Commit bc6bc34b authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'x86_urgent_for_v6.2_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 

Pull x86 fixes from Borislav Petkov:

 - Start checking for -mindirect-branch-cs-prefix clang support too now
   that LLVM 16 will support it

 - Fix a NULL ptr deref when suspending with Xen PV

 - Have a SEV-SNP guest check explicitly for features enabled by the
   hypervisor and fail gracefully if some are unsupported by the guest
   instead of failing in a non-obvious and hard-to-debug way

 - Fix a MSI descriptor leakage under Xen

 - Mark Xen's MSI domain as supporting MSI-X

 - Prevent legacy PIC interrupts from being resent in software by
   marking them level triggered, as they should be, which lead to a NULL
   ptr deref

* tag 'x86_urgent_for_v6.2_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/build: Move '-mindirect-branch-cs-prefix' out of GCC-only block
  acpi: Fix suspend with Xen PV
  x86/sev: Add SEV-SNP guest feature negotiation support
  x86/pci/xen: Fixup fallout from the PCI/MSI overhaul
  x86/pci/xen: Set MSI_FLAG_PCI_MSIX support in Xen MSI domain
  x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL
parents 80826e90 27b5de62

Documentation/x86/amd-memory-encryption.rst

+36 −0
Original line number Diff line number Diff line
@@ -95,3 +95,39 @@ by supplying mem_encrypt=on on the kernel command line. However, if BIOS does 
not enable SME, then Linux will not be able to activate memory encryption, even

if configured to do so by default or the mem_encrypt=on command line parameter

is specified.



Secure Nested Paging (SNP)

==========================



SEV-SNP introduces new features (SEV_FEATURES[1:63]) which can be enabled

by the hypervisor for security enhancements. Some of these features need

guest side implementation to function correctly. The below table lists the

expected guest behavior with various possible scenarios of guest/hypervisor

SNP feature support.



+-----------------+---------------+---------------+------------------+

| Feature Enabled | Guest needs   | Guest has     | Guest boot       |

| by the HV       | implementation| implementation| behaviour        |

+=================+===============+===============+==================+

|      No         |      No       |      No       |     Boot         |

|                 |               |               |                  |

+-----------------+---------------+---------------+------------------+

|      No         |      Yes      |      No       |     Boot         |

|                 |               |               |                  |

+-----------------+---------------+---------------+------------------+

|      No         |      Yes      |      Yes      |     Boot         |

|                 |               |               |                  |

+-----------------+---------------+---------------+------------------+

|      Yes        |      No       |      No       | Boot with        |

|                 |               |               | feature enabled  |

+-----------------+---------------+---------------+------------------+

|      Yes        |      Yes      |      No       | Graceful boot    |

|                 |               |               | failure          |

+-----------------+---------------+---------------+------------------+

|      Yes        |      Yes      |      Yes      | Boot with        |

|                 |               |               | feature enabled  |

+-----------------+---------------+---------------+------------------+



More details in AMD64 APM[1] Vol 2: 15.34.10 SEV_STATUS MSR



[1] https://www.amd.com/system/files/TechDocs/40332.pdf

arch/x86/Makefile

+1 −1
Original line number Diff line number Diff line
@@ -14,13 +14,13 @@ endif 


ifdef CONFIG_CC_IS_GCC

RETPOLINE_CFLAGS	:= $(call cc-option,-mindirect-branch=thunk-extern -mindirect-branch-register)

RETPOLINE_CFLAGS	+= $(call cc-option,-mindirect-branch-cs-prefix)

RETPOLINE_VDSO_CFLAGS	:= $(call cc-option,-mindirect-branch=thunk-inline -mindirect-branch-register)

endif

ifdef CONFIG_CC_IS_CLANG

RETPOLINE_CFLAGS	:= -mretpoline-external-thunk

RETPOLINE_VDSO_CFLAGS	:= -mretpoline

endif

RETPOLINE_CFLAGS	+= $(call cc-option,-mindirect-branch-cs-prefix)



ifdef CONFIG_RETHUNK

RETHUNK_CFLAGS		:= -mfunction-return=thunk-extern

arch/x86/boot/compressed/ident_map_64.c

+6 −0
Original line number Diff line number Diff line
@@ -180,6 +180,12 @@ void initialize_identity_maps(void *rmode) 


	/* Load the new page-table. */

	write_cr3(top_level_pgt);



	/*

	 * Now that the required page table mappings are established and a

	 * GHCB can be used, check for SNP guest/HV feature compatibility.

	 */

	snp_check_features();

}



static pte_t *split_large_pmd(struct x86_mapping_info *info,

arch/x86/boot/compressed/misc.h

+2 −0
Original line number Diff line number Diff line
@@ -126,6 +126,7 @@ static inline void console_init(void) 


#ifdef CONFIG_AMD_MEM_ENCRYPT

void sev_enable(struct boot_params *bp);

void snp_check_features(void);

void sev_es_shutdown_ghcb(void);

extern bool sev_es_check_ghcb_fault(unsigned long address);

void snp_set_page_private(unsigned long paddr);
@@ -143,6 +144,7 @@ static inline void sev_enable(struct boot_params *bp) 
	if (bp)

		bp->cc_blob_address = 0;

}

static inline void snp_check_features(void) { }

static inline void sev_es_shutdown_ghcb(void) { }

static inline bool sev_es_check_ghcb_fault(unsigned long address)

{

arch/x86/boot/compressed/sev.c

+70 −0
Original line number Diff line number Diff line
@@ -208,6 +208,23 @@ void sev_es_shutdown_ghcb(void) 
		error("Can't unmap GHCB page");

}



static void __noreturn sev_es_ghcb_terminate(struct ghcb *ghcb, unsigned int set,

					     unsigned int reason, u64 exit_info_2)

{

	u64 exit_info_1 = SVM_VMGEXIT_TERM_REASON(set, reason);



	vc_ghcb_invalidate(ghcb);

	ghcb_set_sw_exit_code(ghcb, SVM_VMGEXIT_TERM_REQUEST);

	ghcb_set_sw_exit_info_1(ghcb, exit_info_1);

	ghcb_set_sw_exit_info_2(ghcb, exit_info_2);



	sev_es_wr_ghcb_msr(__pa(ghcb));

	VMGEXIT();



	while (true)

		asm volatile("hlt\n" : : : "memory");

}



bool sev_es_check_ghcb_fault(unsigned long address)

{

	/* Check whether the fault was on the GHCB page */
@@ -270,6 +287,59 @@ static void enforce_vmpl0(void) 
		sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_NOT_VMPL0);

}



/*

 * SNP_FEATURES_IMPL_REQ is the mask of SNP features that will need

 * guest side implementation for proper functioning of the guest. If any

 * of these features are enabled in the hypervisor but are lacking guest

 * side implementation, the behavior of the guest will be undefined. The

 * guest could fail in non-obvious way making it difficult to debug.

 *

 * As the behavior of reserved feature bits is unknown to be on the

 * safe side add them to the required features mask.

 */

#define SNP_FEATURES_IMPL_REQ	(MSR_AMD64_SNP_VTOM |			\

				 MSR_AMD64_SNP_REFLECT_VC |		\

				 MSR_AMD64_SNP_RESTRICTED_INJ |		\

				 MSR_AMD64_SNP_ALT_INJ |		\

				 MSR_AMD64_SNP_DEBUG_SWAP |		\

				 MSR_AMD64_SNP_VMPL_SSS |		\

				 MSR_AMD64_SNP_SECURE_TSC |		\

				 MSR_AMD64_SNP_VMGEXIT_PARAM |		\

				 MSR_AMD64_SNP_VMSA_REG_PROTECTION |	\

				 MSR_AMD64_SNP_RESERVED_BIT13 |		\

				 MSR_AMD64_SNP_RESERVED_BIT15 |		\

				 MSR_AMD64_SNP_RESERVED_MASK)



/*

 * SNP_FEATURES_PRESENT is the mask of SNP features that are implemented

 * by the guest kernel. As and when a new feature is implemented in the

 * guest kernel, a corresponding bit should be added to the mask.

 */

#define SNP_FEATURES_PRESENT (0)



void snp_check_features(void)

{

	u64 unsupported;



	if (!(sev_status & MSR_AMD64_SEV_SNP_ENABLED))

		return;



	/*

	 * Terminate the boot if hypervisor has enabled any feature lacking

	 * guest side implementation. Pass on the unsupported features mask through

	 * EXIT_INFO_2 of the GHCB protocol so that those features can be reported

	 * as part of the guest boot failure.

	 */

	unsupported = sev_status & SNP_FEATURES_IMPL_REQ & ~SNP_FEATURES_PRESENT;

	if (unsupported) {

		if (ghcb_version < 2 || (!boot_ghcb && !early_setup_ghcb()))

			sev_es_terminate(SEV_TERM_SET_GEN, GHCB_SNP_UNSUPPORTED);



		sev_es_ghcb_terminate(boot_ghcb, SEV_TERM_SET_GEN,

				      GHCB_SNP_UNSUPPORTED, unsupported);

	}

}



void sev_enable(struct boot_params *bp)

{

	unsigned int eax, ebx, ecx, edx;