From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751671AbdIPMfY (ORCPT ); Sat, 16 Sep 2017 08:35:24 -0400 Received: from mail-dm3nam03on0057.outbound.protection.outlook.com ([104.47.41.57]:43351 "EHLO NAM03-DM3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751541AbdIPMfQ (ORCPT ); Sat, 16 Sep 2017 08:35:16 -0400 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; From: Brijesh Singh To: linux-kernel@vger.kernel.org, x86@kernel.org, kvm@vger.kernel.org Cc: Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , Borislav Petkov , Andy Lutomirski , Tom Lendacky , Brijesh Singh , Paolo Bonzini , =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= Subject: [Part1 PATCH v4 16/17] X86/KVM: Unencrypt shared per-cpu variables when SEV is active Date: Sat, 16 Sep 2017 07:34:17 -0500 Message-Id: <20170916123418.37807-17-brijesh.singh@amd.com> X-Mailer: git-send-email 2.9.5 In-Reply-To: <20170916123418.37807-1-brijesh.singh@amd.com> References: <20170916123418.37807-1-brijesh.singh@amd.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Originating-IP: [165.204.78.1] X-ClientProxiedBy: DM3PR12CA0051.namprd12.prod.outlook.com (10.161.151.19) To CY1PR12MB0152.namprd12.prod.outlook.com (10.161.173.22) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: cc3e602f-1d6e-41b0-08f1-08d4fcff55ab X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(22001)(300000502095)(300135100095)(2017030254152)(48565401081)(300000503095)(300135400095)(2017052603199)(201703131423075)(201703031133081)(201702281549075)(300000504095)(300135200095)(300000505095)(300135600095)(300000506095)(300135500095);SRVR:CY1PR12MB0152; X-Microsoft-Exchange-Diagnostics: 1;CY1PR12MB0152;3:W3kLIC6Fem3DLoXcstMd5TuPwjADJsxrCOke4Rvvbn9SmRJan4RACyKfrwbyUqWOv4LRsIGULW2FSckft65khsup4W/IIMPgCnmITAsYQuH5xXteLnAdllh9IlxUSl0bZs8smFa3jn3jEoZ0/puZyDOYTL63jrTHfH9asLY8aEq4NZZ3WglUuCqL6X9P3HYEACH/YwPUGhTRwQKmJKDAxoTBph8VbvyLZgVdOwi69hVblGkGDAuPGGaHu4tqQSe7;25:qK1fWxLz7SuoijsVA8CCXOYv/v9svFFIRqG/qz2uTyLgrKTQ7B9NsEtUnfa4dol97T9EixzbUyc2t2f6F1x7Gg2UzkX/5BE/Lw3rCr0fTFw8OOU7hJeMErdwDiCDZr25xMFRYgA5q4JjaHzOLbc1c1JD+VcK9MlAmURubrFkJJrs3I0dbaQYYiM6lMWCqkgRoDx56SiwfYb9EzqXllinnbu9LLnioq51/gKUre4+T7hrsO6CHWq4SHzS6qatSgc3ub/HTO9tGUgs0/jNkjZsBkBapEq5v4GcDpMI0ftgkyso/AOTrEtTpfjq156UKSo+JwrxoKKCoBImQCuRsVqqIQ==;31:N4acYszhrQGqCeQdSsK/l3gAZm4SYoohcsFhQYBUDlSLRra4u01vaYYd2mQC1q1XQRllztbJiyykoOSu+IpGB0TwINtpkpTTitQRN5wTSswL1UgtJVM0+wPTY2flBvm92JIcfurpJOZtn0DvbJnrgpm5Bopyqc9NMYnYrffDvBI6xEFJqlCSCV+pNrizI3489cHrxuKEUA0kXILuT1dhR3fjxhYF2rOYwkrxv9RyQEc= X-MS-TrafficTypeDiagnostic: CY1PR12MB0152: X-Microsoft-Exchange-Diagnostics: 1;CY1PR12MB0152;20:qmnyPAYBXwF1ryofGsGIBrvjTVRN1N4G4hKVmW02inQBBkVviQ8ieiDfNdNhbz3NBUnsXqDYhqJJuG23ZVin46Vwp0E2heZOWXUXvRtbeDk3tMWmHUMM2/VfkIN5psfFOtD5pmL9prpTc1kM7qNE2mnYGiRMpGiGp3v28aBtszfvKM1JA/ldCFlu6km5PGnMJR760nS70oBXqtLlwkV5CBCcKTA3EhUkQnKx3S1hyCaaanwKhyRL/i1LMoWRCEbFk7zjdkgIi+BcmMT3A9rdpjpIDZ5TPZIHo9czsbextUx5CjloKNsAB6kEzdgxSpSaM0bSb3hXLvzvThqQed0Ay9xrVztjoKVhMU3KmUKDOPCJcD0uhlXtApWlFTx2B2e0bFdrsWiscfYRgOaDQDSPB9OYDzOrdeWenbfNxqjVMyAMQ8fB1ECljpQsUWlG+RPmnpZguffxzw9r4KBVf12KDFmZgZhcMKvCiHAewBMu7TTknK9wa33BZgf7RDQbWE7u;4:Um/WCoG5GDlGaz2hO5CuEyBcAuBvYNRMVaqW3jGA+yA55w/f3KqmWbW/kEWfNDVx8C9AshlpwtruHl7BJ7aimKVkuXGYirLm/rvIUmw6cbdZxpgjuUgpqRvWjc6IlO4w8AodykNWQkA7GEksdbMGU7f0r2AWPa2slqtuMHAL0VCfk6u/LuHE9PERZ6nf/rCR067a7dPNq7P5ela4iKJR8WhCexqmxvfn01/+PeslJoOnZ6OoFkkcFcjgoOLrEyjSovZobXruMSLRryoHxMwcavMd7l/W44cReonCW/Rv2bqd0Q+iOSGAqgSDxsjGgU7sakoi3Nwm6FMh8mdyo/RjCQ== X-Exchange-Antispam-Report-Test: UriScan:(9452136761055)(767451399110); X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(8121501046)(5005006)(100000703101)(100105400095)(93006095)(93001095)(3002001)(10201501046)(6055026)(6041248)(20161123564025)(20161123562025)(20161123558100)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123560025)(20161123555025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:CY1PR12MB0152;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:CY1PR12MB0152; X-Forefront-PRVS: 0432A04947 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(6009001)(346002)(376002)(199003)(189002)(6486002)(53416004)(81156014)(7416002)(81166006)(50466002)(6666003)(2870700001)(7736002)(54906002)(316002)(8676002)(97736004)(2906002)(305945005)(575784001)(53936002)(5660300001)(86362001)(478600001)(16526017)(1076002)(106356001)(110136004)(3846002)(4326008)(23676002)(50226002)(68736007)(25786009)(6116002)(33646002)(105586002)(101416001)(50986999)(47776003)(2950100002)(8936002)(66066001)(36756003)(189998001)(76176999);DIR:OUT;SFP:1101;SCL:1;SRVR:CY1PR12MB0152;H:ubuntu-010236106000.amd.com;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtDWTFQUjEyTUIwMTUyOzIzOm9CV2w4QW5JeENHa0t2cTVEbmRxbmRJajZE?= =?utf-8?B?MjBRSVYyR0h0MXNKVDd5Z2NlaFN0WWRJQlkzWTR1R21SU2JXUGU0WDBRTW9o?= =?utf-8?B?a0Z3TStSMDRjZlhmRkRJODRJdjVIL2k5UXh6WlFXZ3k3UUlNTlh0QXQ2ekRN?= =?utf-8?B?azF0dTVkWnhBaEhVUFdPS1JFYzF6K3cvMm9HcGlyejRUd0N3bzEwc3pkYWNm?= =?utf-8?B?TWVUeFNmenVHc3E5ODhlUkdBZ3dtaXdvUzdsd0U0WFZITzRWYVFxZERvQzAz?= =?utf-8?B?OUo3UVF3Rzg5RGNjQ0dXMTdqUFUyRHpzaVRXLzJqM1F3MlRtN2VTbWZESktZ?= =?utf-8?B?N0w3b0VKK0xpU3JxWnlNWm1ydnhGZjU4OWxEeTFUWHJSeGU2Z2hvb2RlbVlx?= =?utf-8?B?b29wT1o2bGJldkQ4QzFTeERaUXhBblFlZ09tdlBuQis5Z2w2QVdVL25qbzRK?= =?utf-8?B?RzBHNkprNjhBcnJrZW5jdm1DM2RYQi8xa1piMEZ6QkI4a2YzM2dpK0VzZU96?= =?utf-8?B?Q2FRanAwRU5kYi9ycVk4RDJMUGJBMGVOdTNrZ0Jac1F4WTVSeDJWUS9qYks0?= =?utf-8?B?UStNbkdUM1hnV3UyczBLWUtOWkhmVEJFSUxXQU9sVFRqZjIydWNpM1h6dzdx?= =?utf-8?B?cUQzQlN1K0V1b1I5OTE0bHNld0tkMkRjYXpiTnlBNGFsSWlybVROd1UyOUFB?= =?utf-8?B?TUpQZFRhcU9RNVNtU0psenlOL3RCNm1pSEViSFBMQ1l5QnozN010ZnYwZjdu?= =?utf-8?B?LzFNOXB6QzB6cEpIMDk4YjhIOGNHc1dDVmRaUnZKYTJLelM3WFJnTXFWTzhK?= =?utf-8?B?bEFyUmlIVHQvNDZCYmRPOWY3dHNsenRtVkowekdsM1Fsd29HNlViNmt0aEZq?= =?utf-8?B?VUZJTTdZVS8veDZ6WmZlTGR3TlV4KzUxQitPWUxra1lldGFqQ0d5emlwUnE5?= =?utf-8?B?Um5xMTl4T1IyTHV6UEJEMEtaZldQWlZwdmgzQ2d2cDVxeDFGWHg3WFUxOW0w?= =?utf-8?B?N001Vmt2bDd1SzduNHc5TTJXdFoxa2E3T1RtYmxGOUhENSt1RmhiTEx3TFYy?= =?utf-8?B?aER1c01IcGt5eG1sUlBLSTYyTU9zWWdZZUZDWkxTdFdyQ1Q0dzRsV3FyU1pD?= =?utf-8?B?MmNESXl4N1p1Q1RTbzIrRlJaZHhuUjdoTXp1QU5ybXdNbEh5SHhsMkUvQTBx?= =?utf-8?B?NW43WnFMMTQ4UitJN2lrNmh5MHM4UDJCZjU1K3J6YUVUUDJlV3MyNkU2Q2tD?= =?utf-8?B?NnBwcGFPL29kNEhxL0dUOGNrLzFDNU5HZ0FzRFhZcGdpdzdkU1lOZmFkTUR3?= =?utf-8?B?d0pTN3NvZjZBajBUQnd5ODlMZTNNbmNJbTJJQkFmTno4KzFiTUpuZTZXWnNU?= =?utf-8?B?cUhjVzJNTnRPQ3EyK3E3RHAwdW9uTW02Rms0UzNuYWJ1ei9NejFvYWJXTHZh?= =?utf-8?B?MTZVM0lMM0dZa2xRQ3NtSUFkeW9weW9rMHRmejFEaFZ6VHpPVytQbW0xSG12?= =?utf-8?B?MU1Jdz09?= X-Microsoft-Exchange-Diagnostics: 1;CY1PR12MB0152;6:JEZBEjfQorLyeQ1JKk/3bSqwPI45cASpsKKVzBOSkTAMAQtMFlOGtYDRFZBPbFDhYA9YQ/pPWrLPsoeNlAkfE9mct0QXgW8LdZrJoqp0aVEmAV1UyZFPw9rcr7+cVbqOqEEVUXLHK5vUTfOi4bmMB55P25jZ8//Y8aQUbB5+EYIT0M8GuimcogVqK6gdSsTClRwsg5/icfa+L3FCpPFO8dxYsl+GvSmmCTlWbcT6TYO+oKKrkbXwcxDyTkuTRjb6+FBgQrNBPmN0V5oA/1swvRThOHIDQn1JxVprP6EFp4wqyGVuQhNj33FA1Nf/Gt2iGUqVpV7BXSC2mcuq8fGcXQ==;5:tn1xJJuVLFI4XdatDOPA8OlqL8jnod1z9BroTrHcgCP2iXFjU6HddX5SU3DfkqyozQKSy9lqlnqkiendMTUmP82e7axXSzo7Tf6pO4braTykcKjgJ5BuYoztSHM8fpBT77q8X5ZLGp6dzIZth5usZA==;24:vEGBoKJyeKBu9ttsqlP5jvHW/CVgzvZN6j0p+JkeF0i853YqN9OwF78VhhKbjtvsCqEIbkJbYXggajHvQb5hll2YAnCdkxs73anrqTy+IzY=;7:JGKbqPrCuz9l19oK20anhsJW4b1LRE39QgdYKhcWb0D3EcypIbbDTvCSNMIUoaFcBQ/vVqcE7bzPzfxORXsMfEKcslBg8Odm6UYzvfLohzmOI4EM3osdoRNsSsQjoUEgXs3KIDgReQTu3BWLpu3sMACrF79Y5IkBl6lZ4XLnediQ94Aqte4oCpL0+sJpJJMcRUR/yF20v2ggCQeybiejjEqGvDWrx020F6/N17qvD3s= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;CY1PR12MB0152;20:3WhUIbXQ2NRUK5X0rpKHIp8Xfe/xvfewMGr5z9/FTE0+YX/0V1UUg6EFIfeB20bkGuxefGyXDgdU5kG8MVBD8gkbpHQ6cMS5H0DQYjtUJ2UjkAm4/iwGPbXXPumLR0tRZTXuVKtUSz6gwV47n8RbnfItsBuALjtsa871LYIsu8jvo8xklHHxmtkj/TEK7nbMSy2DzGBz6fpJhXgHcaokq8eg+I/l00hhNFBefE8mT3cD7NI1RDH2TM8MoYNvAGDz X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Sep 2017 12:34:54.4589 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR12MB0152 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org When SEV is active, guest memory is encrypted with guest-specific key, a guest memory region shared with hypervisor must be mapped as unencrypted before we share it. Cc: Thomas Gleixner Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: Borislav Petkov Cc: Paolo Bonzini Cc: "Radim Krčmář" Cc: Tom Lendacky Cc: x86@kernel.org Cc: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org Signed-off-by: Brijesh Singh --- arch/x86/kernel/kvm.c | 46 +++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 43 insertions(+), 3 deletions(-) diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c index 874827b0d7ca..9ccb48b027e4 100644 --- a/arch/x86/kernel/kvm.c +++ b/arch/x86/kernel/kvm.c @@ -75,8 +75,8 @@ static int parse_no_kvmclock_vsyscall(char *arg) early_param("no-kvmclock-vsyscall", parse_no_kvmclock_vsyscall); -static DEFINE_PER_CPU(struct kvm_vcpu_pv_apf_data, apf_reason) __aligned(64); -static DEFINE_PER_CPU(struct kvm_steal_time, steal_time) __aligned(64); +static DEFINE_PER_CPU_UNENCRYPTED(struct kvm_vcpu_pv_apf_data, apf_reason) __aligned(64); +static DEFINE_PER_CPU_UNENCRYPTED(struct kvm_steal_time, steal_time) __aligned(64); static int has_steal_clock = 0; /* @@ -305,7 +305,7 @@ static void kvm_register_steal_time(void) cpu, (unsigned long long) slow_virt_to_phys(st)); } -static DEFINE_PER_CPU(unsigned long, kvm_apic_eoi) = KVM_PV_EOI_DISABLED; +static DEFINE_PER_CPU_UNENCRYPTED(unsigned long, kvm_apic_eoi) = KVM_PV_EOI_DISABLED; static notrace void kvm_guest_apic_eoi_write(u32 reg, u32 val) { @@ -419,9 +419,46 @@ void kvm_disable_steal_time(void) wrmsr(MSR_KVM_STEAL_TIME, 0, 0); } +static inline void __init __set_percpu_var_unencrypted( + void *var, int size) +{ + unsigned long pa = slow_virt_to_phys(var); + + /* decrypt the memory in-place */ + sme_early_decrypt(pa, size); + + /* clear the C-bit from the page table */ + early_set_memory_decrypted(pa, size); +} + +/* + * Iterate through all possible CPUs and map the memory region pointed + * by apf_reason, steal_time and kvm_apic_eoi as unencrypted at once. + * + * Note: we iterate through all possible CPUs to ensure that CPUs + * hotplugged will have their per-cpu variable already mapped as + * unencrypted. + */ +static void __init set_percpu_unencrypted(void) +{ + int cpu; + + for_each_possible_cpu(cpu) { + __set_percpu_var_unencrypted(&per_cpu(apf_reason, cpu), + sizeof(struct kvm_vcpu_pv_apf_data)); + __set_percpu_var_unencrypted(&per_cpu(steal_time, cpu), + sizeof(struct kvm_steal_time)); + __set_percpu_var_unencrypted(&per_cpu(kvm_apic_eoi, cpu), + sizeof(unsigned long)); + } +} + #ifdef CONFIG_SMP static void __init kvm_smp_prepare_boot_cpu(void) { + if (sev_active()) + set_percpu_unencrypted(); + kvm_guest_cpu_init(); native_smp_prepare_boot_cpu(); kvm_spinlock_init(); @@ -489,6 +526,9 @@ void __init kvm_guest_init(void) kvm_cpu_online, kvm_cpu_down_prepare) < 0) pr_err("kvm_guest: Failed to install cpu hotplug callbacks\n"); #else + if (sev_active()) + set_percpu_unencrypted(); + kvm_guest_cpu_init(); #endif -- 2.9.5