From nobody Sun Sep 14 06:31:47 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 11E44C54EBD for ; Thu, 12 Jan 2023 10:16:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239983AbjALKQE (ORCPT ); Thu, 12 Jan 2023 05:16:04 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46438 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239871AbjALKPB (ORCPT ); Thu, 12 Jan 2023 05:15:01 -0500 Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C7E0362EC for ; Thu, 12 Jan 2023 02:14:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1673518465; x=1705054465; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=7okiIaj1mXjjqjJ5IKQzDQSQ9jvp5ruk3bnJVX6pMgw=; b=AdultxN9Xm61l6JCLZ94HprPLAjpGPsuG3cbxLcv1iKqS9+WILhp1/jN G1Pf5v7f+ACDaBknHCTplWRzE1LWMMNk9Gy2fgVV3hcjOUcL7qQKpUnD7 KMDemoVK01LNSX7LjzeOM0wTlZnvV5beeACdTuIFOV96LEUP2YnyiQRom XjSIbtJOBJQLdT0yFYoZ8CkkfGm6YyLa4ar7NN4l7iSPE8yvzogf5hV6W 64jMPJaIoJp5vnZf3tBNm04uIxjgZlBS+gbRwP4+CBkG9XX1y2UzcxYfo 3EnFxIhYEeAWKnuC8Bg0kR0EWjqFg8IISYc5yqOiEX1Bz+m8I5NJZJm0Y Q==; X-IronPort-AV: E=McAfee;i="6500,9779,10586"; a="324899419" X-IronPort-AV: E=Sophos;i="5.96,319,1665471600"; d="scan'208";a="324899419" Received: from fmsmga006.fm.intel.com ([10.253.24.20]) by orsmga102.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 12 Jan 2023 02:14:24 -0800 X-IronPort-AV: E=McAfee;i="6500,9779,10586"; a="903128291" X-IronPort-AV: E=Sophos;i="5.96,319,1665471600"; d="scan'208";a="903128291" Received: from glieseu-mobl.ger.corp.intel.com (HELO box.shutemov.name) ([10.252.52.1]) by fmsmga006-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 12 Jan 2023 02:14:21 -0800 Received: by box.shutemov.name (Postfix, from userid 1000) id A551D109AF5; Thu, 12 Jan 2023 13:14:13 +0300 (+03) From: "Kirill A. Shutemov" To: Dave Hansen , Borislav Petkov , Andy Lutomirski Cc: Kuppuswamy Sathyanarayanan , Thomas Gleixner , Elena Reshetova , x86@kernel.org, linux-coco@lists.linux.dev, linux-kernel@vger.kernel.org, "Kirill A. Shutemov" Subject: [PATCHv2 5/7] x86/tdx: Use ReportFatalError to report missing SEPT_VE_DISABLE Date: Thu, 12 Jan 2023 13:14:05 +0300 Message-Id: <20230112101407.24327-6-kirill.shutemov@linux.intel.com> X-Mailer: git-send-email 2.38.2 In-Reply-To: <20230112101407.24327-1-kirill.shutemov@linux.intel.com> References: <20230112101407.24327-1-kirill.shutemov@linux.intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Linux TDX guests require that the SEPT_VE_DISABLE "attribute" be set. If it is not set, the kernel is theoretically required to handle exceptions anywhere that kernel memory is accessed, including places like NMI handlers and in the syscall entry gap. Rather than even try to handle these exceptions, the kernel refuses to run if SEPT_VE_DISABLE is unset. However, the SEPT_VE_DISABLE detection and refusal code happens very early in boot, even before earlyprintk runs. Calling panic() will effectively just hang the system. Instead, call a TDX-specific panic() function. This makes a very simple TDVMCALL which gets a short error string out to the hypervisor without any console infrastructure. Use TDG.VP.VMCALL to report the error. The hypercall can encode message up to 64 bytes in eight registers. Signed-off-by: Kirill A. Shutemov --- arch/x86/coco/tdx/tdx.c | 38 +++++++++++++++++++++++++++++++++++++- 1 file changed, 37 insertions(+), 1 deletion(-) diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c index 669d9e4f2901..56accf653709 100644 --- a/arch/x86/coco/tdx/tdx.c +++ b/arch/x86/coco/tdx/tdx.c @@ -22,6 +22,7 @@ =20 /* TDX hypercall Leaf IDs */ #define TDVMCALL_MAP_GPA 0x10001 +#define TDVMCALL_REPORT_FATAL_ERROR 0x10003 =20 /* MMIO direction */ #define EPT_READ 0 @@ -140,6 +141,41 @@ int tdx_mcall_get_report0(u8 *reportdata, u8 *tdreport) } EXPORT_SYMBOL_GPL(tdx_mcall_get_report0); =20 +static void __noreturn tdx_panic(const char *msg) +{ + struct tdx_hypercall_args args =3D { + .r10 =3D TDX_HYPERCALL_STANDARD, + .r11 =3D TDVMCALL_REPORT_FATAL_ERROR, + .r12 =3D 0, /* Error code: 0 is Panic */ + }; + union { + /* Define register order according to the GHCI */ + struct { u64 r14, r15, rbx, rdi, rsi, r8, r9, rdx; }; + + char str[64]; + } message; + + /* VMM assumes '\0' in byte 65, if the message took all 64 bytes */ + strncpy(message.str, msg, 64); + + args.r8 =3D message.r8; + args.r9 =3D message.r9; + args.r14 =3D message.r14; + args.r15 =3D message.r15; + args.rdi =3D message.rdi; + args.rsi =3D message.rsi; + args.rbx =3D message.rbx; + args.rdx =3D message.rdx; + + /* + * Keep calling the hypercall in case VMM did not terminated + * the TD as it must. + */ + while (1) { + __tdx_hypercall(&args, 0); + } +} + static void tdx_parse_tdinfo(u64 *cc_mask) { struct tdx_module_output out; @@ -172,7 +208,7 @@ static void tdx_parse_tdinfo(u64 *cc_mask) */ td_attr =3D out.rdx; if (!(td_attr & ATTR_SEPT_VE_DISABLE)) - panic("TD misconfiguration: SEPT_VE_DISABLE attibute must be set.\n"); + tdx_panic("TD misconfiguration: SEPT_VE_DISABLE attribute must be set."); } =20 /* --=20 2.38.2