1. Patchew
  2. linux
  3. View series

[tip: x86/urgent] x86/sev: Unroll string mmio with CC_ATTR_GUEST_UNROLL_STRING_IO

tip-bot2 for Joerg Roedel posted 1 patch 4 years, 2 months ago
There is a newer version of this series
arch/x86/lib/iomem.c | 65 +++++++++++++++++++++++++++++++++++++------
1 file changed, 57 insertions(+), 8 deletions(-)
[tip: x86/urgent] x86/sev: Unroll string mmio with CC_ATTR_GUEST_UNROLL_STRING_IO
Posted by tip-bot2 for Joerg Roedel 4 years, 2 months ago 
The following commit has been merged into the x86/urgent branch of tip:

Commit-ID:     4009a4ac82dd95b8cd2b62bd30019476983f0aff
Gitweb:        https://git.kernel.org/tip/4009a4ac82dd95b8cd2b62bd30019476983f0aff
Author:        Joerg Roedel <jroedel@suse.de>
AuthorDate:    Mon, 21 Mar 2022 10:33:51 +01:00
Committer:     Borislav Petkov <bp@suse.de>
CommitterDate: Tue, 29 Mar 2022 15:59:16 +02:00

x86/sev: Unroll string mmio with CC_ATTR_GUEST_UNROLL_STRING_IO

The io-specific memcpy/memset functions use string mmio accesses to do
their work. Under SEV, the hypervisor can't emulate these instructions
because they read/write directly from/to encrypted memory.

KVM will inject a page fault exception into the guest when it is asked
to emulate string mmio instructions for an SEV guest:

  BUG: unable to handle page fault for address: ffffc90000065068
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  PGD 8000100000067 P4D 8000100000067 PUD 80001000fb067 PMD 80001000fc067 PTE 80000000fed40173
  Oops: 0000 [#1] PREEMPT SMP NOPTI
  CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.17.0-rc7 #3

As string mmio for an SEV guest can not be supported by the
hypervisor, unroll the instructions for CC_ATTR_GUEST_UNROLL_STRING_IO
enabled kernels.

This issue appears when kernels are launched in recent libvirt-managed
SEV virtual machines, because virt-install started to add a tpm-crb
device to the guest by default and proactively because, raisins:

  https://github.com/virt-manager/virt-manager/commit/eb58c09f488b0633ed1eea012cd311e48864401e

and as that commit says, the default adding of a TPM can be disabled
with "virt-install ... --tpm none".

The kernel driver for tpm-crb uses memcpy_to/from_io() functions to
access MMIO memory, resulting in a page-fault injected by KVM and
crashing the kernel at boot.

  [ bp: Massage and extend commit message. ]

Fixes: d8aa7eea78a1 ('x86/mm: Add Secure Encrypted Virtualization (SEV) support')
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20220321093351.23976-1-joro@8bytes.org
---
 arch/x86/lib/iomem.c | 65 +++++++++++++++++++++++++++++++++++++------
 1 file changed, 57 insertions(+), 8 deletions(-)

diff --git a/arch/x86/lib/iomem.c b/arch/x86/lib/iomem.c
index df50451..3e2f33f 100644
--- a/arch/x86/lib/iomem.c
+++ b/arch/x86/lib/iomem.c
@@ -22,7 +22,7 @@ static __always_inline void rep_movs(void *to, const void *from, size_t n)
 		     : "memory");
 }
 
-void memcpy_fromio(void *to, const volatile void __iomem *from, size_t n)
+static void string_memcpy_fromio(void *to, const volatile void __iomem *from, size_t n)
 {
 	if (unlikely(!n))
 		return;
@@ -38,9 +38,8 @@ void memcpy_fromio(void *to, const volatile void __iomem *from, size_t n)
 	}
 	rep_movs(to, (const void *)from, n);
 }
-EXPORT_SYMBOL(memcpy_fromio);
 
-void memcpy_toio(volatile void __iomem *to, const void *from, size_t n)
+static void string_memcpy_toio(volatile void __iomem *to, const void *from, size_t n)
 {
 	if (unlikely(!n))
 		return;
@@ -56,14 +55,64 @@ void memcpy_toio(volatile void __iomem *to, const void *from, size_t n)
 	}
 	rep_movs((void *)to, (const void *) from, n);
 }
+
+static void unrolled_memcpy_fromio(void *to, const volatile void __iomem *from, size_t n)
+{
+	const volatile char __iomem *in = from;
+	char *out = to;
+	int i;
+
+	for (i = 0; i < n; ++i)
+		out[i] = readb(&in[i]);
+}
+
+static void unrolled_memcpy_toio(volatile void __iomem *to, const void *from, size_t n)
+{
+	volatile char __iomem *out = to;
+	const char *in = from;
+	int i;
+
+	for (i = 0; i < n; ++i)
+		writeb(in[i], &out[i]);
+}
+
+static void unrolled_memset_io(volatile void __iomem *a, int b, size_t c)
+{
+	volatile char __iomem *mem = a;
+	int i;
+
+	for (i = 0; i < c; ++i)
+		writeb(b, &mem[i]);
+}
+
+void memcpy_fromio(void *to, const volatile void __iomem *from, size_t n)
+{
+	if (cc_platform_has(CC_ATTR_GUEST_UNROLL_STRING_IO))
+		unrolled_memcpy_fromio(to, from, n);
+	else
+		string_memcpy_fromio(to, from, n);
+}
+EXPORT_SYMBOL(memcpy_fromio);
+
+void memcpy_toio(volatile void __iomem *to, const void *from, size_t n)
+{
+	if (cc_platform_has(CC_ATTR_GUEST_UNROLL_STRING_IO))
+		unrolled_memcpy_toio(to, from, n);
+	else
+		string_memcpy_toio(to, from, n);
+}
 EXPORT_SYMBOL(memcpy_toio);
 
 void memset_io(volatile void __iomem *a, int b, size_t c)
 {
-	/*
-	 * TODO: memset can mangle the IO patterns quite a bit.
-	 * perhaps it would be better to use a dumb one:
-	 */
-	memset((void *)a, b, c);
+	if (cc_platform_has(CC_ATTR_GUEST_UNROLL_STRING_IO)) {
+		unrolled_memset_io(a, b, c);
+	} else {
+		/*
+		 * TODO: memset can mangle the IO patterns quite a bit.
+		 * perhaps it would be better to use a dumb one:
+		 */
+		memset((void *)a, b, c);
+	}
 }
 EXPORT_SYMBOL(memset_io);
RE: [tip: x86/urgent] x86/sev: Unroll string mmio with CC_ATTR_GUEST_UNROLL_STRING_IO
Posted by David Laight 4 years, 2 months ago 
Isn't this patch entirely broken?
Even the 'normal' kernel functions are broken.

memcpy_toio() and memcpy_fromio() need to be using 64bit
accesses to IO space.

They used to be implemented using memcpy() - but that can end
up being 'rep movsb' which is always byte copies on uncached
memory.
I thought that had been fixed to used a better copy loop.

	David

> -----Original Message-----
> From: tip-bot2@linutronix.de <tip-bot2@linutronix.de>
> Sent: 29 March 2022 15:39
> To: linux-tip-commits@vger.kernel.org
> Cc: Joerg Roedel <jroedel@suse.de>; Borislav Petkov <bp@suse.de>; Tom Lendacky
> <thomas.lendacky@amd.com>; stable@vger.kernel.org; x86@kernel.org; linux-kernel@vger.kernel.org
> Subject: [tip: x86/urgent] x86/sev: Unroll string mmio with CC_ATTR_GUEST_UNROLL_STRING_IO
> 
> The following commit has been merged into the x86/urgent branch of tip:
> 
> Commit-ID:     4009a4ac82dd95b8cd2b62bd30019476983f0aff
> Gitweb:        https://git.kernel.org/tip/4009a4ac82dd95b8cd2b62bd30019476983f0aff
> Author:        Joerg Roedel <jroedel@suse.de>
> AuthorDate:    Mon, 21 Mar 2022 10:33:51 +01:00
> Committer:     Borislav Petkov <bp@suse.de>
> CommitterDate: Tue, 29 Mar 2022 15:59:16 +02:00
> 
> x86/sev: Unroll string mmio with CC_ATTR_GUEST_UNROLL_STRING_IO
> 
> The io-specific memcpy/memset functions use string mmio accesses to do
> their work. Under SEV, the hypervisor can't emulate these instructions
> because they read/write directly from/to encrypted memory.
> 
> KVM will inject a page fault exception into the guest when it is asked
> to emulate string mmio instructions for an SEV guest:
> 
>   BUG: unable to handle page fault for address: ffffc90000065068
>   #PF: supervisor read access in kernel mode
>   #PF: error_code(0x0000) - not-present page
>   PGD 8000100000067 P4D 8000100000067 PUD 80001000fb067 PMD 80001000fc067 PTE 80000000fed40173
>   Oops: 0000 [#1] PREEMPT SMP NOPTI
>   CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.17.0-rc7 #3
> 
> As string mmio for an SEV guest can not be supported by the
> hypervisor, unroll the instructions for CC_ATTR_GUEST_UNROLL_STRING_IO
> enabled kernels.
> 
> This issue appears when kernels are launched in recent libvirt-managed
> SEV virtual machines, because virt-install started to add a tpm-crb
> device to the guest by default and proactively because, raisins:
> 
>   https://github.com/virt-manager/virt-manager/commit/eb58c09f488b0633ed1eea012cd311e48864401e
> 
> and as that commit says, the default adding of a TPM can be disabled
> with "virt-install ... --tpm none".
> 
> The kernel driver for tpm-crb uses memcpy_to/from_io() functions to
> access MMIO memory, resulting in a page-fault injected by KVM and
> crashing the kernel at boot.
> 
>   [ bp: Massage and extend commit message. ]
> 
> Fixes: d8aa7eea78a1 ('x86/mm: Add Secure Encrypted Virtualization (SEV) support')
> Signed-off-by: Joerg Roedel <jroedel@suse.de>
> Signed-off-by: Borislav Petkov <bp@suse.de>
> Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
> Cc: <stable@vger.kernel.org>
> Link: https://lore.kernel.org/r/20220321093351.23976-1-joro@8bytes.org
> ---
>  arch/x86/lib/iomem.c | 65 +++++++++++++++++++++++++++++++++++++------
>  1 file changed, 57 insertions(+), 8 deletions(-)
> 
> diff --git a/arch/x86/lib/iomem.c b/arch/x86/lib/iomem.c
> index df50451..3e2f33f 100644
> --- a/arch/x86/lib/iomem.c
> +++ b/arch/x86/lib/iomem.c
> @@ -22,7 +22,7 @@ static __always_inline void rep_movs(void *to, const void *from, size_t n)
>  		     : "memory");
>  }
> 
> -void memcpy_fromio(void *to, const volatile void __iomem *from, size_t n)
> +static void string_memcpy_fromio(void *to, const volatile void __iomem *from, size_t n)
>  {
>  	if (unlikely(!n))
>  		return;
> @@ -38,9 +38,8 @@ void memcpy_fromio(void *to, const volatile void __iomem *from, size_t n)
>  	}
>  	rep_movs(to, (const void *)from, n);
>  }
> -EXPORT_SYMBOL(memcpy_fromio);
> 
> -void memcpy_toio(volatile void __iomem *to, const void *from, size_t n)
> +static void string_memcpy_toio(volatile void __iomem *to, const void *from, size_t n)
>  {
>  	if (unlikely(!n))
>  		return;
> @@ -56,14 +55,64 @@ void memcpy_toio(volatile void __iomem *to, const void *from, size_t n)
>  	}
>  	rep_movs((void *)to, (const void *) from, n);
>  }
> +
> +static void unrolled_memcpy_fromio(void *to, const volatile void __iomem *from, size_t n)
> +{
> +	const volatile char __iomem *in = from;
> +	char *out = to;
> +	int i;
> +
> +	for (i = 0; i < n; ++i)
> +		out[i] = readb(&in[i]);
> +}
> +
> +static void unrolled_memcpy_toio(volatile void __iomem *to, const void *from, size_t n)
> +{
> +	volatile char __iomem *out = to;
> +	const char *in = from;
> +	int i;
> +
> +	for (i = 0; i < n; ++i)
> +		writeb(in[i], &out[i]);
> +}
> +
> +static void unrolled_memset_io(volatile void __iomem *a, int b, size_t c)
> +{
> +	volatile char __iomem *mem = a;
> +	int i;
> +
> +	for (i = 0; i < c; ++i)
> +		writeb(b, &mem[i]);
> +}
> +
> +void memcpy_fromio(void *to, const volatile void __iomem *from, size_t n)
> +{
> +	if (cc_platform_has(CC_ATTR_GUEST_UNROLL_STRING_IO))
> +		unrolled_memcpy_fromio(to, from, n);
> +	else
> +		string_memcpy_fromio(to, from, n);
> +}
> +EXPORT_SYMBOL(memcpy_fromio);
> +
> +void memcpy_toio(volatile void __iomem *to, const void *from, size_t n)
> +{
> +	if (cc_platform_has(CC_ATTR_GUEST_UNROLL_STRING_IO))
> +		unrolled_memcpy_toio(to, from, n);
> +	else
> +		string_memcpy_toio(to, from, n);
> +}
>  EXPORT_SYMBOL(memcpy_toio);
> 
>  void memset_io(volatile void __iomem *a, int b, size_t c)
>  {
> -	/*
> -	 * TODO: memset can mangle the IO patterns quite a bit.
> -	 * perhaps it would be better to use a dumb one:
> -	 */
> -	memset((void *)a, b, c);
> +	if (cc_platform_has(CC_ATTR_GUEST_UNROLL_STRING_IO)) {
> +		unrolled_memset_io(a, b, c);
> +	} else {
> +		/*
> +		 * TODO: memset can mangle the IO patterns quite a bit.
> +		 * perhaps it would be better to use a dumb one:
> +		 */
> +		memset((void *)a, b, c);
> +	}
>  }
>  EXPORT_SYMBOL(memset_io);

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)

Patchew 2.1-devel-ea86937

© 2016 - 2026 Red Hat, Inc.