loaded_vmcss(); - /* Disable VMX or SVM if needed. - * - * We need to disable virtualization on all CPUs. - * Having VMX or SVM enabled on any CPU may break rebooting - * after the kdump kernel has finished its task. - */ - cpu_emergency_vmxoff(); - cpu_emergency_svm_disable(); - /* * Disable Intel PT to stop its logging */ @@ -148,12 +138,7 @@ void native_machine_crash_shutdown(struct pt_regs *regs) */ cpu_crash_vmclear_loaded_vmcss(); - /* Booting kdump kernel with VMX or SVM enabled won't work, - * because (among other limitations) we can't disable paging - * with the virt flags. - */ - cpu_emergency_vmxoff(); - cpu_emergency_svm_disable(); + cpu_emergency_disable_virtualization(); /* * Disable Intel PT to stop its logging diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c index c3636ea4aa71..374c14b3a9bf 100644 --- a/arch/x86/kernel/reboot.c +++ b/arch/x86/kernel/reboot.c @@ -528,10 +528,7 @@ static inline void kb_wait(void) } } -static void vmxoff_nmi(int cpu, struct pt_regs *regs) -{ - cpu_emergency_vmxoff(); -} +static inline void nmi_shootdown_cpus_on_restart(void); /* Use NMIs as IPIs to tell all CPUs to disable virtualization */ static void emergency_vmx_disable_all(void) @@ -554,7 +551,7 @@ static void emergency_vmx_disable_all(void) __cpu_emergency_vmxoff(); /* Halt and exit VMX root operation on the other CPUs. */ - nmi_shootdown_cpus(vmxoff_nmi); + nmi_shootdown_cpus_on_restart(); } } @@ -795,6 +792,17 @@ void machine_crash_shutdown(struct pt_regs *regs) /* This is the CPU performing the emergency shutdown work. */ int crashing_cpu = -1; +/* + * Disable virtualization, i.e. VMX or SVM, to ensure INIT is recognized during + * reboot. VMX blocks INIT if the CPU is post-VMXON, and SVM blocks INIT if + * GIF=0, i.e. if the crash occurred between CLGI and STGI. + */ +void cpu_emergency_disable_virtualization(void) +{ + cpu_emergency_vmxoff(); + cpu_emergency_svm_disable(); +} + #if defined(CONFIG_SMP) static nmi_shootdown_cb shootdown_callback; @@ -817,7 +825,14 @@ static int crash_nmi_callback(unsigned int val, struct pt_regs *regs) return NMI_HANDLED; local_irq_disable(); - shootdown_callback(cpu, regs); + if (shootdown_callback) + shootdown_callback(cpu, regs); + + /* + * Prepare the CPU for reboot _after_ invoking the callback so that the + * callback can safely use virtualization instructions, e.g. VMCLEAR. + */ + cpu_emergency_disable_virtualization(); atomic_dec(&waiting_for_crash_ipi); /* Assume hlt works */ @@ -828,18 +843,32 @@ static int crash_nmi_callback(unsigned int val, struct pt_regs *regs) return NMI_HANDLED; } -/* - * Halt all other CPUs, calling the specified function on each of them +/** + * nmi_shootdown_cpus - Stop other CPUs via NMI + * @callback: Optional callback to be invoked from the NMI handler * - * This function can be used to halt all other CPUs on crash - * or emergency reboot time. The function passed as parameter - * will be called inside a NMI handler on all CPUs. + * The NMI handler on the remote CPUs invokes @callback, if not + * NULL, first and then disables virtualization to ensure that + * INIT is recognized during reboot. + * + * nmi_shootdown_cpus() can only be invoked once. After the first + * invocation all other CPUs are stuck in crash_nmi_callback() and + * cannot respond to a second NMI. */ void nmi_shootdown_cpus(nmi_shootdown_cb callback) { unsigned long msecs; + local_irq_disable(); + /* + * Avoid certain doom if a shootdown already occurred; re-registering + * the NMI handler will cause list corruption, modifying the callback + * will do who knows what, etc... + */ + if (WARN_ON_ONCE(crash_ipi_issued)) + return; + /* Make a note of crashing cpu. Will be used in NMI callback. */ crashing_cpu = safe_smp_processor_id(); @@ -867,7 +896,17 @@ void nmi_shootdown_cpus(nmi_shootdown_cb callback) msecs--; } - /* Leave the nmi callback set */ + /* + * Leave the nmi callback set, shootdown is a one-time thing. Clearing + * the callback could result in a NULL pointer dereference if a CPU + * (finally) responds after the timeout expires. + */ +} + +static inline void nmi_shootdown_cpus_on_restart(void) +{ + if (!crash_ipi_issued) + nmi_shootdown_cpus(NULL); } /* @@ -897,6 +936,8 @@ void nmi_shootdown_cpus(nmi_shootdown_cb callback) /* No other CPUs to shoot down */ } +static inline void nmi_shootdown_cpus_on_restart(void) { } + void run_crash_ipi_callback(struct pt_regs *regs) { } From patchwork Wed Nov 30 23:36:48 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sean Christopherson X-Patchwork-Id: 28084 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp1215267wrr; Wed, 30 Nov 2022 15:59:56 -0800 (PST) X-Google-Smtp-Source: AA0mqf42gmdM9Q+IWXxVF4DhFNzJN4uZapqHyqW9UFph7esd4Op0+odY2lzX/CNiCvs0HGE0AFwh X-Received: by 2002:a17:906:6403:b0:7b2:9667:241e with SMTP id d3-20020a170906640300b007b29667241emr54800828ejm.115.1669852796246; Wed, 30 Nov 2022 15:59:56 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1669852796; cv=none; d=google.com; s=arc-20160816; b=po2PAlYYIqXzrvvd1GmnnAs7yZq5auN5lzXOevLSTPp4BL/LJP2jaWkfwXcGGDunoQ P6RQd/7aY6QYMCbje5WzaQ8HFuOHpW2IlompLy4k3aqAlDx9cMlenG9huxxA9xKxGH0B 9YxLCgRz4sCO6xFSFLog5epLXoLzqi99tCsKuA6c0KNMYCZPxo2VE2pJDtoWJyQkSa3b 9n81mJ3BLjxAmPTW4N35AkzsxhvksrswGOdMLeeq7IEkTZg5grloyqYinMP1rB4I5mUA RGOubMJUMmSRXwAzfg8Zl/BTDA/s6ALQ138ijQPrfKbxeeG2PSKeDep5nkFj+hLxZjJJ 30gg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:reply-to:dkim-signature; bh=KY6cgH0FoQgBjJK6cWHlNWc/cuNwA3rTkcmq/FIE/W0=; b=HHIO8KQQBUI2qnuMox/ziwgZwZHYceOOM2U76hvVXf3ucd0zQlLDxfrtJZxgelcrAk vmnbzbOn68xhE1tDesqE3KtPvgi+lcQNmZx+SjSzvaW0Nb8X6vf2srSGxXZmvzsn8YTk FovvTdfWTTeux36In3pxm9oEs3Y/vGw2c+4yVnWJ9GciqksM+XOqCVeK63Dsr4UqbFkC deqCeVq6yEbPDZGEZybXXSeu9jPkSyTJ/rIxtg6xV49kJsDPAFNxfcgRjRcyMTUX5E71 6mhSQVUyBCvQxazr3dg2yXdYNQHQE4Etl+/S+P3QkQVL+/JZXc4ettsJcxW3Kqo2Kky2 4jaQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20210112 header.b=O5Kmt+7v; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id nb38-20020a1709071ca600b00791a67e4c00si2783939ejc.835.2022.11.30.15.59.33; Wed, 30 Nov 2022 15:59:56 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20210112 header.b=O5Kmt+7v; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230028AbiK3XhG (ORCPT + 99 others); Wed, 30 Nov 2022 18:37:06 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55064 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229668AbiK3Xg5 (ORCPT ); Wed, 30 Nov 2022 18:36:57 -0500 Received: from mail-pf1-x449.google.com (mail-pf1-x449.google.com [IPv6:2607:f8b0:4864:20::449]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 90E571128 for ; Wed, 30 Nov 2022 15:36:56 -0800 (PST) Received: by mail-pf1-x449.google.com with SMTP id 145-20020a621497000000b00574fab7294dso227737pfu.13 for ; Wed, 30 Nov 2022 15:36:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=KY6cgH0FoQgBjJK6cWHlNWc/cuNwA3rTkcmq/FIE/W0=; b=O5Kmt+7v3RpSCb0+VWEK9EqPSVW4nD/fCUmVYybP1v3f7uc0CVBZQJ6Mp82SSuZjF7 zmqc3E+bxzy+4Uq3+UDL+eohoq6ah6TrTNoVMvZHg4n+blU3QqemmrwiIawxne5qaD2T UConf3WriIgOVVFc0wl6okzHI4t82xGt4irFaBr3xR+F+tKQt3rl2uMUicSZ4RLGB9mZ L4lQxltIQF790VaPnhEgv3TVdq11vbEFZWepOygqrqfyQCJT5q3mxBQgc0290BBpcxCj r6Ta1DMsMNlerxvpH+yMMUmLS6f5AjQRavMBZ2mZ/a/ok3WETdkul8QghZxRpHT3AW/f vCcg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=KY6cgH0FoQgBjJK6cWHlNWc/cuNwA3rTkcmq/FIE/W0=; b=kJpX0xRPYYtITTix7Ybn79Zji4JU7QkVIEmQXhWUb739+X0QFIHJFiOQaHF4BQneRW 8uDV0Dxv4eg5oF51n2JBISyyMYYSgk5YqYD9XyRiEoYzMrxkmxn6q2mLiMW7mqRx+K+D mxy2DsbZMLzB5L9rNmqjpr26ShWvMG/ocFBET3WKaYGvFG5O8o+x2SujnuE/GjFm25a1 7KUgyE9FVOZptQ56RWj/R3GbtgFRETHmBQ2fTmtb1aOXLlc9vOX5Wz6FWfxPuixMKumb 9PuNWzoPONl1Mv3sfc8psahckh3f/evLnLvA8dC0kXuarxFa8SxxlgZgval0Y/qHa8Sb SlaQ== X-Gm-Message-State: ANoB5pnfTIVD2OF5jQEYy6YrTKJawWRNqiREYkrg/UU5aSFVB8IWWGya zWyBiAYpXALSbXD5GNunnaW1lcvmJto= X-Received: from zagreus.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:5c37]) (user=seanjc job=sendgmr) by 2002:a17:903:1206:b0:186:a2ef:7a74 with SMTP id l6-20020a170903120600b00186a2ef7a74mr48409099plh.148.1669851416008; Wed, 30 Nov 2022 15:36:56 -0800 (PST) Reply-To: Sean Christopherson Date: Wed, 30 Nov 2022 23:36:48 +0000 In-Reply-To: <20221130233650.1404148-1-seanjc@google.com> Mime-Version: 1.0 References: <20221130233650.1404148-1-seanjc@google.com> X-Mailer: git-send-email 2.38.1.584.g0f3c55d4c2-goog Message-ID: <20221130233650.1404148-3-seanjc@google.com> Subject: [PATCH v4 2/4] x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows) From: Sean Christopherson To: Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org Cc: "H. Peter Anvin" , linux-kernel@vger.kernel.org, "Guilherme G . Piccoli" , Vitaly Kuznetsov , Paolo Bonzini , Sean Christopherson , Andrew Cooper , Tom Lendacky , stable@vger.kernel X-Spam-Status: No, score=-9.6 required=5.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1750967565403241723?= X-GMAIL-MSGID: =?utf-8?q?1750967565403241723?= Set GIF=1 prior to disabling SVM to ensure that INIT is recognized if the kernel is disabling SVM in an emergency, e.g. if the kernel is about to jump into a crash kernel or may reboot without doing a full CPU RESET. If GIF is left cleared, the new kernel (or firmware) will be unabled to awaken APs. Eat faults on STGI (due to EFER.SVME=0) as it's possible that SVM could be disabled via NMI shootdown between reading EFER.SVME and executing STGI. Link: https://lore.kernel.org/all/cbcb6f35-e5d7-c1c9-4db9-fe5cc4de579a@amd.com Cc: stable@vger.kernel.org Cc: Andrew Cooper Cc: Tom Lendacky Signed-off-by: Sean Christopherson --- arch/x86/include/asm/virtext.h | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/arch/x86/include/asm/virtext.h b/arch/x86/include/asm/virtext.h index 8757078d4442..0acb14806a74 100644 --- a/arch/x86/include/asm/virtext.h +++ b/arch/x86/include/asm/virtext.h @@ -126,7 +126,18 @@ static inline void cpu_svm_disable(void) wrmsrl(MSR_VM_HSAVE_PA, 0); rdmsrl(MSR_EFER, efer); - wrmsrl(MSR_EFER, efer & ~EFER_SVME); + if (efer & EFER_SVME) { + /* + * Force GIF=1 prior to disabling SVM, e.g. to ensure INIT and + * NMI aren't blocked. Eat faults on STGI, as it #UDs if SVM + * isn't enabled and SVM can be disabled by an NMI callback. + */ + asm_volatile_goto("1: stgi\n\t" + _ASM_EXTABLE(1b, %l[fault]) + ::: "memory" : fault); +fault: + wrmsrl(MSR_EFER, efer & ~EFER_SVME); + } } /** Makes sure SVM is disabled, if it is supported on the CPU From patchwork Wed Nov 30 23:36:49 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sean Christopherson X-Patchwork-Id: 28086 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp1215613wrr; Wed, 30 Nov 2022 16:00:37 -0800 (PST) X-Google-Smtp-Source: AA0mqf5KDExEzen7LNox6hijuEGdKXa77dLbPS8g2/2gDhINng5lrnnl31ptj+JJmlzhjPWRFAJx X-Received: by 2002:a17:90a:fc84:b0:217:ff37:2fe9 with SMTP id ci4-20020a17090afc8400b00217ff372fe9mr74007485pjb.242.1669852836758; Wed, 30 Nov 2022 16:00:36 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1669852836; cv=none; d=google.com; s=arc-20160816; b=j5n5fwt+Oeg+jRCQXBIOGhsvPN7ny/zugxfwGYrwhCrICgBHPRzvT+upTGUrXc2rCW gG3KyH/NQDU7j8FKUx1oWTYYvdGCJvF/Q5GYd5wTr/Y+2XrP6m7DkK/+kkQgfwtCKJZ+ 1VetQDjqB2cAWRB8ZgBUc5WxAZAvW3SNK/V6AEZJiGFasANqYhY2fDQgILfCGvmK3lDr nL+V8fmGQ/tcmi+Iseme7ESS6EBa4CQfW3EHLN7LCoPTk5UiNKkIPXkjMgf1cN9VRVBr 2IOA6UXlt2CKGaAgFOCopq12KFqVukw3snENRiMbm74c7FlaEmL5+Z8Q6DlSoxsNjR2f t7EQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:reply-to:dkim-signature; bh=3Ac7XTrKyealJvttnej4gqUHiXpbMGi2BgXlQ8TSBek=; b=sO8Gt+Qvypnsh5Qe2RShIwgvGM/k6kVEoRI9gusqhNnUTME+uBmGO2+8NXlEYLgYuH l9Doh8cvtpw6yI529liSyFOXGi5PLcmVVYyZs8KtBddkx9BVBVMeMeVoabVyzjWua2kF Y9s0uBaqtF7zFtgE7uv4emWnWCORUJtK/HKU/3tbI807/Y4Q7JmEqjzSEftbdEBOqMNS uY3LdKadd8TD/SIoKhFY1p4GFJ/kqlRSum5u9agQnmuXtJPd4HrzAaflFUzrg7BDCviU NGQmZFwBwkhrqa+9kfhUU7+wnEVGesyjFDSFCzEelerHELwm1gHHAopGqcuNsNvCOOJ2 I4YQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20210112 header.b=YklaFhYb; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id h62-20020a638341000000b0044b5e15db73si2740586pge.249.2022.11.30.16.00.24; Wed, 30 Nov 2022 16:00:36 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20210112 header.b=YklaFhYb; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229736AbiK3XhK (ORCPT + 99 others); Wed, 30 Nov 2022 18:37:10 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55094 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229728AbiK3Xg6 (ORCPT ); Wed, 30 Nov 2022 18:36:58 -0500 Received: from mail-pj1-x104a.google.com (mail-pj1-x104a.google.com [IPv6:2607:f8b0:4864:20::104a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D6055102F for ; Wed, 30 Nov 2022 15:36:57 -0800 (PST) Received: by mail-pj1-x104a.google.com with SMTP id mh8-20020a17090b4ac800b0021348e084a0so3837849pjb.8 for ; Wed, 30 Nov 2022 15:36:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=3Ac7XTrKyealJvttnej4gqUHiXpbMGi2BgXlQ8TSBek=; b=YklaFhYbAovNTKW/H+xKi4bkAw0j+BumngcZB3OlflQPR0hl5TLLW/d3npxDohI8NT VgcAbLoHTd44LVdVzGM3yxudxW2ho3QXdF+/SGcfBR0PdrsCn8xQkMDcpYZUOITiq3tm ejsfEgqpx0zgTMo0usF5nLH8vXSTbwryscEhsVb1IFTPrKoVppmft3n5n1r9sAeZDxaz j5BwvQOzX8Zx2dBw2LVdlOwa6/MDTBkjd39lP3EsJd6aSHUTLgpXDwH+jKqnM1j2M1Io Unm/D0mL5mkskraYkuzDrFZIqViANCMp/8MAezMKZeOLngNa+ZVA48UX7PdCIqBwSMBB 6yBQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=3Ac7XTrKyealJvttnej4gqUHiXpbMGi2BgXlQ8TSBek=; b=l14x3hv2G7lPX/BlDu5A6DpjZbrO540rju1RPbDeVs8OSQQibUQNpg4YWn5eFMmuCM Sx5dxrlPvo71iNTGEGzL0yrYF7nk+84tWABL5nwzKYhSUBCh/kCP1ZL9Y3Go21Sq02Yx UhR4LU2SWr/kqdrSz9u0hzAquYrDoaLPcyxHiuY9E3x4qL71dkeY11ZBbJIWjd7CFviJ +SzQyCjDgm6M7WDa8rBYDnmHGratiWAxWtuX341tw2tVyxu2KeFhE5fqmDuN9EXAaSiH 4XqNPZ+8A9SIj8P+uyMnZWWXBK0hwP31n1DaDzDhOJ+pwUGPuuMwft9J0lLXFLLFAXjt QxiQ== X-Gm-Message-State: ANoB5pn6PhRbqydr+1vXmPlheXcJoSJPCCQT+YN8j55UCwvJpx0gouhP qPpWX+6siiB+fhJ3rPXCV8oju8pqqMI= X-Received: from zagreus.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:5c37]) (user=seanjc job=sendgmr) by 2002:a62:ea18:0:b0:56c:2d:1e56 with SMTP id t24-20020a62ea18000000b0056c002d1e56mr45222870pfh.41.1669851417445; Wed, 30 Nov 2022 15:36:57 -0800 (PST) Reply-To: Sean Christopherson Date: Wed, 30 Nov 2022 23:36:49 +0000 In-Reply-To: <20221130233650.1404148-1-seanjc@google.com> Mime-Version: 1.0 References: <20221130233650.1404148-1-seanjc@google.com> X-Mailer: git-send-email 2.38.1.584.g0f3c55d4c2-goog Message-ID: <20221130233650.1404148-4-seanjc@google.com> Subject: [PATCH v4 3/4] x86/reboot: Disable virtualization in an emergency if SVM is supported From: Sean Christopherson To: Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org Cc: "H. Peter Anvin" , linux-kernel@vger.kernel.org, "Guilherme G . Piccoli" , Vitaly Kuznetsov , Paolo Bonzini , Sean Christopherson , Andrew Cooper , Tom Lendacky , stable@vger.kernel X-Spam-Status: No, score=-9.6 required=5.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1750967608087571130?= X-GMAIL-MSGID: =?utf-8?q?1750967608087571130?= Disable SVM on all CPUs via NMI shootdown during an emergency reboot. Like VMX, SVM can block INIT, e.g. if the emergency reboot is triggered between CLGI and STGI, and thus can prevent bringing up other CPUs via INIT-SIPI-SIPI. Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson --- arch/x86/kernel/reboot.c | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-) diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c index 374c14b3a9bf..d03c551defcc 100644 --- a/arch/x86/kernel/reboot.c +++ b/arch/x86/kernel/reboot.c @@ -530,27 +530,26 @@ static inline void kb_wait(void) static inline void nmi_shootdown_cpus_on_restart(void); -/* Use NMIs as IPIs to tell all CPUs to disable virtualization */ -static void emergency_vmx_disable_all(void) +static void emergency_reboot_disable_virtualization(void) { /* Just make sure we won't change CPUs while doing this */ local_irq_disable(); /* - * Disable VMX on all CPUs before rebooting, otherwise we risk hanging - * the machine, because the CPU blocks INIT when it's in VMX root. + * Disable virtualization on all CPUs before rebooting to avoid hanging + * the system, as VMX and SVM block INIT when running in the host. * * We can't take any locks and we may be on an inconsistent state, so - * use NMIs as IPIs to tell the other CPUs to exit VMX root and halt. + * use NMIs as IPIs to tell the other CPUs to disable VMX/SVM and halt. * - * Do the NMI shootdown even if VMX if off on _this_ CPU, as that - * doesn't prevent a different CPU from being in VMX root operation. + * Do the NMI shootdown even if virtualization is off on _this_ CPU, as + * other CPUs may have virtualization enabled. */ - if (cpu_has_vmx()) { - /* Safely force _this_ CPU out of VMX root operation. */ - __cpu_emergency_vmxoff(); + if (cpu_has_vmx() || cpu_has_svm(NULL)) { + /* Safely force _this_ CPU out of VMX/SVM operation. */ + cpu_emergency_disable_virtualization(); - /* Halt and exit VMX root operation on the other CPUs. */ + /* Disable VMX/SVM and halt on other CPUs. */ nmi_shootdown_cpus_on_restart(); } } @@ -587,7 +586,7 @@ static void native_machine_emergency_restart(void) unsigned short mode; if (reboot_emergency) - emergency_vmx_disable_all(); + emergency_reboot_disable_virtualization(); tboot_shutdown(TB_SHUTDOWN_REBOOT); From patchwork Wed Nov 30 23:36:50 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sean Christopherson X-Patchwork-Id: 28085 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp1215353wrr; Wed, 30 Nov 2022 16:00:07 -0800 (PST) X-Google-Smtp-Source: AA0mqf6M8rgC0u2qa2c4f8m2GZ332UajL/I5QJwxal689iy58Q0ONTPj7RwXPl4K2ux6GPh8uIOR X-Received: by 2002:a17:907:1df2:b0:7ae:8411:112c with SMTP id og50-20020a1709071df200b007ae8411112cmr51035856ejc.97.1669852807540; Wed, 30 Nov 2022 16:00:07 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1669852807; cv=none; d=google.com; s=arc-20160816; b=nYSPGmf8zAx9Wg4AnRyBbbMcxpbbV+szWJigyImDv5MuYhX301dJqfEmSvJCDgEttO LHDhxMPPRiN7+8zE3hNTRUbeusQCvJt2EavlGu3wfKjrghXs/0uwngd0G7KF58STwzbU N15wV6BSxR3Bu2nltZsfTax/eYu8n9KePA9b88C8vz9Hxlg1bHJqw6yonjb1dbdhZd1S f2udvCaoQW0SFVsYzTe+8EceJmV95wgcN7PsyjxiM2O/R4ijk8iGEmd+1VogEqsH6uy+ EcQz1RqJ7G4pRCbBh5GUFIwU1ZfUMErLJwWSHod1zipY8ya9wMw+vQXRjB8TplyCi9LZ 2w8Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:reply-to:dkim-signature; bh=Gab+7smmEIeAzCswMeinhNnVkpeemsKL4/AIt3t4698=; b=Ct5J5ih+qoRG3ZnG1Okb9JSuCBqS1oTHVhALUOV3yOYoGJeWC3LZ+c7+dV+t42nhcB 1+LSzhDutWVSGPTvTi0MMxyXXhbrB0TQ7GIADqZ8eNThFkDtrbSthUJHszVoHeqKgyeX 4vRLLeUEId1g/mEc/dvCvxIaOZBGW6Ej12NUmX+guHN4Y/vSkMSVDv8+5eVMROfShhml b84mFjVWghgM6topu7aoOBTLL0IcveOzyt5NddE8+ZUcdbbiC4HQnmpvyW05prUbbsAA 3aOgzwQxGfDZw1SOMU/G+qane+YAVOSQabTx7gV0H6FhBWCy7jTh+xoJyqh8tO9Oznsl Xk4Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20210112 header.b=ZJiwYaMv; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id u20-20020a05640207d400b0046b0dedf5d5si2342833edy.199.2022.11.30.15.59.44; Wed, 30 Nov 2022 16:00:07 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20210112 header.b=ZJiwYaMv; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229854AbiK3XhN (ORCPT + 99 others); Wed, 30 Nov 2022 18:37:13 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55112 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229814AbiK3XhA (ORCPT ); Wed, 30 Nov 2022 18:37:00 -0500 Received: from mail-pl1-x64a.google.com (mail-pl1-x64a.google.com [IPv6:2607:f8b0:4864:20::64a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9437AEB5 for ; Wed, 30 Nov 2022 15:36:59 -0800 (PST) Received: by mail-pl1-x64a.google.com with SMTP id z10-20020a170902ccca00b001898329db72so13184247ple.21 for ; Wed, 30 Nov 2022 15:36:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=Gab+7smmEIeAzCswMeinhNnVkpeemsKL4/AIt3t4698=; b=ZJiwYaMvGcPJ2o6DfJu9KidimXxl4J+NW5eoqSBhAX4kZ+WPgDR8YQpHsF8I2pm3Hj u2AZ3u4vgrf43j/UtrcH9r9f1BMELIEBxQScRF3vEb7okCvXsEm3sLXo3I1OXzNtpIMO eSUiGAv86HRwAX7VJOF2WQ+5Muz5vqZRHkmjWkYn32GHVJulKdBB7+hMZ22OhD9IV5XN uFEoNX/r4vp9anjRuVb/U/rwtImPO+24HlJ0ZA8d/0UxOMJZDsulI322mBzUMbNuT92W 7KVmMwsSbSQ81Ncz6cur428ZbWpaHi3J0iIHFrwDjN1xElSPZnEUdDexEU0IxrXuJle3 pItQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=Gab+7smmEIeAzCswMeinhNnVkpeemsKL4/AIt3t4698=; b=Qs4UeGut7kK4FBK9Z9uoRn34zLZhAR5p5SkZ0JGRryXnmenalbbQyyVHhHOnNEV/SW p1WutI3CgZMJ9dDvqLCjsEoPYIrriTv1O7U+jTtDM8pxyDk3thRys3dwFhBXSQbtuzK3 khInxy2jtX/Xu9c9oUKXdv3qDDU/jSJFg6tRhcTV+juz3M6FbhEORnLRMY2otV7UP1Pr xIL8Gdae8rrgqE9FOnAdWgkAeZhksOwGpW5dGsooj0tHzObqVt16/zcKYJRYK2dpMpkT 8F06dPTEXNKi/gTP+1gSt+g74U12JckMd3GuJcdZsJRm2HwV5G94Sl8I7Koz3Jtp13o6 h09Q== X-Gm-Message-State: ANoB5plY8i4oVmUNdmOSaM9Eawf6pO0QkCJN4MzmvEZm1t7K7LZO7l1y V5QbTKKeZEdLPWYwjnMNHCoaFLCVcb4= X-Received: from zagreus.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:5c37]) (user=seanjc job=sendgmr) by 2002:a17:90b:1e0f:b0:213:c5ae:55ec with SMTP id pg15-20020a17090b1e0f00b00213c5ae55ecmr65534712pjb.182.1669851419154; Wed, 30 Nov 2022 15:36:59 -0800 (PST) Reply-To: Sean Christopherson Date: Wed, 30 Nov 2022 23:36:50 +0000 In-Reply-To: <20221130233650.1404148-1-seanjc@google.com> Mime-Version: 1.0 References: <20221130233650.1404148-1-seanjc@google.com> X-Mailer: git-send-email 2.38.1.584.g0f3c55d4c2-goog Message-ID: <20221130233650.1404148-5-seanjc@google.com> Subject: [PATCH v4 4/4] x86/reboot: Disable SVM, not just VMX, when stopping CPUs From: Sean Christopherson To: Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org Cc: "H. Peter Anvin" , linux-kernel@vger.kernel.org, "Guilherme G . Piccoli" , Vitaly Kuznetsov , Paolo Bonzini , Sean Christopherson , Andrew Cooper , Tom Lendacky , stable@vger.kernel X-Spam-Status: No, score=-9.6 required=5.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1750967577235706261?= X-GMAIL-MSGID: =?utf-8?q?1750967577235706261?= Disable SVM and more importantly force GIF=1 when halting a CPU or rebooting the machine. Similar to VMX, SVM allows software to block INITs via CLGI, and thus can be problematic for a crash/reboot. The window for failure is smaller with SVM as INIT is only blocked while GIF=0, i.e. between CLGI and STGI, but the window does exist. Fixes: fba4f472b33a ("x86/reboot: Turn off KVM when halting a CPU") Cc: stable@vger.kernel Signed-off-by: Sean Christopherson --- arch/x86/kernel/smp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c index 06db901fabe8..375b33ecafa2 100644 --- a/arch/x86/kernel/smp.c +++ b/arch/x86/kernel/smp.c @@ -32,7 +32,7 @@ #include #include #include -#include +#include /* * Some notes on x86 processor bugs affecting SMP operation: @@ -122,7 +122,7 @@ static int smp_stop_nmi_callback(unsigned int val, struct pt_regs *regs) if (raw_smp_processor_id() == atomic_read(&stopping_cpu)) return NMI_HANDLED; - cpu_emergency_vmxoff(); + cpu_emergency_disable_virtualization(); stop_this_cpu(NULL); return NMI_HANDLED; @@ -134,7 +134,7 @@ static int smp_stop_nmi_callback(unsigned int val, struct pt_regs *regs) DEFINE_IDTENTRY_SYSVEC(sysvec_reboot) { ack_APIC_irq(); - cpu_emergency_vmxoff(); + cpu_emergency_disable_virtualization(); stop_this_cpu(NULL); }