linux-kernel - [tip: x86/tdx] x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <174297615961.14745.3991954793932889948.tip-bot2@tip-bot2>
Date: Wed, 26 Mar 2025 08:02:39 -0000
From: "tip-bot2 for Vishal Annapurve" <tip-bot2@...utronix.de>
To: linux-tip-commits@...r.kernel.org
Cc: Vishal Annapurve <vannapurve@...gle.com>, Ingo Molnar <mingo@...nel.org>,
 "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
 Ryan Afranji <afranji@...gle.com>, Andy Lutomirski <luto@...nel.org>,
 Brian Gerst <brgerst@...il.com>, Juergen Gross <jgross@...e.com>,
 "H. Peter Anvin" <hpa@...or.com>,
 Linus Torvalds <torvalds@...ux-foundation.org>,
 Josh Poimboeuf <jpoimboe@...hat.com>, x86@...nel.org,
 linux-kernel@...r.kernel.org
Subject: [tip: x86/tdx] x86/tdx: Emit warning if IRQs are enabled during HLT
 #VE handling

The following commit has been merged into the x86/tdx branch of tip:

Commit-ID:     e8f45927ee5d99fa52f14205a2c7ac3820c64457
Gitweb:        https://git.kernel.org/tip/e8f45927ee5d99fa52f14205a2c7ac3820c64457
Author:        Vishal Annapurve <vannapurve@...gle.com>
AuthorDate:    Fri, 28 Feb 2025 01:44:16 
Committer:     Ingo Molnar <mingo@...nel.org>
CommitterDate: Wed, 26 Mar 2025 08:52:10 +01:00

x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling

Direct HLT instruction execution causes #VEs for TDX VMs which is routed
to hypervisor via TDCALL. safe_halt() routines execute HLT in STI-shadow
so IRQs need to remain disabled until the TDCALL to ensure that pending
IRQs are correctly treated as wake events.

Emit warning and fail emulation if IRQs are enabled during HLT #VE handling
to avoid running into scenarios where IRQ wake events are lost resulting in
indefinite HLT execution times.

Signed-off-by: Vishal Annapurve <vannapurve@...gle.com>
Signed-off-by: Ingo Molnar <mingo@...nel.org>
Reviewed-by: Kirill A. Shutemov <kirill.shutemov@...ux.intel.com>
Tested-by: Ryan Afranji <afranji@...gle.com>
Cc: Andy Lutomirski <luto@...nel.org>
Cc: Brian Gerst <brgerst@...il.com>
Cc: Juergen Gross <jgross@...e.com>
Cc: H. Peter Anvin <hpa@...or.com>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Josh Poimboeuf <jpoimboe@...hat.com>
Link: https://lore.kernel.org/r/20250228014416.3925664-4-vannapurve@google.com
---
 arch/x86/coco/tdx/tdx.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c
index aa0eb40..edab6d6 100644
--- a/arch/x86/coco/tdx/tdx.c
+++ b/arch/x86/coco/tdx/tdx.c
@@ -393,6 +393,14 @@ static int handle_halt(struct ve_info *ve)
 {
 	const bool irq_disabled = irqs_disabled();

+	/*
+	 * HLT with IRQs enabled is unsafe, as an IRQ that is intended to be a
+	 * wake event may be consumed before requesting HLT emulation, leaving
+	 * the vCPU blocking indefinitely.
+	 */
+	if (WARN_ONCE(!irq_disabled, "HLT emulation with IRQs enabled"))
+		return -EIO;
+
 	if (__halt(irq_disabled))
 		return -EIO;