From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id C9B45EB64D9 for ; Mon, 19 Jun 2023 12:21:42 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 3646E8D0002; Mon, 19 Jun 2023 08:21:42 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 315168D0001; Mon, 19 Jun 2023 08:21:42 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 1DC378D0002; Mon, 19 Jun 2023 08:21:42 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id 0F1B88D0001 for ; Mon, 19 Jun 2023 08:21:42 -0400 (EDT) Received: from smtpin30.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id BEF4812080F for ; Mon, 19 Jun 2023 12:21:41 +0000 (UTC) X-FDA: 80919408402.30.542716D Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by imf06.hostedemail.com (Postfix) with ESMTP id 0B70A18001A for ; Mon, 19 Jun 2023 12:21:38 +0000 (UTC) Authentication-Results: imf06.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=MZotyI8M; spf=pass (imf06.hostedemail.com: domain of david@redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=david@redhat.com; dmarc=pass (policy=none) header.from=redhat.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1687177299; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=pIB4Pfs9fbpMTO7m6AmZ/9HnKP7cCuS9gi+tv9YLZxo=; b=KWfmr3rm64vu3vDkgZScUjiBcWytFcl4SRF+qNXyVGA/OCY+GxcvjySiUu5oXaRUAnsY+l 8G0XmKu/MT+PrP7XFomKU1pY/5tjx23Go6tBEuSQFKSviGI983NlPwxxz8AeULMbMXhZSU MF8LVFfV4wzpSfFEyrKaIsCQSflouOM= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1687177299; a=rsa-sha256; cv=none; b=bQJ5ZQ9jNiThaOwWk6630xGUrSFb2fNwQBbhH1M/xCU8HhdRTmBc37XH8ItOAujuE6zi+H TdGoImbvliFXizT+cem1/O9qYZ1nalfYYEhYzdqEe9PUdOKz+A6UGXU5KAJkL+dMac0QIN 7F17fRIz1G/67kB3SMM9BAl3UccWOLM= ARC-Authentication-Results: i=1; imf06.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=MZotyI8M; spf=pass (imf06.hostedemail.com: domain of david@redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=david@redhat.com; dmarc=pass (policy=none) header.from=redhat.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1687177298; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=pIB4Pfs9fbpMTO7m6AmZ/9HnKP7cCuS9gi+tv9YLZxo=; b=MZotyI8M6CrPjy5CdJ04kNOM/si4AIwvfYFS3lLHPDlcCjXC1P6/fnKCuM/OA1XxevUEdQ rQ2jkhAkt8LFzPVnBTUrE4MEsFUFMenx58wYBTJhCGaHz+Hlk7uf4Q8reFaKsHQ+0Ze+U2 PqWORe0rO9L7ANykLUh4llm8ltPJpFA= Received: from mail-lf1-f71.google.com (mail-lf1-f71.google.com [209.85.167.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-182-s72RJVEqMVKzSx4n5ZDDtg-1; Mon, 19 Jun 2023 08:21:36 -0400 X-MC-Unique: s72RJVEqMVKzSx4n5ZDDtg-1 Received: by mail-lf1-f71.google.com with SMTP id 2adb3069b0e04-4f517b5309cso2150854e87.1 for ; Mon, 19 Jun 2023 05:21:36 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1687177295; x=1689769295; h=content-transfer-encoding:in-reply-to:organization:from:references :cc:to:content-language:subject:user-agent:mime-version:date :message-id:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=pIB4Pfs9fbpMTO7m6AmZ/9HnKP7cCuS9gi+tv9YLZxo=; b=Ch4TPqrh7DCPYvW7K7fobs71TIUJxPi+1v+ffwAkPKsXnD+vji6FXVCA4XPOTg/uL9 /mtSGF4YmJMlkNXGy7jcqJVavTwzJNKHHLtLbsvbjr7WJ0ecQxdhsgtys54XKQ8Ad+mj tMPIj2HjsRKTVMMduvLLYl3EfymJosgDYygoUVdytqvCOOAEErbLOUscWfsHJOPWIein Yl69asZniXYSxzmxoHn6USbgrQKRkqlcf4kd/6kFcHiWZW29Z8VmZrz1I8f3ySPFVxIS mXYGcMr/T+zwnd4AQd79GwXvkO14EIj7qG3bwKM3GpWEfGZ1h7DZGCOZ8zGMfff5lHI4 VLVg== X-Gm-Message-State: AC+VfDyh7D3GEPI0XPWxHgqiBnQ+oXPVeWsfZkybmj7GUIfGG8Bp0v5L K06dM3/a31MdmOAAyzn4F1C3YHEsKNU5mbWzm09hYFmuman5RAPPG4jDF9t/NGducikrJToEvw8 o+obziYZbe8w= X-Received: by 2002:a05:6512:3286:b0:4f8:7127:9b9d with SMTP id p6-20020a056512328600b004f871279b9dmr1478966lfe.37.1687177295332; Mon, 19 Jun 2023 05:21:35 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ6Ja7N7ynoEdw3gVBRjtgeD5bqeanvdmHPH1S5c1ZXM6MVwIxYJ0TZf0dca8krz+8Q4ueDjKA== X-Received: by 2002:a05:6512:3286:b0:4f8:7127:9b9d with SMTP id p6-20020a056512328600b004f871279b9dmr1478921lfe.37.1687177294844; Mon, 19 Jun 2023 05:21:34 -0700 (PDT) Received: from ?IPV6:2003:cb:c72f:7100:cede:6433:a77b:41e9? (p200300cbc72f7100cede6433a77b41e9.dip0.t-ipconnect.de. [2003:cb:c72f:7100:cede:6433:a77b:41e9]) by smtp.gmail.com with ESMTPSA id m9-20020a056000008900b0030ae499da59sm31424013wrx.111.2023.06.19.05.21.33 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 19 Jun 2023 05:21:34 -0700 (PDT) Message-ID: <723dd9da-ebd5-edb0-e9e5-2d8c14aaffe2@redhat.com> Date: Mon, 19 Jun 2023 14:21:33 +0200 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.12.0 Subject: Re: [PATCH v11 04/20] x86/cpu: Detect TDX partial write machine check erratum To: Kai Huang , linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: linux-mm@kvack.org, dave.hansen@intel.com, kirill.shutemov@linux.intel.com, tony.luck@intel.com, peterz@infradead.org, tglx@linutronix.de, seanjc@google.com, pbonzini@redhat.com, dan.j.williams@intel.com, rafael.j.wysocki@intel.com, ying.huang@intel.com, reinette.chatre@intel.com, len.brown@intel.com, ak@linux.intel.com, isaku.yamahata@intel.com, chao.gao@intel.com, sathyanarayanan.kuppuswamy@linux.intel.com, bagasdotme@gmail.com, sagis@google.com, imammedo@redhat.com References: <86f2a8814240f4bbe850f6a09fc9d0b934979d1b.1685887183.git.kai.huang@intel.com> From: David Hildenbrand Organization: Red Hat In-Reply-To: <86f2a8814240f4bbe850f6a09fc9d0b934979d1b.1685887183.git.kai.huang@intel.com> X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Language: en-US Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Rspamd-Queue-Id: 0B70A18001A X-Rspam-User: X-Stat-Signature: k4fqitkwrwc6g9tkt3d7suiboh8d7b1w X-Rspamd-Server: rspam03 X-HE-Tag: 1687177298-645552 X-HE-Meta: U2FsdGVkX1/hbpxha4TaM/re3S8PSYru96Zc6t0WHdFMDCdObEEvhZO0wXyy7mAX/jsQJpG5LLxzrKcamzgVmHqfr+Z7IMHbeT44w+H7JGd1cKhJGUf+bgucPlzu09EZjClZuwlmm1r/jVlpQSycLOHVrhS/1/XyAA0MkRB9CdnURvwnVLsyvcpUBSAfXP6XOSN1hW/b7KmREXLyC94gtdu04wUM7lhmNrbsZGD/fcyVnVQJJzmFmcGTUXUbtjsm/C9fMnTOppW5rNLuCpk0GXFeicuGK10yOfNgXqS0CtUHWbtzqqAYfJUDT6ZKeocPV/iKCnQqoVbLwBit5W12ZsnQxKHbOhwmt/BdCF/Mu0tqWJyjfew2YseqWRZuxBeXQhTCAChID3hM/J6jauAt+saDWPBb+gEfSh2w6L4sTo54fyqYKi7Cz7wIzUZBU9yMjRnSBgUuRH/DZlz0+bGxEF4oe18A0cCPJ27JpaxAVMGSMSdVlqkKjCjeAOkuXrnqevzLXsUfzj3JiXdD6t03Q6n9TOM0DClCb3v2g8lEX4T50BDa2mfLy1BUx+2OV8CI7JN5a6/KKJI3QbcRZAw/PWxokK/MMxbJ1dplfT8uhfkoTiVgBRKmfxC0kmdLJOJGjnvkux9U23kQG1E58J9ZMGZXCEVxew/iMq8EjL21qO8onV0adVcohReAdnSHG8R0+OvGFxn6o9dkxjOez87iFvINlBQtsWoKKfcCvwGcX+Sm9ZjBt9inqHugv20p9MoE9+uUgnmZGO7axYPaFqgd3WaXlbFtbs+Q8Pw92tzSKfPt8ef/cpZzoGIc7pdol/xebQelpOfxIpxHzNEZ/bOEqsDxIREp99g/75fskZ3fsx/sKxLMgZbf3uykS7z3qHp2yJfrdJEMrq1PBObdnAPWQQVNVzMOM9wVTofTxBvVus8ZcvirTEG57W0v0fcyyyq/psG5kQSLblWnvFJPqIV NCyr3KAk k8YtIer2v2G+fKQLwQwssi1laNMdhXKrXR5hO5DvvFJ60dPOQlFX02VcIBP6zRb65jFaQEoTZ4rFoIegOv1EKck11bhVqoH0M3fGvKYGexuYWEQerMyu6LNGFSjGKAFZgXLJPQmjaNP+AiP1SMfTPHZ8Ip5MYW2pJWgHZk3MBb/YE1MD4lWLQH+hPmMt0/9j5oItwE3serQY0N+S2Xh1+WS+G3jYqhrtJYpebsXFk/w5baM57uetRZ9UEPVX+brKzdTWEkmcMMwcxIiAooZfTwYVDLrclPuxwLSEDdDLXfiUDR1EJ5DGSoPFWL7OkQhJ3zh/ItGciRwhKzmuc+3kZd4bhDM6DHL6Pfl9JtDpOm2ZJOW3bx6mqC3UVScBGEYBKRC6eJw+bVA4/q3lhylQGNtwrCvuVOBRSWlES X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 04.06.23 16:27, Kai Huang wrote: > TDX memory has integrity and confidentiality protections. Violations of > this integrity protection are supposed to only affect TDX operations and > are never supposed to affect the host kernel itself. In other words, > the host kernel should never, itself, see machine checks induced by the > TDX integrity hardware. > > Alas, the first few generations of TDX hardware have an erratum. A > "partial" write to a TDX private memory cacheline will silently "poison" > the line. Subsequent reads will consume the poison and generate a > machine check. According to the TDX hardware spec, neither of these > things should have happened. > > Virtually all kernel memory accesses operations happen in full > cachelines. In practice, writing a "byte" of memory usually reads a 64 > byte cacheline of memory, modifies it, then writes the whole line back. > Those operations do not trigger this problem. So, ordinary writes to TD private memory are not a problem? I thought one motivation for the unmapped-guest-memory discussion was to prevent host (userspace) writes to such memory because it would trigger a MC and eventually crash the host. I recall that this would happen easily (not just in some weird "partial" case and that the spec would allow for it) 1) Does that, in general, not happen anymore (was the hardware fixed?)? 2) Will new hardware prevent/"fix" that completely (was the spec updated?)? ... or was my understanding wrong? Thanks! > > This problem is triggered by "partial" writes where a write transaction > of less than cacheline lands at the memory controller. The CPU does > these via non-temporal write instructions (like MOVNTI), or through > UC/WC memory mappings. The issue can also be triggered away from the > CPU by devices doing partial writes via DMA. > > With this erratum, there are additional things need to be done around > machine check handler and kexec(), etc. Similar to other CPU bugs, use > a CPU bug bit to indicate this erratum, and detect this erratum during > early boot. Note this bug reflects the hardware thus it is detected > regardless of whether the kernel is built with TDX support or not. > > Signed-off-by: Kai Huang > --- > > v10 -> v11: > - New patch > > --- > arch/x86/include/asm/cpufeatures.h | 1 + > arch/x86/kernel/cpu/intel.c | 21 +++++++++++++++++++++ > 2 files changed, 22 insertions(+) > > diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h > index cb8ca46213be..dc8701f8d88b 100644 > --- a/arch/x86/include/asm/cpufeatures.h > +++ b/arch/x86/include/asm/cpufeatures.h > @@ -483,5 +483,6 @@ > #define X86_BUG_RETBLEED X86_BUG(27) /* CPU is affected by RETBleed */ > #define X86_BUG_EIBRS_PBRSB X86_BUG(28) /* EIBRS is vulnerable to Post Barrier RSB Predictions */ > #define X86_BUG_SMT_RSB X86_BUG(29) /* CPU is vulnerable to Cross-Thread Return Address Predictions */ > +#define X86_BUG_TDX_PW_MCE X86_BUG(30) /* CPU may incur #MC if non-TD software does partial write to TDX private memory */ > > #endif /* _ASM_X86_CPUFEATURES_H */ > diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c > index 1c4639588ff9..251b333e53d2 100644 > --- a/arch/x86/kernel/cpu/intel.c > +++ b/arch/x86/kernel/cpu/intel.c > @@ -1552,3 +1552,24 @@ u8 get_this_hybrid_cpu_type(void) > > return cpuid_eax(0x0000001a) >> X86_HYBRID_CPU_TYPE_ID_SHIFT; > } > + > +/* > + * These CPUs have an erratum. A partial write from non-TD > + * software (e.g. via MOVNTI variants or UC/WC mapping) to TDX > + * private memory poisons that memory, and a subsequent read of > + * that memory triggers #MC. > + */ > +static const struct x86_cpu_id tdx_pw_mce_cpu_ids[] __initconst = { > + X86_MATCH_INTEL_FAM6_MODEL(SAPPHIRERAPIDS_X, NULL), > + X86_MATCH_INTEL_FAM6_MODEL(EMERALDRAPIDS_X, NULL), > + { } > +}; > + > +static int __init tdx_erratum_detect(void) > +{ > + if (x86_match_cpu(tdx_pw_mce_cpu_ids)) > + setup_force_cpu_bug(X86_BUG_TDX_PW_MCE); > + > + return 0; > +} > +early_initcall(tdx_erratum_detect); -- Cheers, David / dhildenb