* [tip: x86/urgent] x86/sev: Unroll string mmio with CC_ATTR_GUEST_UNROLL_STRING_IO [not found] <20220321093351.23976-1-joro@8bytes.org> @ 2022-03-24 11:55 ` tip-bot2 for Joerg Roedel 2022-03-29 14:38 ` tip-bot2 for Joerg Roedel 1 sibling, 0 replies; 3+ messages in thread From: tip-bot2 for Joerg Roedel @ 2022-03-24 11:55 UTC (permalink / raw) To: linux-tip-commits Cc: Joerg Roedel, Borislav Petkov, Tom Lendacky, x86, linux-kernel The following commit has been merged into the x86/urgent branch of tip: Commit-ID: fb96320e194066cd9a177989920e8854fa6c1537 Gitweb: https://git.kernel.org/tip/fb96320e194066cd9a177989920e8854fa6c1537 Author: Joerg Roedel <jroedel@suse.de> AuthorDate: Mon, 21 Mar 2022 10:33:51 +01:00 Committer: Borislav Petkov <bp@suse.de> CommitterDate: Thu, 24 Mar 2022 12:24:04 +01:00 x86/sev: Unroll string mmio with CC_ATTR_GUEST_UNROLL_STRING_IO The io-specific memcpy/memset functions use string mmio accesses to do their work. Under SEV, the hypervisor can't emulate these instructions because they read/write directly from/to encrypted memory. KVM will inject a page fault exception into the guest when it is asked to emulate string mmio instructions for an SEV guest: BUG: unable to handle page fault for address: ffffc90000065068 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 8000100000067 P4D 8000100000067 PUD 80001000fb067 PMD 80001000fc067 PTE 80000000fed40173 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.17.0-rc7 #3 As string mmio for an SEV guest can not be supported by the hypervisor, unroll the instructions for CC_ATTR_GUEST_UNROLL_STRING_IO enabled kernels. This issue appears when kernels are launched in recent libvirt-managed SEV virtual machines, because virt-install started to add a tpm-crb device to the guest by default and proactively because, raisins: https://github.com/virt-manager/virt-manager/commit/eb58c09f488b0633ed1eea012cd311e48864401e and as that commit says, the default adding of a TPM can be disabled with "virt-install ... --tpm none". The kernel driver for tpm-crb uses memcpy_to/from_io() functions to access MMIO memory, resulting in a page-fault injected by KVM and crashing the kernel at boot. [ bp: Massage and extend commit message. ] Fixes: d8aa7eea78a1 ('x86/mm: Add Secure Encrypted Virtualization (SEV) support') Signed-off-by: Joerg Roedel <jroedel@suse.de> Signed-off-by: Borislav Petkov <bp@suse.de> Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com> Link: https://lore.kernel.org/r/20220321093351.23976-1-joro@8bytes.org --- arch/x86/lib/iomem.c | 65 +++++++++++++++++++++++++++++++++++++------ 1 file changed, 57 insertions(+), 8 deletions(-) diff --git a/arch/x86/lib/iomem.c b/arch/x86/lib/iomem.c index df50451..6954193 100644 --- a/arch/x86/lib/iomem.c +++ b/arch/x86/lib/iomem.c @@ -22,7 +22,7 @@ static __always_inline void rep_movs(void *to, const void *from, size_t n) : "memory"); } -void memcpy_fromio(void *to, const volatile void __iomem *from, size_t n) +static void string_memcpy_fromio(void *to, const volatile void __iomem *from, size_t n) { if (unlikely(!n)) return; @@ -38,9 +38,8 @@ void memcpy_fromio(void *to, const volatile void __iomem *from, size_t n) } rep_movs(to, (const void *)from, n); } -EXPORT_SYMBOL(memcpy_fromio); -void memcpy_toio(volatile void __iomem *to, const void *from, size_t n) +static void string_memcpy_toio(volatile void __iomem *to, const void *from, size_t n) { if (unlikely(!n)) return; @@ -56,14 +55,64 @@ void memcpy_toio(volatile void __iomem *to, const void *from, size_t n) } rep_movs((void *)to, (const void *) from, n); } + +static void unrolled_memcpy_fromio(void *to, const volatile void __iomem *from, size_t n) +{ + const volatile char __iomem *in = from; + char *out = to; + int i; + + for (i = 0; i < n; ++i) + out[i] = in[i]; +} + +static void unrolled_memcpy_toio(volatile void __iomem *to, const void *from, size_t n) +{ + volatile char __iomem *out = to; + const char *in = from; + int i; + + for (i = 0; i < n; ++i) + out[i] = in[i]; +} + +static void unrolled_memset_io(volatile void __iomem *a, int b, size_t c) +{ + volatile char __iomem *mem = a; + int i; + + for (i = 0; i < c; ++i) + mem[i] = b; +} + +void memcpy_fromio(void *to, const volatile void __iomem *from, size_t n) +{ + if (cc_platform_has(CC_ATTR_GUEST_UNROLL_STRING_IO)) + unrolled_memcpy_fromio(to, from, n); + else + string_memcpy_fromio(to, from, n); +} +EXPORT_SYMBOL(memcpy_fromio); + +void memcpy_toio(volatile void __iomem *to, const void *from, size_t n) +{ + if (cc_platform_has(CC_ATTR_GUEST_UNROLL_STRING_IO)) + unrolled_memcpy_toio(to, from, n); + else + string_memcpy_toio(to, from, n); +} EXPORT_SYMBOL(memcpy_toio); void memset_io(volatile void __iomem *a, int b, size_t c) { - /* - * TODO: memset can mangle the IO patterns quite a bit. - * perhaps it would be better to use a dumb one: - */ - memset((void *)a, b, c); + if (cc_platform_has(CC_ATTR_GUEST_UNROLL_STRING_IO)) { + unrolled_memset_io(a, b, c); + } else { + /* + * TODO: memset can mangle the IO patterns quite a bit. + * perhaps it would be better to use a dumb one: + */ + memset((void *)a, b, c); + } } EXPORT_SYMBOL(memset_io); ^ permalink raw reply [flat|nested] 3+ messages in thread
* [tip: x86/urgent] x86/sev: Unroll string mmio with CC_ATTR_GUEST_UNROLL_STRING_IO [not found] <20220321093351.23976-1-joro@8bytes.org> 2022-03-24 11:55 ` [tip: x86/urgent] x86/sev: Unroll string mmio with CC_ATTR_GUEST_UNROLL_STRING_IO tip-bot2 for Joerg Roedel @ 2022-03-29 14:38 ` tip-bot2 for Joerg Roedel 2022-03-29 15:11 ` David Laight 1 sibling, 1 reply; 3+ messages in thread From: tip-bot2 for Joerg Roedel @ 2022-03-29 14:38 UTC (permalink / raw) To: linux-tip-commits Cc: Joerg Roedel, Borislav Petkov, Tom Lendacky, stable, x86, linux-kernel The following commit has been merged into the x86/urgent branch of tip: Commit-ID: 4009a4ac82dd95b8cd2b62bd30019476983f0aff Gitweb: https://git.kernel.org/tip/4009a4ac82dd95b8cd2b62bd30019476983f0aff Author: Joerg Roedel <jroedel@suse.de> AuthorDate: Mon, 21 Mar 2022 10:33:51 +01:00 Committer: Borislav Petkov <bp@suse.de> CommitterDate: Tue, 29 Mar 2022 15:59:16 +02:00 x86/sev: Unroll string mmio with CC_ATTR_GUEST_UNROLL_STRING_IO The io-specific memcpy/memset functions use string mmio accesses to do their work. Under SEV, the hypervisor can't emulate these instructions because they read/write directly from/to encrypted memory. KVM will inject a page fault exception into the guest when it is asked to emulate string mmio instructions for an SEV guest: BUG: unable to handle page fault for address: ffffc90000065068 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 8000100000067 P4D 8000100000067 PUD 80001000fb067 PMD 80001000fc067 PTE 80000000fed40173 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.17.0-rc7 #3 As string mmio for an SEV guest can not be supported by the hypervisor, unroll the instructions for CC_ATTR_GUEST_UNROLL_STRING_IO enabled kernels. This issue appears when kernels are launched in recent libvirt-managed SEV virtual machines, because virt-install started to add a tpm-crb device to the guest by default and proactively because, raisins: https://github.com/virt-manager/virt-manager/commit/eb58c09f488b0633ed1eea012cd311e48864401e and as that commit says, the default adding of a TPM can be disabled with "virt-install ... --tpm none". The kernel driver for tpm-crb uses memcpy_to/from_io() functions to access MMIO memory, resulting in a page-fault injected by KVM and crashing the kernel at boot. [ bp: Massage and extend commit message. ] Fixes: d8aa7eea78a1 ('x86/mm: Add Secure Encrypted Virtualization (SEV) support') Signed-off-by: Joerg Roedel <jroedel@suse.de> Signed-off-by: Borislav Petkov <bp@suse.de> Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20220321093351.23976-1-joro@8bytes.org --- arch/x86/lib/iomem.c | 65 +++++++++++++++++++++++++++++++++++++------ 1 file changed, 57 insertions(+), 8 deletions(-) diff --git a/arch/x86/lib/iomem.c b/arch/x86/lib/iomem.c index df50451..3e2f33f 100644 --- a/arch/x86/lib/iomem.c +++ b/arch/x86/lib/iomem.c @@ -22,7 +22,7 @@ static __always_inline void rep_movs(void *to, const void *from, size_t n) : "memory"); } -void memcpy_fromio(void *to, const volatile void __iomem *from, size_t n) +static void string_memcpy_fromio(void *to, const volatile void __iomem *from, size_t n) { if (unlikely(!n)) return; @@ -38,9 +38,8 @@ void memcpy_fromio(void *to, const volatile void __iomem *from, size_t n) } rep_movs(to, (const void *)from, n); } -EXPORT_SYMBOL(memcpy_fromio); -void memcpy_toio(volatile void __iomem *to, const void *from, size_t n) +static void string_memcpy_toio(volatile void __iomem *to, const void *from, size_t n) { if (unlikely(!n)) return; @@ -56,14 +55,64 @@ void memcpy_toio(volatile void __iomem *to, const void *from, size_t n) } rep_movs((void *)to, (const void *) from, n); } + +static void unrolled_memcpy_fromio(void *to, const volatile void __iomem *from, size_t n) +{ + const volatile char __iomem *in = from; + char *out = to; + int i; + + for (i = 0; i < n; ++i) + out[i] = readb(&in[i]); +} + +static void unrolled_memcpy_toio(volatile void __iomem *to, const void *from, size_t n) +{ + volatile char __iomem *out = to; + const char *in = from; + int i; + + for (i = 0; i < n; ++i) + writeb(in[i], &out[i]); +} + +static void unrolled_memset_io(volatile void __iomem *a, int b, size_t c) +{ + volatile char __iomem *mem = a; + int i; + + for (i = 0; i < c; ++i) + writeb(b, &mem[i]); +} + +void memcpy_fromio(void *to, const volatile void __iomem *from, size_t n) +{ + if (cc_platform_has(CC_ATTR_GUEST_UNROLL_STRING_IO)) + unrolled_memcpy_fromio(to, from, n); + else + string_memcpy_fromio(to, from, n); +} +EXPORT_SYMBOL(memcpy_fromio); + +void memcpy_toio(volatile void __iomem *to, const void *from, size_t n) +{ + if (cc_platform_has(CC_ATTR_GUEST_UNROLL_STRING_IO)) + unrolled_memcpy_toio(to, from, n); + else + string_memcpy_toio(to, from, n); +} EXPORT_SYMBOL(memcpy_toio); void memset_io(volatile void __iomem *a, int b, size_t c) { - /* - * TODO: memset can mangle the IO patterns quite a bit. - * perhaps it would be better to use a dumb one: - */ - memset((void *)a, b, c); + if (cc_platform_has(CC_ATTR_GUEST_UNROLL_STRING_IO)) { + unrolled_memset_io(a, b, c); + } else { + /* + * TODO: memset can mangle the IO patterns quite a bit. + * perhaps it would be better to use a dumb one: + */ + memset((void *)a, b, c); + } } EXPORT_SYMBOL(memset_io); ^ permalink raw reply [flat|nested] 3+ messages in thread
* RE: [tip: x86/urgent] x86/sev: Unroll string mmio with CC_ATTR_GUEST_UNROLL_STRING_IO 2022-03-29 14:38 ` tip-bot2 for Joerg Roedel @ 2022-03-29 15:11 ` David Laight 0 siblings, 0 replies; 3+ messages in thread From: David Laight @ 2022-03-29 15:11 UTC (permalink / raw) To: linux-kernel, linux-tip-commits Cc: Joerg Roedel, Borislav Petkov, Tom Lendacky, stable, x86 Isn't this patch entirely broken? Even the 'normal' kernel functions are broken. memcpy_toio() and memcpy_fromio() need to be using 64bit accesses to IO space. They used to be implemented using memcpy() - but that can end up being 'rep movsb' which is always byte copies on uncached memory. I thought that had been fixed to used a better copy loop. David > -----Original Message----- > From: tip-bot2@linutronix.de <tip-bot2@linutronix.de> > Sent: 29 March 2022 15:39 > To: linux-tip-commits@vger.kernel.org > Cc: Joerg Roedel <jroedel@suse.de>; Borislav Petkov <bp@suse.de>; Tom Lendacky > <thomas.lendacky@amd.com>; stable@vger.kernel.org; x86@kernel.org; linux-kernel@vger.kernel.org > Subject: [tip: x86/urgent] x86/sev: Unroll string mmio with CC_ATTR_GUEST_UNROLL_STRING_IO > > The following commit has been merged into the x86/urgent branch of tip: > > Commit-ID: 4009a4ac82dd95b8cd2b62bd30019476983f0aff > Gitweb: https://git.kernel.org/tip/4009a4ac82dd95b8cd2b62bd30019476983f0aff > Author: Joerg Roedel <jroedel@suse.de> > AuthorDate: Mon, 21 Mar 2022 10:33:51 +01:00 > Committer: Borislav Petkov <bp@suse.de> > CommitterDate: Tue, 29 Mar 2022 15:59:16 +02:00 > > x86/sev: Unroll string mmio with CC_ATTR_GUEST_UNROLL_STRING_IO > > The io-specific memcpy/memset functions use string mmio accesses to do > their work. Under SEV, the hypervisor can't emulate these instructions > because they read/write directly from/to encrypted memory. > > KVM will inject a page fault exception into the guest when it is asked > to emulate string mmio instructions for an SEV guest: > > BUG: unable to handle page fault for address: ffffc90000065068 > #PF: supervisor read access in kernel mode > #PF: error_code(0x0000) - not-present page > PGD 8000100000067 P4D 8000100000067 PUD 80001000fb067 PMD 80001000fc067 PTE 80000000fed40173 > Oops: 0000 [#1] PREEMPT SMP NOPTI > CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.17.0-rc7 #3 > > As string mmio for an SEV guest can not be supported by the > hypervisor, unroll the instructions for CC_ATTR_GUEST_UNROLL_STRING_IO > enabled kernels. > > This issue appears when kernels are launched in recent libvirt-managed > SEV virtual machines, because virt-install started to add a tpm-crb > device to the guest by default and proactively because, raisins: > > https://github.com/virt-manager/virt-manager/commit/eb58c09f488b0633ed1eea012cd311e48864401e > > and as that commit says, the default adding of a TPM can be disabled > with "virt-install ... --tpm none". > > The kernel driver for tpm-crb uses memcpy_to/from_io() functions to > access MMIO memory, resulting in a page-fault injected by KVM and > crashing the kernel at boot. > > [ bp: Massage and extend commit message. ] > > Fixes: d8aa7eea78a1 ('x86/mm: Add Secure Encrypted Virtualization (SEV) support') > Signed-off-by: Joerg Roedel <jroedel@suse.de> > Signed-off-by: Borislav Petkov <bp@suse.de> > Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com> > Cc: <stable@vger.kernel.org> > Link: https://lore.kernel.org/r/20220321093351.23976-1-joro@8bytes.org > --- > arch/x86/lib/iomem.c | 65 +++++++++++++++++++++++++++++++++++++------ > 1 file changed, 57 insertions(+), 8 deletions(-) > > diff --git a/arch/x86/lib/iomem.c b/arch/x86/lib/iomem.c > index df50451..3e2f33f 100644 > --- a/arch/x86/lib/iomem.c > +++ b/arch/x86/lib/iomem.c > @@ -22,7 +22,7 @@ static __always_inline void rep_movs(void *to, const void *from, size_t n) > : "memory"); > } > > -void memcpy_fromio(void *to, const volatile void __iomem *from, size_t n) > +static void string_memcpy_fromio(void *to, const volatile void __iomem *from, size_t n) > { > if (unlikely(!n)) > return; > @@ -38,9 +38,8 @@ void memcpy_fromio(void *to, const volatile void __iomem *from, size_t n) > } > rep_movs(to, (const void *)from, n); > } > -EXPORT_SYMBOL(memcpy_fromio); > > -void memcpy_toio(volatile void __iomem *to, const void *from, size_t n) > +static void string_memcpy_toio(volatile void __iomem *to, const void *from, size_t n) > { > if (unlikely(!n)) > return; > @@ -56,14 +55,64 @@ void memcpy_toio(volatile void __iomem *to, const void *from, size_t n) > } > rep_movs((void *)to, (const void *) from, n); > } > + > +static void unrolled_memcpy_fromio(void *to, const volatile void __iomem *from, size_t n) > +{ > + const volatile char __iomem *in = from; > + char *out = to; > + int i; > + > + for (i = 0; i < n; ++i) > + out[i] = readb(&in[i]); > +} > + > +static void unrolled_memcpy_toio(volatile void __iomem *to, const void *from, size_t n) > +{ > + volatile char __iomem *out = to; > + const char *in = from; > + int i; > + > + for (i = 0; i < n; ++i) > + writeb(in[i], &out[i]); > +} > + > +static void unrolled_memset_io(volatile void __iomem *a, int b, size_t c) > +{ > + volatile char __iomem *mem = a; > + int i; > + > + for (i = 0; i < c; ++i) > + writeb(b, &mem[i]); > +} > + > +void memcpy_fromio(void *to, const volatile void __iomem *from, size_t n) > +{ > + if (cc_platform_has(CC_ATTR_GUEST_UNROLL_STRING_IO)) > + unrolled_memcpy_fromio(to, from, n); > + else > + string_memcpy_fromio(to, from, n); > +} > +EXPORT_SYMBOL(memcpy_fromio); > + > +void memcpy_toio(volatile void __iomem *to, const void *from, size_t n) > +{ > + if (cc_platform_has(CC_ATTR_GUEST_UNROLL_STRING_IO)) > + unrolled_memcpy_toio(to, from, n); > + else > + string_memcpy_toio(to, from, n); > +} > EXPORT_SYMBOL(memcpy_toio); > > void memset_io(volatile void __iomem *a, int b, size_t c) > { > - /* > - * TODO: memset can mangle the IO patterns quite a bit. > - * perhaps it would be better to use a dumb one: > - */ > - memset((void *)a, b, c); > + if (cc_platform_has(CC_ATTR_GUEST_UNROLL_STRING_IO)) { > + unrolled_memset_io(a, b, c); > + } else { > + /* > + * TODO: memset can mangle the IO patterns quite a bit. > + * perhaps it would be better to use a dumb one: > + */ > + memset((void *)a, b, c); > + } > } > EXPORT_SYMBOL(memset_io); - Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales) ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-03-29 15:11 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <20220321093351.23976-1-joro@8bytes.org>
2022-03-24 11:55 ` [tip: x86/urgent] x86/sev: Unroll string mmio with CC_ATTR_GUEST_UNROLL_STRING_IO tip-bot2 for Joerg Roedel
2022-03-29 14:38 ` tip-bot2 for Joerg Roedel
2022-03-29 15:11 ` David Laight
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®