Skip to content

Commit cceb4e0

Browse files
dcuiliuw
authored andcommitted
Drivers: hv: vmbus: Support >64 VPs for a fully enlightened TDX/SNP VM
Don't set *this_cpu_ptr(hyperv_pcpu_input_arg) before the function set_memory_decrypted() returns, otherwise we run into this ticky issue: For a fully enlightened TDX/SNP VM, in hv_common_cpu_init(), *this_cpu_ptr(hyperv_pcpu_input_arg) is an encrypted page before the set_memory_decrypted() returns. When such a VM has more than 64 VPs, if the hyperv_pcpu_input_arg is not NULL, hv_common_cpu_init() -> set_memory_decrypted() -> ... -> cpa_flush() -> on_each_cpu() -> ... -> hv_send_ipi_mask() -> ... -> __send_ipi_mask_ex() tries to call hv_do_rep_hypercall() with the hyperv_pcpu_input_arg as the hypercall input page, which must be a decrypted page in such a VM, but the page is still encrypted at this point, and a fatal fault is triggered. Fix the issue by setting *this_cpu_ptr(hyperv_pcpu_input_arg) after set_memory_decrypted(): if the hyperv_pcpu_input_arg is NULL, __send_ipi_mask_ex() returns HV_STATUS_INVALID_PARAMETER immediately, and hv_send_ipi_mask() falls back to orig_apic.send_IPI_mask(), which can use x2apic_send_IPI_all(), which may be slightly slower than the hypercall but still works correctly in such a VM. Reviewed-by: Michael Kelley <mikelley@microsoft.com> Reviewed-by: Tianyu Lan <tiala@microsoft.com> Signed-off-by: Dexuan Cui <decui@microsoft.com> Signed-off-by: Wei Liu <wei.liu@kernel.org> Link: https://lore.kernel.org/r/20230824080712.30327-6-decui@microsoft.com
1 parent 0719881 commit cceb4e0

File tree

1 file changed

+23
-7
lines changed

1 file changed

+23
-7
lines changed

drivers/hv/hv_common.c

Lines changed: 23 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -360,6 +360,7 @@ int hv_common_cpu_init(unsigned int cpu)
360360
u64 msr_vp_index;
361361
gfp_t flags;
362362
int pgcount = hv_root_partition ? 2 : 1;
363+
void *mem;
363364
int ret;
364365

365366
/* hv_cpu_init() can be called with IRQs disabled from hv_resume() */
@@ -372,25 +373,40 @@ int hv_common_cpu_init(unsigned int cpu)
372373
* allocated if this CPU was previously online and then taken offline
373374
*/
374375
if (!*inputarg) {
375-
*inputarg = kmalloc(pgcount * HV_HYP_PAGE_SIZE, flags);
376-
if (!(*inputarg))
376+
mem = kmalloc(pgcount * HV_HYP_PAGE_SIZE, flags);
377+
if (!mem)
377378
return -ENOMEM;
378379

379380
if (hv_root_partition) {
380381
outputarg = (void **)this_cpu_ptr(hyperv_pcpu_output_arg);
381-
*outputarg = (char *)(*inputarg) + HV_HYP_PAGE_SIZE;
382+
*outputarg = (char *)mem + HV_HYP_PAGE_SIZE;
382383
}
383384

384385
if (hv_isolation_type_en_snp() || hv_isolation_type_tdx()) {
385-
ret = set_memory_decrypted((unsigned long)*inputarg, pgcount);
386+
ret = set_memory_decrypted((unsigned long)mem, pgcount);
386387
if (ret) {
387-
/* It may be unsafe to free *inputarg */
388-
*inputarg = NULL;
388+
/* It may be unsafe to free 'mem' */
389389
return ret;
390390
}
391391

392-
memset(*inputarg, 0x00, pgcount * PAGE_SIZE);
392+
memset(mem, 0x00, pgcount * HV_HYP_PAGE_SIZE);
393393
}
394+
395+
/*
396+
* In a fully enlightened TDX/SNP VM with more than 64 VPs, if
397+
* hyperv_pcpu_input_arg is not NULL, set_memory_decrypted() ->
398+
* ... -> cpa_flush()-> ... -> __send_ipi_mask_ex() tries to
399+
* use hyperv_pcpu_input_arg as the hypercall input page, which
400+
* must be a decrypted page in such a VM, but the page is still
401+
* encrypted before set_memory_decrypted() returns. Fix this by
402+
* setting *inputarg after the above set_memory_decrypted(): if
403+
* hyperv_pcpu_input_arg is NULL, __send_ipi_mask_ex() returns
404+
* HV_STATUS_INVALID_PARAMETER immediately, and the function
405+
* hv_send_ipi_mask() falls back to orig_apic.send_IPI_mask(),
406+
* which may be slightly slower than the hypercall, but still
407+
* works correctly in such a VM.
408+
*/
409+
*inputarg = mem;
394410
}
395411

396412
msr_vp_index = hv_get_register(HV_REGISTER_VP_INDEX);

0 commit comments

Comments
 (0)