From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1759120AbcLPEef (ORCPT ); Thu, 15 Dec 2016 23:34:35 -0500 Received: from aserp1050.oracle.com ([141.146.126.70]:43109 "EHLO aserp1050.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758922AbcLPEe1 (ORCPT ); Thu, 15 Dec 2016 23:34:27 -0500 From: Boris Ostrovsky Subject: Re: Can't boot as Xen dom0 due to commit fe055896 To: Borislav Petkov References: <20161215164635.thm7ruio2ddnxszw@pd.tnic> <20161215171755.xpfuax7a6q3jofet@pd.tnic> <20161215173609.ornfok6lk5oro2pj@pd.tnic> <385ac3cd-7a3f-4c4d-69bb-8feee235fb7e@oracle.com> <20161215192305.dlgyrmteirgzop4y@pd.tnic> <399c758a-a94b-8aa1-efbb-79a0161b8020@oracle.com> <20161215200324.6ju7o5e3aiirrycf@pd.tnic> <51f0a58d-a5bc-aae4-22b2-f45bf7164088@oracle.com> <20161215230433.m52cs2gef662c2s7@pd.tnic> Cc: Juergen Gross , Linux Kernel Mailing List , xen-devel Message-ID: <539c1b43-009d-9a59-0c80-7b1e552ab0ed@oracle.com> Date: Thu, 15 Dec 2016 22:56:25 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 In-Reply-To: <20161215230433.m52cs2gef662c2s7@pd.tnic> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Source-IP: aserp1040.oracle.com [141.146.126.69] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 12/15/2016 06:04 PM, Borislav Petkov wrote: > On Thu, Dec 15, 2016 at 05:56:44PM -0500, Boris Ostrovsky wrote: >> With CONFIG_PARAVIRT (which I suspect you don't have on) cpuid() is a >> call via a pointer, you can see it, for example, if you disassemble >> load_ucode_amd_bsp(). And we don't have paging on yet when we call >> load_ucode_amd_bsp (at least in 32-bit mode). > > That's a good catch, you can send me that one as a proper patch with a > commit message and so on... OK, I'll send something tomorrow. > >> Since this happens during AP bringup PV cpuid is available and can be >> checked to see whether we are a guest. > > What exactly do I need to check there? CPUID(4), leaf which, reg which? > How do I identify a xen hypervisor properly? You can use xen_cpuid_base(), for example. It will prevent microcode loading for all types of Xen guests (PV, HVM and, in the near future, PVH). Which I think is fine. This will require adding a #define for xen_cpu_base() for !CONFIG_XEN. Alternatively, if we think that no guest should ever load microcode, we could check for 'x86_hyper != 0'. This will be cleaner but I can't speak for KVM/VMware/Hyper-V. Neither of these solutions will work for load_ucode_bsp() because xen_cpuid_base() calls cpuid() (and so we are back to the above bug) and x86_hyper is not set yet. This is OK for Xen as PV guests never call load_ucode_bsp and HVM/PVH guests should be able to handle MSR accesses. > >> But I think it may be worthwhile trying to understand why we are >> dying, it hasn't happened until now. > > What for? We don't want to run the microcode loader on xen at all. True. But I don't think it's clear that the problem we are seeing is Xen-specific. -boris