From patchwork Wed Oct 26 23:16:10 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Huang, Kai" X-Patchwork-Id: 13021359 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2BD1FC38A2D for ; Wed, 26 Oct 2022 23:17:54 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 1A72F8E0009; Wed, 26 Oct 2022 19:17:53 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 10B4D8E0001; Wed, 26 Oct 2022 19:17:52 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id CF11F8E0009; Wed, 26 Oct 2022 19:17:52 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id BF2CC8E0001 for ; Wed, 26 Oct 2022 19:17:52 -0400 (EDT) Received: from smtpin11.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id 98BA680F92 for ; Wed, 26 Oct 2022 23:17:52 +0000 (UTC) X-FDA: 80064665184.11.11A1EDB Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by imf16.hostedemail.com (Postfix) with ESMTP id E82CF180002 for ; Wed, 26 Oct 2022 23:17:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1666826272; x=1698362272; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=ZngkJ1hy62z1ZJ9j+OUr9HiZ6dC7QfTSzP7zLtYV5ys=; b=B69eRX0A45U91JfpytKgQpzgnfnyExK0/FNY6TWkK2RK7RQB3+a05jZr aPeq0sBA7jbdT2/4Xigw6NEX/ZKML0BLCmIcO9oGXRDRXuXW2JHryvmdL 9u464GvFtO3AxHFU2/J6NU283OI+ASMnvNaIBeJpDaWJ06H7IJOnX2k3Y NuFJkoz/ettTp4Zmhuz/IpnuoDAcP6Zbzq1J+GU57JPBRG/mEavi39z3L Mu+JffXgLzSHNjJOW8XDZqItWiUS092gHts8eWNk8m5ck2rxkIF4xdz0a rXMW3w8tmRowD9FYu7xCcE5w5gHNgglTw6xJdvG2KXVWV8KsP5LcFiB17 Q==; X-IronPort-AV: E=McAfee;i="6500,9779,10512"; a="394400377" X-IronPort-AV: E=Sophos;i="5.95,215,1661842800"; d="scan'208";a="394400377" Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 26 Oct 2022 16:17:45 -0700 X-IronPort-AV: E=McAfee;i="6500,9779,10512"; a="737446374" X-IronPort-AV: E=Sophos;i="5.95,215,1661842800"; d="scan'208";a="737446374" Received: from fordon1x-mobl.amr.corp.intel.com (HELO khuang2-desk.gar.corp.intel.com) ([10.212.24.177]) by fmsmga002-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 26 Oct 2022 16:17:41 -0700 From: Kai Huang To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: linux-mm@kvack.org, seanjc@google.com, pbonzini@redhat.com, dave.hansen@intel.com, dan.j.williams@intel.com, rafael.j.wysocki@intel.com, kirill.shutemov@linux.intel.com, reinette.chatre@intel.com, len.brown@intel.com, tony.luck@intel.com, peterz@infradead.org, ak@linux.intel.com, isaku.yamahata@intel.com, chao.gao@intel.com, sathyanarayanan.kuppuswamy@linux.intel.com, bagasdotme@gmail.com, sagis@google.com, imammedo@redhat.com, kai.huang@intel.com Subject: [PATCH v6 11/21] x86/virt/tdx: Sanity check all TDX memory ranges are convertible memory Date: Thu, 27 Oct 2022 12:16:10 +1300 Message-Id: <27f99598d368dc24fbd2bdb9a79247a8dc3039e9.1666824663.git.kai.huang@intel.com> X-Mailer: git-send-email 2.37.3 In-Reply-To: References: MIME-Version: 1.0 ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1666826272; a=rsa-sha256; cv=none; b=px4P6jPR9qJg0OrQEyZmfduDnqGzCWBvS1NNgK72ku1NCZ+nleDbs3eqxS4PQ/8LVgATGp v3OhQ5jIPC9elN/wqn5JL579Cvj4OBqNgrs79Kq593jQ0R9xS+8OcPybV+goqlA7f4tvlv T6VOLZkgkCXSO6VN/8bp4W9AlHheg3k= ARC-Authentication-Results: i=1; imf16.hostedemail.com; dkim=none ("invalid DKIM record") header.d=intel.com header.s=Intel header.b=B69eRX0A; dmarc=pass (policy=none) header.from=intel.com; spf=pass (imf16.hostedemail.com: domain of kai.huang@intel.com designates 192.55.52.43 as permitted sender) smtp.mailfrom=kai.huang@intel.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1666826272; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=znmRJ2BbdrQ9c5LRvUBC3pdZzNU8KADNNeWy7i8E9l8=; b=L8OB8GA5PetOYXDGdHHhyoNrAE3/xnuLDVhVNamvJR8txgVPN22Wyf4lcQ/Zhou7mNp8WM Lt1cyaehWCJcO/TuLOfpuOoHBLinAEwxNi669rP9eG/R3337FKSd1rGCGABsX45H7l1waq mngT+YPQEnGeQlqiEkRTlswpCPIj1a0= X-Rspam-User: Authentication-Results: imf16.hostedemail.com; dkim=none ("invalid DKIM record") header.d=intel.com header.s=Intel header.b=B69eRX0A; dmarc=pass (policy=none) header.from=intel.com; spf=pass (imf16.hostedemail.com: domain of kai.huang@intel.com designates 192.55.52.43 as permitted sender) smtp.mailfrom=kai.huang@intel.com X-Rspamd-Server: rspam11 X-Stat-Signature: jzryr7tkd3epd4m13cajngpizzn59bkm X-Rspamd-Queue-Id: E82CF180002 X-HE-Tag: 1666826271-7534 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: All TDX-usable memory ranges were built during early kernel boot, and they were not verified that they are truly convertible memory since CMRs were not available until now. Explicitly check all TDX memory ranges to make sure they are convertible memory before passing those ranges to the TDX module. Signed-off-by: Kai Huang --- v5 -> v6: - Added a comment to explain two contiguous CMRs case (Isaku). - Rebase due to using 'tdx_memblock' to represent TDX memory, thus removed using memblock directly, and the handling of excluding first 1MB as TDX memory. v3 -> v4 (no feedback on v4): - Changed to use memblock from e820. - Simplified changelog a lot. --- arch/x86/virt/vmx/tdx/tdx.c | 61 +++++++++++++++++++++++++++++++++++++ 1 file changed, 61 insertions(+) diff --git a/arch/x86/virt/vmx/tdx/tdx.c b/arch/x86/virt/vmx/tdx/tdx.c index 7d7205615873..ff3ef7ed4509 100644 --- a/arch/x86/virt/vmx/tdx/tdx.c +++ b/arch/x86/virt/vmx/tdx/tdx.c @@ -483,6 +483,59 @@ static int tdx_get_sysinfo(void) return check_cmrs(tdx_cmr_array, &tdx_cmr_num); } +/* Check whether the first range is the subrange of the second */ +static bool is_subrange(u64 r1_start, u64 r1_end, u64 r2_start, u64 r2_end) +{ + return r1_start >= r2_start && r1_end <= r2_end; +} + +/* Check whether the address range is covered by any CMR or not. */ +static bool range_covered_by_cmr(struct cmr_info *cmr_array, int cmr_num, + u64 start, u64 end) +{ + int i; + + for (i = 0; i < cmr_num; i++) { + struct cmr_info *cmr = &cmr_array[i]; + + if (is_subrange(start, end, cmr->base, cmr->base + cmr->size)) + return true; + } + + return false; +} + +/* + * Check whether all memory regions in memblock are TDX convertible + * memory. Return 0 if all memory regions are convertible, or error. + */ +static int sanity_check_tdx_memory(void) +{ + struct tdx_memblock *tmb; + + list_for_each_entry(tmb, &tdx_memlist, list) { + u64 start = tmb->start_pfn << PAGE_SHIFT; + u64 end = tmb->end_pfn << PAGE_SHIFT; + + /* + * Note: The spec doesn't say two CMRs cannot be + * contiguous. Theoretically a memory region crossing + * two contiguous CMRs (but still falls into the two + * CMRs) should be treated as covered by CMR. But this + * is purely theoretically thing that doesn't occur in + * practice. + */ + if (!range_covered_by_cmr(tdx_cmr_array, tdx_cmr_num, start, + end)) { + pr_err("[0x%llx, 0x%llx) is not fully convertible memory\n", + start, end); + return -EINVAL; + } + } + + return 0; +} + /* * Detect and initialize the TDX module. * @@ -511,6 +564,14 @@ static int init_tdx_module(void) if (ret) goto out; + /* + * TDX memory ranges were built during kernel boot. Need to + * make sure all those ranges are truly convertible memory + * before passing them to the TDX module. + */ + ret = sanity_check_tdx_memory(); + if (ret) + goto out; /* * Return -EINVAL until all steps of TDX module initialization * process are done.