linux-kernel - [PATCH 0/2] Fix AMD SEV guest boot issue with PCID feature

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <160514082171.31583.9995411273370528911.stgit@bmoger-ubuntu>
Date:   Wed, 11 Nov 2020 18:28:11 -0600
From:   Babu Moger <babu.moger@....com>
To:     pbonzini@...hat.com
Cc:     junaids@...gle.com, wanpengli@...cent.com, kvm@...r.kernel.org,
        joro@...tes.org, x86@...nel.org, linux-kernel@...r.kernel.org,
        sean.j.christopherson@...el.com, mingo@...hat.com, bp@...en8.de,
        hpa@...or.com, tglx@...utronix.de, vkuznets@...hat.com,
        jmattson@...gle.com
Subject: [PATCH 0/2] Fix AMD SEV guest boot issue with PCID feature

SEV guests fail to boot on systems that support the PCID feature.

The problem is observed with SMM enabled OVMF build. The guest
crashes with the following messages on the console while loading.

----------------------------------------------------------------------
[    0.264224] tsc: Marking TSC unstable due to TSCs unsynchronized
[    0.264946] Calibrating delay loop (skipped) preset value.. 3194.00
                                                 BogoMIPS (lpj=1597000)
[    0.265946] pid_max: default: 65536 minimum: 512
KVM internal error. Suberror: 1
emulation failure
EAX=00000000 EBX=00000000 ECX=00000000 EDX=00000000
ESI=00000000 EDI=7ffac000 EBP=00000000 ESP=7ffa1ff8
EIP=7ffb4280 EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0020 00000000 ffffffff 00c09300 DPL=0 DS   [-WA]
CS =0000 00000000 00000fff 00009b00 DPL=0 CS16 [-RA]
SS =0020 00000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0020 00000000 ffffffff 00c09300 DPL=0 DS   [-WA]
FS =0020 00000000 ffffffff 00c09300 DPL=0 DS   [-WA]
GS =0020 00000000 ffffffff 00c09300 DPL=0 DS   [-WA]
LDT=0000 00000000 00000000 00000000
TR =0040 00003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=ffff88817ffff000 CR3=0008000107e12000 CR4=000606b0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000
DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
----------------------------------------------------------------------

The issue is root caused to the way kvm tries to validate the cr3
address in kvm_set_cr3(). The cr3 address in SEV guests have the encryption
bit set. KVM fails because the reserved bit check fails on this address.

This series fixes the problem by introducing a new kvm_x86_ops callback
function to detect the encryption bit and mask it during the check.
---

Babu Moger (2):
      KVM: x86: Introduce mask_cr3_rsvd_bits to mask memory encryption bit
      KVM:SVM: Mask SEV encryption bit from CR3 reserved bits


 arch/x86/include/asm/kvm_host.h |    2 ++
 arch/x86/kvm/svm/svm.c          |   15 +++++++++++++++
 arch/x86/kvm/svm/svm.h          |    3 +++
 arch/x86/kvm/vmx/vmx.c          |    6 ++++++
 arch/x86/kvm/x86.c              |    3 ++-
 5 files changed, 28 insertions(+), 1 deletion(-)

--