From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B05C1C07E9B for ; Tue, 20 Jul 2021 03:54:39 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7C1DC611CE for ; Tue, 20 Jul 2021 03:54:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1349181AbhGTDNv (ORCPT ); Mon, 19 Jul 2021 23:13:51 -0400 Received: from mga03.intel.com ([134.134.136.65]:24179 "EHLO mga03.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348435AbhGTDJ6 (ORCPT ); Mon, 19 Jul 2021 23:09:58 -0400 X-IronPort-AV: E=McAfee;i="6200,9189,10050"; a="211229344" X-IronPort-AV: E=Sophos;i="5.84,254,1620716400"; d="scan'208";a="211229344" Received: from fmsmga005.fm.intel.com ([10.253.24.32]) by orsmga103.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 19 Jul 2021 20:49:29 -0700 X-IronPort-AV: E=Sophos;i="5.84,254,1620716400"; d="scan'208";a="661006658" Received: from ywei11-mobl1.amr.corp.intel.com (HELO skuppusw-desk1.amr.corp.intel.com) ([10.251.138.31]) by fmsmga005-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 19 Jul 2021 20:49:29 -0700 From: Kuppuswamy Sathyanarayanan To: Thomas Gleixner , Ingo Molnar , Borislav Petkov , Peter Zijlstra , Andy Lutomirski Cc: Peter H Anvin , Dave Hansen , Tony Luck , Dan Williams , Andi Kleen , Kirill Shutemov , Sean Christopherson , Kuppuswamy Sathyanarayanan , x86@kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v3 10/10] x86/tdx: Handle MWAIT and MONITOR Date: Mon, 19 Jul 2021 20:49:01 -0700 Message-Id: <20210720034901.2120205-11-sathyanarayanan.kuppuswamy@linux.intel.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210720034901.2120205-1-sathyanarayanan.kuppuswamy@linux.intel.com> References: <20210720034901.2120205-1-sathyanarayanan.kuppuswamy@linux.intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org When running as a TDX guest, there are a number of existing, privileged instructions that do not work. If the guest kernel uses these instructions, the hardware generates a #VE. You can find the list of unsupported instructions in Intel Trust Domain Extensions (Intel® TDX) Module specification, sec 9.2.2 and in Guest-Host Communication Interface (GHCI) Specification for Intel TDX, sec 2.4.1. To prevent TD guests from using MWAIT/MONITOR instructions, the CPUID flags for these instructions are already disabled by the TDX module.      After the above mentioned preventive measures, if TD guests still execute these instructions, add appropriate warning message (WARN_ONCE()) in #VE handler. This handling behavior is same as KVM (which also treats MWAIT/MONITOR as nops with warning once in unsupported platforms). Signed-off-by: Kuppuswamy Sathyanarayanan Reviewed-by: Andi Kleen Reviewed-by: Dan Williams --- Changes since v2: * None arch/x86/kernel/tdx.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/arch/x86/kernel/tdx.c b/arch/x86/kernel/tdx.c index ff38f19abbb8..92acccbce59c 100644 --- a/arch/x86/kernel/tdx.c +++ b/arch/x86/kernel/tdx.c @@ -363,6 +363,14 @@ int tdg_handle_virtualization_exception(struct pt_regs *regs, return -EFAULT; } break; + case EXIT_REASON_MONITOR_INSTRUCTION: + case EXIT_REASON_MWAIT_INSTRUCTION: + /* + * Something in the kernel used MONITOR or MWAIT despite + * X86_FEATURE_MWAIT being cleared for TDX guests. + */ + WARN_ONCE(1, "TD Guest used unsupported MWAIT/MONITOR instruction\n"); + break; default: pr_warn("Unexpected #VE: %lld\n", ve->exit_reason); return -EFAULT; -- 2.25.1