Received-SPF: pass (google.com: domain of linux-kernel+bounces-42532-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Message-ID: <f0677a02-72ea-49e8-9499-18eca6b5e8d7@amd.com>
Date: Mon, 29 Jan 2024 04:24:09 -0600
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCHv6 10/16] x86/tdx: Convert shared memory back to private on
 kexec
Content-Language: en-US
To: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>,
 Thomas Gleixner <tglx@linutronix.de>, Ingo Molnar <mingo@redhat.com>,
 Borislav Petkov <bp@alien8.de>, Dave Hansen <dave.hansen@linux.intel.com>,
 x86@kernel.org
Cc: "Rafael J. Wysocki" <rafael@kernel.org>,
 Peter Zijlstra <peterz@infradead.org>,
 Adrian Hunter <adrian.hunter@intel.com>,
 Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>,
 Elena Reshetova <elena.reshetova@intel.com>,
 Jun Nakajima <jun.nakajima@intel.com>,
 Rick Edgecombe <rick.p.edgecombe@intel.com>,
 Tom Lendacky <thomas.lendacky@amd.com>,
 Sean Christopherson <seanjc@google.com>, "Huang, Kai" <kai.huang@intel.com>,
 Baoquan He <bhe@redhat.com>, kexec@lists.infradead.org,
 linux-coco@lists.linux.dev, linux-kernel@vger.kernel.org
References: <20240124125557.493675-1-kirill.shutemov@linux.intel.com>
 <20240124125557.493675-11-kirill.shutemov@linux.intel.com>
From: "Kalra, Ashish" <ashish.kalra@amd.com>
In-Reply-To: <20240124125557.493675-11-kirill.shutemov@linux.intel.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?utf-8?B?UkNyc25oNHBNTUVLZzk1Q1hIeVhuQm85cDZZcVpsTjl4K0ZiVGh2eXA0UUhx?=
 =?utf-8?B?a2U0WDg4VkJCNWdWNDh5MkhWbkNqV0FteVFubTFzVDcrelp5T2h1T0ZrOFZo?=
 =?utf-8?B?dVNQTm9MQ3Y2eWNLYjBYWGVqaFY2c2pKZ2N0Qi9NYy81RDNlSnRYclRmcnQw?=
 =?utf-8?B?RmtjbnJIVjJoWmZ5U3dpV3cwZU5tbDM3MTVrYlpSeHpJYTc2MGp3Uis5eEhv?=
 =?utf-8?B?ZG1ORTVjd3Vra1BSdGhqWEZyL1JQVnNjdGFhSzdpRzQxV1V1MFJtNi9OUWpD?=
 =?utf-8?B?TzhtRlgyM0ZFM2J6aitaZEFRSWNMc1M1V0N4d1cvUm41R0IyOHcvYjhiVVZo?=
 =?utf-8?B?VFMwWkdKN09GVW94RGh0bm5LYStacURyY0dPZnRCOUhicUl1b2hVU1VCY2dI?=
 =?utf-8?B?enA4RkJ1YVVpQlcxd1NRM1VvL3lxRk84SFpIMHRVQkRMVEVOWno4NXprVFF6?=
 =?utf-8?B?aWpHbU5kdFU3a1dpVU5XVGVQdVZPQm9LWEpjd2JuczcyVnpkc1N6Q1RYVEJX?=
 =?utf-8?B?czVuVG9RZ09LcXZEVW5CRkJkOGdUMmUrcFlnU2N5OFZrVStwRUVVaStzSW9r?=
 =?utf-8?B?SlJrdjVqb280dHNzMEtIUFdLaVRUSGJiWWdrRXRXM2pNTExvZUhwZzBvRHFo?=
 =?utf-8?B?MUF6K09KRmYxNmVYTlU2Yll3WXNNR3NMRW5CaEl0RjlsQWpoNWVkNVYrN00x?=
 =?utf-8?B?anZFMUM4OStIRXlQUHZYMlAxSTdWYWFYNWttVlpNcDZ3bHJtWFQzUnhGYVV4?=
 =?utf-8?B?ZHFaWUhhajRzaUpWNEp4UUZCcEVwLzRDTWFQU1UxTVlOZDRCVmRoMlVMckZs?=
 =?utf-8?B?c2I4bS8rUithenJmUDRNTGZpVmFzZ1RRV2hVYTNFMVFsUEFnbHZWZnRLN0c3?=
 =?utf-8?B?NjYxWEtuTStEYkZDekRGN2ZlRlFZcGpUalZKcnBZY0Z0THJ6bHk2UnhHa2pn?=
 =?utf-8?B?bTlZWm94SHRZNDliTXp3OEk2UXE2VHFMOG1SV0JjVVpqbS96c2hkYzcrVVJw?=
 =?utf-8?B?THV4T2J1T1lkUEVXOG1qZk9mUG12MFJxZVFBUzl1bytaMzhPNHEvTFY3WlNY?=
 =?utf-8?B?dFJianF6WGVsaTd5c3kvM21XL0RnTEtIK1I4Wk8vTTNXdWtvSmVsNTR0MGpP?=
 =?utf-8?B?Yk5mQlVFb0hRNWducWJOY1UvNGRrMlI1eHA0Z0pVWmhxd2l6ak5SVG1JanJG?=
 =?utf-8?B?MkJlWTAvZVp3SlY5bFVuRmx6eTJiMzdwSTE2QWp2SmVsaGcwcVVFMUxHcHll?=
 =?utf-8?B?a1ROWjVJRVdJVXJXbW5LYXE2YW8vQ0pGTUZ3cjVabzB0Y01pZFlVVFAreEkv?=
 =?utf-8?B?bGU1THNyenNFU2pkakl1Z2hMVUpsaG1iWnlCTHNGVm5xc3B5bVRJRkNoT3Z1?=
 =?utf-8?B?aHlPb1ZNckJ5cjNDTFFYM1Q4eElEMDlSYUZwTHN6d25LZ1FjODBIY3Bha0wr?=
 =?utf-8?B?TXJ0cGk4Lzk1N2VXR1dOTVY2bE5iMzNmeEx6azVjQS8wWXdFUEtpOTNSL21Z?=
 =?utf-8?B?bHd1MVl0bk1pOE5xREtTdzVxdUp1ZER2TlE2R1QvN1RMbVk1VnRjSU0zMzBk?=
 =?utf-8?B?Q0c3a0hqMFdvWmZUYjU4YU1TdlN0UVEwZFpMdnRxWDVocTEvR2ZBZE5Yb3lV?=
 =?utf-8?B?ZG5QU1ZuWnhqSGNOSDZqdUNwRmlJOHZKb3pKKzBFaFlkWVRkUTUyYjArYnlQ?=
 =?utf-8?B?MldvSjN1MEJXY3lFT2lOQUNXRUFlclI2V1MrWnJtK0Z3WC8xNnRhNnpoTnRT?=
 =?utf-8?B?YnhiYlhhS1dldlU1VXlHbkdiU3g1VGo5QU1ybUtpUnhDYmhVaDhSQ2JkaHF0?=
 =?utf-8?B?Vit1MWkwYXRhMit4TFVBWHRCQnFTMjFNdjJQRVNLdFhXY0psL1BqT1NRR3RF?=
 =?utf-8?B?Z0dJMkY5SHR1bmQ0OXFqVHJHTGo3V0V0a1FkaEZCbktxWkp0Z0UwdXVMSEhS?=
 =?utf-8?B?SVIvNXBieUl6SE1yZGJ1UnJVcUZNVVludlB2VVZvcGRiZkFneTlyUjdZTi9O?=
 =?utf-8?B?ZGRWb1ZTbEI2NWhMUStmcVp1TG95b29zd2VyajliQ21pUTBxSCtBNjZQU3Rr?=
 =?utf-8?B?WUlvV29JclBOQ09GbGRNeWNuRVA1L2RTL0hZaVdKWkJOMVRMYkYxMExKcTc0?=
 =?utf-8?Q?ajPBz/FiCb32sNpAtMIh8svid?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: f49f9a85-3874-45e1-f9c6-08dc20b46fbf
X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2767.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Jan 2024 10:24:12.2543
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: z8irIUsZn7sFimv+8Th+afqmRNlkr8CdDAqVGhicpaSO1UcAGpzAKRUFoPxoUZSfV8QZp7urGmKwTO7L7BcLcw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR12MB7648

Hello Kirill,

On 1/24/2024 6:55 AM, Kirill A. Shutemov wrote:
> TDX guests allocate shared buffers to perform I/O. It is done by
> allocating pages normally from the buddy allocator and converting them
> to shared with set_memory_decrypted().
>
> The second kernel has no idea what memory is converted this way. It only
> sees E820_TYPE_RAM.
>
> Accessing shared memory via private mapping is fatal. It leads to
> unrecoverable TD exit.
>
> On kexec walk direct mapping and convert all shared memory back to
> private. It makes all RAM private again and second kernel may use it
> normally.
>
> The conversion occurs in two steps: stopping new conversions and
> unsharing all memory. In the case of normal kexec, the stopping of
> conversions takes place while scheduling is still functioning. This
> allows for waiting until any ongoing conversions are finished. The
> second step is carried out when all CPUs except one are inactive and
> interrupts are disabled. This prevents any conflicts with code that may
> access shared memory.
>
> Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
> Reviewed-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
> ---
>   arch/x86/coco/tdx/tdx.c | 124 +++++++++++++++++++++++++++++++++++++++-
>   1 file changed, 122 insertions(+), 2 deletions(-)
<snip>
> +static void tdx_kexec_stop_conversion(bool crash)
> +{
> +	/* Stop new private<->shared conversions */
> +	conversion_allowed = false;
> +
> +	/*
> +	 * Make sure conversion_allowed is cleared before checking
> +	 * conversions_in_progress.
> +	 */
> +	barrier();
> +
> +	/*
> +	 * Crash kernel reaches here with interrupts disabled: can't wait for
> +	 * conversions to finish.
> +	 *
> +	 * If race happened, just report and proceed.
> +	 */
> +	if (!crash) {
> +		unsigned long timeout;
> +
> +		/*
> +		 * Wait for in-flight conversions to complete.
> +		 *
> +		 * Do not wait more than 30 seconds.
> +		 */
> +		timeout = 30 * USEC_PER_SEC;
> +		while (atomic_read(&conversions_in_progress) && timeout--)
> +			udelay(1);
> +	}
> +
> +	if (atomic_read(&conversions_in_progress))
> +		pr_warn("Failed to finish shared<->private conversions\n");
> +}
> +
> +static void tdx_kexec_unshare_mem(void)
> +{
> +	unsigned long addr, end;
> +	long found = 0, shared;
> +
> +	/*
> +	 * Walk direct mapping and convert all shared memory back to private,
> +	 */
> +
> +	addr = PAGE_OFFSET;
> +	end  = PAGE_OFFSET + get_max_mapped();
> +
> +	while (addr < end) {
> +		unsigned long size;
> +		unsigned int level;
> +		pte_t *pte;
> +
> +		pte = lookup_address(addr, &level);
> +		size = page_level_size(level);
> +
> +		if (pte && pte_decrypted(*pte)) {
> +			int pages = size / PAGE_SIZE;
> +
> +			/*
> +			 * Touching memory with shared bit set triggers implicit
> +			 * conversion to shared.
> +			 *
> +			 * Make sure nobody touches the shared range from
> +			 * now on.
> +			 */
> +			set_pte(pte, __pte(0));
> +
> +			if (!tdx_enc_status_changed(addr, pages, true)) {
> +				pr_err("Failed to unshare range %#lx-%#lx\n",
> +				       addr, addr + size);
> +			}
> +
> +			found += pages;
> +		}
> +
> +		addr += size;
> +	}
> +
> +	__flush_tlb_all();
> +
> +	shared = atomic_long_read(&nr_shared);
> +	if (shared != found) {
> +		pr_err("shared page accounting is off\n");
> +		pr_err("nr_shared = %ld, nr_found = %ld\n", shared, found);
> +	}
> +}
In case of SNP and crash/kdump case, we need to prevent the boot_ghcb 
being converted to shared (in snp_kexec_unshare_mem()) as the boot_ghcb 
is required to handle all I/O for disabling IO-APIC/lapic, hpet, etc., 
as the enc_kexec_unshare_mem() callback is invoked before the apics, 
hpet, etc. are disabled.

Is there any reason why enc_kexec_unshare_mem() callback is invoked in 
crash case before the IO-APIC/lapic, hpet, etc. are shutdown/disabled ?

In case of kexec, enc_kexec_unshare_mem() callback is invoked after the 
IO-APIC/lapic, hpet, iommu, etc. have already been disabled/shutdown, 
hence, this callback can transition all guest shared memory (including 
boot_ghcb) back to private.

Thanks, Ashish