From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753505AbdI0PP1 (ORCPT ); Wed, 27 Sep 2017 11:15:27 -0400 Received: from mail-by2nam03on0054.outbound.protection.outlook.com ([104.47.42.54]:61520 "EHLO NAM03-BY2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753321AbdI0POW (ORCPT ); Wed, 27 Sep 2017 11:14:22 -0400 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; From: Brijesh Singh To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, x86@kernel.org Cc: Brijesh Singh , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , Borislav Petkov , Paolo Bonzini , =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= , Tom Lendacky Subject: [Part1 PATCH v5 16/17] X86/KVM: Decrypt shared per-cpu variables when SEV is active Date: Wed, 27 Sep 2017 10:13:28 -0500 Message-Id: <20170927151329.70011-17-brijesh.singh@amd.com> X-Mailer: git-send-email 2.9.5 In-Reply-To: <20170927151329.70011-1-brijesh.singh@amd.com> References: <20170927151329.70011-1-brijesh.singh@amd.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Originating-IP: [165.204.78.1] X-ClientProxiedBy: BN6PR04CA0033.namprd04.prod.outlook.com (10.174.93.150) To CY1PR12MB0152.namprd12.prod.outlook.com (10.161.173.22) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: c13b3b18-714b-4f10-c8ec-08d505ba6900 X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(2017030254152)(48565401081)(2017052603199)(201703131423075)(201703031133081)(201702281549075);SRVR:CY1PR12MB0152; X-Microsoft-Exchange-Diagnostics: 1;CY1PR12MB0152;3:2aOWLAKEkEj1EV7S28xfGeCVyy+VT0dygpRZJzAZQRlTg8RJSjlsuJbl1RTMCG5OjGCQ9iwpF9m9Cy8MuhoHx0H7B902v/8X0N0f93ooD3inI0dr/GRP7tUXX9mmBFafhupEY5BRddsMly61TqBJ4zjWFNbGrXUDuLT1SV2l6put4PoTKIszqXIKX0dt0IqRnlFD7MaiWSjt9KfQ9y9lLJlLrEinaF/8K1LS5d0w2pG/tJotAMAldPVajll7M2uI;25:pCEgt9Tyi751DsJKIG/1bdiIbiAaXq4Wif7ZblW7NlS64nRBIolfmsA9zOfeffzheyC54cvKc+/9GZILrU+gWgEvJzfDG6dDpJhiLOW0H6+AhNqjLCFJyGS1a0+Oe3xAs+y9vK65jU9gQsTnPn6qFMgzZDy+eVJxntGzPJmQFiBjWN+8qlMSV3J8XTnI5BQTd/33lviuy+kTvqFLaetwCEKr6A+Rs8UxXvqXR3WQoM+tsbst3TM1LxZ1syrhxM+VzJIvPRksgGqnFxfAjxIlpk74qCcKx15GXtInjHpAIjP3mxLYYektFrXI0t0X4/aZYGPjKJruG5/Ij2ZBKohVKw==;31:DL5vDoGKLB+6mgkgX6zeDZ9GGRmP2QAWyGZ3Z6QPydmGOkuKJ1bxa04B1ysZe7qkv5vdbvxEF2JKW6E7I/HAxsgHDJo02agd5XYHiJ4PQO8lMvm2oJDK/GjoBe18j3S4f8s15tuNww0h68GvAQKaHSDyWLRIVWI/vjEsgVB4T6YHaqyO7JzCM2M1yxiSVFtFLmS5qEJkKAWc01eIxRW5aDfKNZ+pPNrZwbMKzFr1zXQ= X-MS-TrafficTypeDiagnostic: CY1PR12MB0152: X-Microsoft-Exchange-Diagnostics: 1;CY1PR12MB0152;20:ZwGMZrKdxlLCaEeh5xWq2jly6A4rK52zdkEz0LvoERNqbb/3n6qFy9z69sxJT/ZM4ZyeAPeKULoKsWZLg4a0I33tHSLx98uphfTU8c1q41FIa47der2vFqRVYt5VpoOuVvFFaxXZCDhEtObK0eCfHAo5c/c/WlVdR+83dAcTK2p9RxIVFyhU9ewSIpIUtMXZSHsQfQWLlEL1n7L+e2YLQKHSL7k8FDTfNMFqAdbdJVpQQNTxUsp9sdzc1PARSS6mnvV1eCfhIKKDfTbYPjnvFPQNXhzzMTnQWzadvsSO6w2Uuodzq9L2fN6Gljbvm+oZCSfNOFsfgJj4KkGNZpL5VDk3EFxiso0M2apQmm9eyIpom8YtsoaBEciBkygfKOTS6Lt0lznsR21Rtho/xrM+BPIT4TgV7WQezgYiKf0+JqFInPuCSnturzPqnHLnvykL9Nw2K4EKQNmGzur8w/qxZOrLC+D6BoJ7A7jtMv7Lga8H7tqa6C49jX9ffpLsmtug;4:sYwzI485hEiCDbl3Ue6qmITw/JiwGbNabdSGtUunfe4aU7gOdMf1aOrkmObGQrW0WCV6y3Mx7i7VDwNdNYvUjN34B1hKszITN7GJ6XxWXxtvVVoLP1c9zJzmQ9tvZ/Vb1/q7RKBEW8ETuWDpk1ADtbvH/ORMFjVF31pyjk8gl79md+n6CwwjwI0Z6yq+V8KZ3yemJeYHvcXijCeJOM5qfia93uBl129ppz8xBjBvHiP+TEEsy4loxf4k+aL47vN8W8/pE0x5uZ1emBnXrjR5Kh7rcZng4jJCxqoOTSMAWIX2uK4aBbkpnPju4aIkvaKADGhVzV2MDllqP/jB8Iy5Bw== X-Exchange-Antispam-Report-Test: UriScan:(9452136761055)(767451399110); X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(8121501046)(5005006)(10201501046)(3002001)(93006095)(93001095)(100000703101)(100105400095)(6055026)(6041248)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123560025)(20161123555025)(20161123562025)(20161123564025)(20161123558100)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:CY1PR12MB0152;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:CY1PR12MB0152; X-Forefront-PRVS: 04433051BF X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(6009001)(346002)(376002)(39860400002)(199003)(189002)(3846002)(25786009)(6116002)(23676002)(53416004)(106356001)(8936002)(4326008)(54906003)(1076002)(6486002)(50226002)(8676002)(305945005)(50466002)(81156014)(81166006)(6666003)(68736007)(36756003)(189998001)(7736002)(105586002)(97736004)(2870700001)(53936002)(2950100002)(101416001)(478600001)(16526017)(76176999)(50986999)(316002)(47776003)(66066001)(86362001)(33646002)(5660300001)(2906002);DIR:OUT;SFP:1101;SCL:1;SRVR:CY1PR12MB0152;H:ubuntu-010236106000.amd.com;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtDWTFQUjEyTUIwMTUyOzIzOkxUNld5TXNxQW5GYTlCc2lrRkFrbVBBZ2xG?= =?utf-8?B?WEhpcnpVNlBLVWFqdFcvZG1KTUI0SEJMVVZtZ1FmM1hrTUdPTlpFOTFSSU1U?= =?utf-8?B?V2lRM1FjU3R6c0xWa1F0ZjkrMC9FMjNlQlk4Y1JyYlpHUks2M2tlQVFNQml2?= =?utf-8?B?R3ZzYlZNRUZOemNkM3FBWEZ6eFJ3dzhNS3RoRGNuOExDaW1ORTM2Zm5FS0N6?= =?utf-8?B?UktWWGxBYTB2U3ZGSEI4c2NkV0VZSUo1bWg5L2hMbjJBMTBGeFJQcWhYdll3?= =?utf-8?B?MkNmMCtaemd2bGNmNXYrenBMcStITkVlWEpEZG5VR0lObDB3WkF1ZzQ5WDZ0?= =?utf-8?B?R0l4YmpaT0NYWUtseWt2Q3o2US8zbUtuM2UxNEF2d09ZSTIzQ1hNMG96Q1ZM?= =?utf-8?B?QkVmbERyR1ZLSVcwbDRTZFhnaEY5ckNIdStza2NUcndRS0Jicml1WnBBQWNQ?= =?utf-8?B?OGVlRXNuSWRNSUpmaWZxb3REOEZmdm1SdnRMbkllZjFDYlVjUlltMmJ5ZmtT?= =?utf-8?B?OHhTYWpsQTA4UkUzV3ExMzJ5eWM3akxMTCsyZVJ5UFh6U1lTcW9GY3M3WWZZ?= =?utf-8?B?MXE5M01oY21mbGRnQ28wUGtrUmdtT08rYmxzLzVpOG9nNjk1L2Y0TXd2M28y?= =?utf-8?B?UkhqQ29aV2x2dzVVR0N1T2FadWRCWE9uL2NINGlNR0ZXSTRWTlh2ZnFCd3hG?= =?utf-8?B?QlQ0NDhBYUVUTWxpcElMRHVUeGwxL1ZtMFNYakt4UGFwdU43NUlSYXFlZUVy?= =?utf-8?B?aE9CeHkwVEtoOTBxbzJxMWdwUE1waFZKeVR1NE9mNGQwYzI3UnRoZU1JN0pL?= =?utf-8?B?Sk1HWGdiQzZydUZVUno2OVVpbVR4V3lMK1pIOGZmL0ZMU3k1ZURUL3RYWHRJ?= =?utf-8?B?Q3BrSFdMNFdGZjVqVzh0dEhNTVRteHNaaGVNM0lxMjgxRW9oUWhxeGh2b1Nn?= =?utf-8?B?WTd2NHg4T2FGU0poaVBBMkZrZ0xDLzVTTFpwVkZxcWU4My9CTmFmNmw5bWJj?= =?utf-8?B?ZHRzM1BzTWYvZzRPT2g2cGNxNUk5SS9HM3hadm5VR2JQSkRzajBzUVFtRThQ?= =?utf-8?B?VGgrUFNHb2lmVGZNc0Z5MkplLzlnVUdUTTFkNG5wTENrWDNWNmpnMkhjanhy?= =?utf-8?B?S2ZQYlNkWWsyaWlYRHNIdzVoQTNKdlRwbFlBcnhoU2xKK2lwWEJDNE9aa2tK?= =?utf-8?B?eUFCekZUMGN3WlljeWpFY2JHdVVRT1FnUmsvUWpMQzlwc0xiRjlVbmJQTTNO?= =?utf-8?B?TWJRbEtqQ05aTlMyV0hrdWgwOWtyZG9KS1BRdmF6SUxRQTJQcm9qZThsdnN5?= =?utf-8?B?aGxmdjAwRXhCNS9tNk51dmZ2ZW1MeGxVZUpJN0YrckNFVXRVc2djNGU5ZnNu?= =?utf-8?B?VUpXY1RVbnJaWFhTV2Y4ZUtDWlIraWpqak1rUWlBc21Qdmx3WWh1YkxSbWZx?= =?utf-8?Q?DoTwZn+uhnlW2pEYIVYlwYFP3sZ?= X-Microsoft-Exchange-Diagnostics: 1;CY1PR12MB0152;6:repGYgHnxiwdnHBwLfj/BS4eyCXESjgDbXVFHN1nXHMZMiXORtBrFn/aYNs7WD1YY780/HrJ35B8GEbmlSTP6imBp2m/vit3pA05dbft/JO/9QPVs+B/qudyczJepEmqjFHjq34Drsy8LV+CtCsSBRESbmP68LWAIjDP0cgYer1yOGAS7hh0Sn0EIPI/NR0Io+Xh+BoYk2Vm9S9AEmk46siwHPk3qAYmc3+k7PjmWmag0yxYhr5LwlSkxBme/RnmUPsYMuYASP06K+4tyq/F6pA1jQSz+NxVOY0RXyHz/oP3HZYRNqOMeGVfwpdmlpd5HMEZGY931+clErbM1VJ/vg==;5:sztomVAWUu7yuqVFjLcNmo3XBfVTLhUFI7U7u3uQqaRVENJLj61q9aoQljgbxx7Tex4bx6qNtLUbFmKTd7sgtWjxgXJtNYtbeWv/9XkuTBtg8CaDDZrYWEEPsUqt3gX7JYKQ+bhnqmaoF/owKM6NyQ==;24:CDHS6YXw3Tq4u/bsSfBqcVrVWgwfaaJ9XxJDIfPfgiAuKVy8BLuUXerLSNC+Y5m9k9cmYCu2Fxc5hN7MlREqWYWfEBWn+zj2Sk8qGbRMbAM=;7:lc480iu+ZAgl/ImGPKuz+8ik/TCOPGLTBqzOtLsFMu6khsZ7Qfpr611nP+5/ghogkDgN3RMNbVP+Qiq1HdxXLnAPz3sa8htA9cnzO3kzTnYeTHavR49WDrt5NOd6pzn+jKvFK88QRN3YkLwVnD5X6NZoKxyQALhaXvOWKDX3178cOCnvZGHYlKL/k/Ez3ax8hPMkwc4a3sVY+hqI36/r88GyaVSbzSYT31CyFycctUg= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;CY1PR12MB0152;20:wIqEZxwvpzWVRl1CWkSSplpducH6z+sniJUSnYSyRqDKbZrTifuek8tNW+Uyxsh0Ysp7qJEnnh4cTLDW7k3fJtemDYXZ0P7O+dX7x1S5dK26mCbN7sr1iCoP6ectCu7TZ+IJVPhFs37db0FGRq8j4HDiDPnsF0KsrS2pKZlPS9Szz5t012xNHMO68xMKJ2ENUeHLWPSTnHT/WWDXemWSOPP11+gp2zOVzj/5IY4kFnNPG/oHsg95ty8733Prwue9 X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Sep 2017 15:14:11.4476 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR12MB0152 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org When SEV is active, guest memory is encrypted with a guest-specific key, a guest memory region shared with the hypervisor must be mapped as decrypted before we can share it. Cc: Thomas Gleixner Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: Borislav Petkov Cc: Paolo Bonzini Cc: "Radim Krčmář" Cc: Tom Lendacky Cc: x86@kernel.org Cc: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org Signed-off-by: Brijesh Singh --- arch/x86/kernel/kvm.c | 41 ++++++++++++++++++++++++++++++++++++++--- 1 file changed, 38 insertions(+), 3 deletions(-) diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c index aa60a08b65b1..2bd193ac78dc 100644 --- a/arch/x86/kernel/kvm.c +++ b/arch/x86/kernel/kvm.c @@ -75,8 +75,8 @@ static int parse_no_kvmclock_vsyscall(char *arg) early_param("no-kvmclock-vsyscall", parse_no_kvmclock_vsyscall); -static DEFINE_PER_CPU(struct kvm_vcpu_pv_apf_data, apf_reason) __aligned(64); -static DEFINE_PER_CPU(struct kvm_steal_time, steal_time) __aligned(64); +static DEFINE_PER_CPU_DECRYPTED(struct kvm_vcpu_pv_apf_data, apf_reason) __aligned(64); +static DEFINE_PER_CPU_DECRYPTED(struct kvm_steal_time, steal_time) __aligned(64); static int has_steal_clock = 0; /* @@ -305,7 +305,7 @@ static void kvm_register_steal_time(void) cpu, (unsigned long long) slow_virt_to_phys(st)); } -static DEFINE_PER_CPU(unsigned long, kvm_apic_eoi) = KVM_PV_EOI_DISABLED; +static DEFINE_PER_CPU_DECRYPTED(unsigned long, kvm_apic_eoi) = KVM_PV_EOI_DISABLED; static notrace void kvm_guest_apic_eoi_write(u32 reg, u32 val) { @@ -419,9 +419,43 @@ void kvm_disable_steal_time(void) wrmsr(MSR_KVM_STEAL_TIME, 0, 0); } +static inline void __init __set_percpu_decrypted(void *var, int size) +{ + unsigned long pa = slow_virt_to_phys(var); + + /* decrypt the memory in-place */ + sme_early_decrypt(pa, size); + + /* clear the C-bit from the page table */ + early_set_memory_decrypted(pa, size); +} + +/* + * Iterate through all possible CPUs and map the memory region pointed + * by apf_reason, steal_time and kvm_apic_eoi as decrypted at once. + * + * Note: we iterate through all possible CPUs to ensure that CPUs + * hotplugged will have their per-cpu variable already mapped as + * decrypted. + */ +static void __init sev_map_percpu_data(void) +{ + int cpu; + + if (!sev_active()) + return; + + for_each_possible_cpu(cpu) { + __set_percpu_decrypted(&per_cpu(apf_reason, cpu), sizeof(struct kvm_vcpu_pv_apf_data)); + __set_percpu_decrypted(&per_cpu(steal_time, cpu), sizeof(struct kvm_steal_time)); + __set_percpu_decrypted(&per_cpu(kvm_apic_eoi, cpu), sizeof(unsigned long)); + } +} + #ifdef CONFIG_SMP static void __init kvm_smp_prepare_boot_cpu(void) { + sev_map_percpu_data(); kvm_guest_cpu_init(); native_smp_prepare_boot_cpu(); kvm_spinlock_init(); @@ -489,6 +523,7 @@ void __init kvm_guest_init(void) kvm_cpu_online, kvm_cpu_down_prepare) < 0) pr_err("kvm_guest: Failed to install cpu hotplug callbacks\n"); #else + sev_map_percpu_data(); kvm_guest_cpu_init(); #endif -- 2.9.5