From nobody Sun Sep 14 01:45:45 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AC139C38142 for ; Fri, 27 Jan 2023 18:29:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234535AbjA0S3Z (ORCPT ); Fri, 27 Jan 2023 13:29:25 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59848 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234919AbjA0S3L (ORCPT ); Fri, 27 Jan 2023 13:29:11 -0500 Received: from galois.linutronix.de (Galois.linutronix.de [IPv6:2a0a:51c0:0:12e:550::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 208708A553; Fri, 27 Jan 2023 10:28:40 -0800 (PST) Date: Fri, 27 Jan 2023 18:26:55 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1674844016; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=8MPK0X48FMiysaw0nsOseqJtZ6B9eEOkLBK2xmsdWRY=; b=10RUjvF4Dj8jQVyI+p3bbUyOpQr+mgydmdZ+R0sp5dNDkEdHNnIjtKXUCY9pV02HQUC7OA 2Ir7SspzBzUczygc32CIB+DWsgas5OtYrCGntT1LIG6q5i6RawthvZ1RwYbM3MKg1QQK/E LkgDTqz6BIFDD7iwfaHonC6OfXd5u8/51AGp5DGVxUCOQBECs4yBhNZ3lhS9+gMeWhJXDj BVdw/0QEqBXpYpSRZMMArDjR7EjAyzyhbBUva08dwXSbaqmoESxl1MxfCYNWXVFPduVkpZ X/awzeoMKRmbF79mWNaSs2JQivd4Wjz0aoyq8XZtZ044JMwjubamW9GnZpcCiw== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1674844016; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=8MPK0X48FMiysaw0nsOseqJtZ6B9eEOkLBK2xmsdWRY=; b=U6hOmyJvZWLGwHCWNlOvBulQlPzIQEWmlGQ3kDAo023bx4xxV5/Zxv904tLas+UXLOG1om a7hFsA9gIlyt/GCA== From: "tip-bot2 for Kirill A. Shutemov" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: x86/tdx] x86/tdx: Relax SEPT_VE_DISABLE check for debug TD Cc: "Kirill A. Shutemov" , Dave Hansen , x86@kernel.org, linux-kernel@vger.kernel.org MIME-Version: 1.0 Message-ID: <167484401594.4906.4180234768994841109.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The following commit has been merged into the x86/tdx branch of tip: Commit-ID: 47e67cf317ed6ad22a3df9762daae75dfcba76a8 Gitweb: https://git.kernel.org/tip/47e67cf317ed6ad22a3df9762daae75df= cba76a8 Author: Kirill A. Shutemov AuthorDate: Fri, 27 Jan 2023 01:11:58 +03:00 Committer: Dave Hansen CommitterDate: Fri, 27 Jan 2023 09:46:05 -08:00 x86/tdx: Relax SEPT_VE_DISABLE check for debug TD A "SEPT #VE" occurs when a TDX guest touches memory that is not properly mapped into the "secure EPT". This can be the result of hypervisor attacks or bugs, *OR* guest bugs. Most notably, buggy guests might touch unaccepted memory for lots of different memory safety bugs like buffer overflows. TDX guests do not want to continue in the face of hypervisor attacks or hypervisor bugs. They want to terminate as fast and safely as possible. SEPT_VE_DISABLE ensures that TDX guests *can't* continue in the face of these kinds of issues. But, that causes a problem. TDX guests that can't continue can't spit out oopses or other debugging info. In essence SEPT_VE_DISABLE=3D1 guests are not debuggable. Relax the SEPT_VE_DISABLE check to warning on debug TD and panic() in the #VE handler on EPT-violation on private memory. It will produce useful backtrace. Signed-off-by: Kirill A. Shutemov Signed-off-by: Dave Hansen Link: https://lore.kernel.org/all/20230126221159.8635-7-kirill.shutemov%40l= inux.intel.com --- arch/x86/coco/tdx/tdx.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c index fbb9913..c4a1299 100644 --- a/arch/x86/coco/tdx/tdx.c +++ b/arch/x86/coco/tdx/tdx.c @@ -38,6 +38,7 @@ #define VE_GET_PORT_NUM(e) ((e) >> 16) #define VE_IS_IO_STRING(e) ((e) & BIT(4)) =20 +#define ATTR_DEBUG BIT(0) #define ATTR_SEPT_VE_DISABLE BIT(28) =20 /* TDX Module call error codes */ @@ -207,8 +208,15 @@ static void tdx_parse_tdinfo(u64 *cc_mask) * TD-private memory. Only VMM-shared memory (MMIO) will #VE. */ td_attr =3D out.rdx; - if (!(td_attr & ATTR_SEPT_VE_DISABLE)) - tdx_panic("TD misconfiguration: SEPT_VE_DISABLE attribute must be set."); + if (!(td_attr & ATTR_SEPT_VE_DISABLE)) { + const char *msg =3D "TD misconfiguration: SEPT_VE_DISABLE attribute must= be set."; + + /* Relax SEPT_VE_DISABLE check for debug TD. */ + if (td_attr & ATTR_DEBUG) + pr_warn("%s\n", msg); + else + tdx_panic(msg); + } } =20 /* @@ -664,6 +672,11 @@ static int virt_exception_user(struct pt_regs *regs, s= truct ve_info *ve) } } =20 +static inline bool is_private_gpa(u64 gpa) +{ + return gpa =3D=3D cc_mkenc(gpa); +} + /* * Handle the kernel #VE. * @@ -682,6 +695,8 @@ static int virt_exception_kernel(struct pt_regs *regs, = struct ve_info *ve) case EXIT_REASON_CPUID: return handle_cpuid(regs, ve); case EXIT_REASON_EPT_VIOLATION: + if (is_private_gpa(ve->gpa)) + panic("Unexpected EPT-violation on private memory."); return handle_mmio(regs, ve); case EXIT_REASON_IO_INSTRUCTION: return handle_io(regs, ve);