Messages in this thread | ![/](/images/icornerl.gif) | | Date | Mon, 29 Apr 2024 16:17:38 +0300 | From | "Kirill A. Shutemov" <> | Subject | Re: [PATCHv10 05/18] x86/kexec: Keep CR4.MCE set during kexec for TDX guest |
| |
On Sun, Apr 28, 2024 at 07:11:11PM +0200, Borislav Petkov wrote: > On Tue, Apr 09, 2024 at 06:26:05PM +0300, Kirill A. Shutemov wrote: > > From 6be428e3b1c6fb494b2c48ba6a7c133514a0b2b4 Mon Sep 17 00:00:00 2001 > > From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com> > > Date: Fri, 10 Feb 2023 12:53:11 +0300 > > Subject: [PATCHv10.1 05/18] x86/kexec: Keep CR4.MCE set during kexec for TDX guest > > > > Depending on setup, TDX guests might be allowed to clear CR4.MCE. > > Attempt to clear it leads to #VE. > > > > Use alternatives to keep the flag during kexec for TDX guests. > > > > The change doesn't affect non-TDX-guest environments. > > This is all fine and dandy but nothing explains *why* TDX needs this > special dance. > > Why can't TDX do the usual CR4.MCE diddling like the normal kernel > during init and needs to do that here immediately?
As I mentioned above, clearing CR4.MCE triggers #VE. It is quirk of the platform.
There's plan to allow it in newer TDX modules, but kernel still has to assume we cannot touch it in TDX guest case.
> > Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> > > --- > > arch/x86/kernel/relocate_kernel_64.S | 15 +++++++++------ > > 1 file changed, 9 insertions(+), 6 deletions(-) > > > > diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S > > index 56cab1bb25f5..90246d544eb1 100644 > > --- a/arch/x86/kernel/relocate_kernel_64.S > > +++ b/arch/x86/kernel/relocate_kernel_64.S > > @@ -5,6 +5,8 @@ > > */ > > > > #include <linux/linkage.h> > > +#include <linux/stringify.h> > > +#include <asm/alternative.h> > > #include <asm/page_types.h> > > #include <asm/kexec.h> > > #include <asm/processor-flags.h> > > @@ -143,14 +145,15 @@ SYM_CODE_START_LOCAL_NOALIGN(identity_mapped) > > > > /* > > * Set cr4 to a known state: > > - * - physical address extension enabled > > * - 5-level paging, if it was enabled before > > + * - Machine check exception on TDX guest, if it was enabled before. > > + * Clearing MCE might not allowed in TDX guests, depending on setup. > > ... might not be allowed ... >
Oopsie. Thanks.
> > + * - physical address extension enabled > > */ > > - movl $X86_CR4_PAE, %eax > > - testq $X86_CR4_LA57, %r13 > > - jz 1f > > - orl $X86_CR4_LA57, %eax > > -1: > > + movl $X86_CR4_LA57, %eax > > + ALTERNATIVE "", __stringify(orl $X86_CR4_MCE, %eax), X86_FEATURE_TDX_GUEST > > + andl %r13d, %eax > > %r13 needs a comment here that it contains %cr4 read above in > relocate_kernel()
Okay.
-- Kiryl Shutsemau / Kirill A. Shutemov
| ![\](/images/icornerr.gif) |