From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753244AbdJSNpK (ORCPT ); Thu, 19 Oct 2017 09:45:10 -0400 Received: from mail-bn3nam01on0079.outbound.protection.outlook.com ([104.47.33.79]:24208 "EHLO NAM01-BN3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752275AbdJSNpH (ORCPT ); Thu, 19 Oct 2017 09:45:07 -0400 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; From: Brijesh Singh To: Borislav Petkov Cc: Brijesh Singh , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , Borislav Petkov , Paolo Bonzini , =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= , Tom Lendacky , x86@kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Subject: [Part1 PATCH v6.1 16/17] X86/KVM: Decrypt shared per-cpu variables when SEV is active Date: Thu, 19 Oct 2017 08:44:44 -0500 Message-Id: <20171019134444.2616-1-brijesh.singh@amd.com> X-Mailer: git-send-email 2.9.5 In-Reply-To: <20171016153423.2980-17-brijesh.singh@amd.com> References: <20171016153423.2980-17-brijesh.singh@amd.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Originating-IP: [165.204.78.1] X-ClientProxiedBy: CY4PR04CA0049.namprd04.prod.outlook.com (10.171.243.142) To BY2PR12MB0146.namprd12.prod.outlook.com (10.162.82.19) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: a1fdde63-f20c-4759-405d-08d516f79934 X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(2017030254152)(48565401081)(2017052603199)(201703131423075)(201703031133081)(201702281549075);SRVR:BY2PR12MB0146; X-Microsoft-Exchange-Diagnostics: 1;BY2PR12MB0146;3:OtohG7vAtdTqAfYlQCv7j1MJpAKQFl5za+hsz187YI782/XtZJaHz3Z0o7NaxFK/+JSNl5KDZE5sizJ7i3wv3UVBZ5Cte58oPS86cBpHfYwwhIrUeYyM9L2/BtdcCMZZFEV8aBArCChbmhmZOc4amR1Mshaqlx+nJLzsSJxdlkPcz8FPExjyafr6EqszX7xj2UKylCwN2vxyeW9/iajBB3DbQvFDtB9lq3iIpvE9euuik23b9yzFao9se51eqk1p;25:xWU+spkfLh3ZpYGgPi/QVYGCVoZ3Z1XqqQ5/SbyFGNwOP7BRs/JEjEEefoCFQ6ddStY6yYb8644hWr8nD6/8a/GPm8E9riwqNoXTPTvgggPc8SVS8hGslc4bl3FkFPnh5PG1rS25wcvD/+WmR+AQzJT6ITT90+5PAFuIMeTJ80v+DXSEq9dr8A/aBDJjv08lsIJ3brxyLg8aH38aLveZXSr6Lj/B+1mBMZVIzqbs7tL0XnfkOFm79+fIck4M3dx5rsXBChXmazBzafwCEceLvn4/GKIbK9WwyIMR8rr6UF7TdHJNm0WDbhHcr5Zmw3KQL3M4MFHwRwtWgP+74zPq1A==;31:C4ZXWIA4ZswAGn8hEWHoBYse60ieIZ+8SBv5l7tVIhLLSCSUO5Sn9UQhOYNWLpQQozo22X4A/IH6wqgVLT58N3lm/Fh1uJiOfw83XUHApBHc7Ajwpc/mVTpq9CLrwHlnt8x0zThD98FWQHGQiv9IDHCBLumJNghqDo7RIOB7PQtD5Ff2EeEMBEWnF7IIz0aZ3caTDPNX+yFLbfb/EiyLYlbQV5bhE7JSoslyj5G8f2A= X-MS-TrafficTypeDiagnostic: BY2PR12MB0146: X-Microsoft-Exchange-Diagnostics: 1;BY2PR12MB0146;20:iDlG/3t3PWVkjnPnC9qtPePI6OnDxzrHNMCRKoSU8P349oQho0MoAEy6LXSt7Al3G/zpUZS21xaUx2ntSKSEB3NLuMUFDNQYzXTHWAou8IkaUoMD/vKOj+wY5tHayvNNmEbZ5AMoJwOz5QBWzjan3s55eShd8KAsFW+zZmWMnUTGDWW8f7dkC2Ua1VFMnlxUUJWQVfCgPiXLbbL0c2n/zTNC7GFecTs00YhiUDYZfR7OoM1tfQwyC68CMzne8svETx+5iOJx6k365BVoViRuT2LxCp8vqr5jqW9rcDVeyw8GkhBkNdi0FJv3NLc2jVxXcUAiG6E82gxMmFUIJCUE0rd1KsFQ8198EGCC+/XM3bIoBLuGzmmjnN1lWsEmGftzLwCUuqQ38974zs0RpVbWZTrd4Ljr6OCf8vie3Q01Dbk9ULf2edkV1znb0aHrdnoXlRfk2bb6MrLHWYmyazqPji55oOhs8AQXDXIaRtaSafZO+rsKlo5GRR7OtQp1gu03;4:6mw5RV+gTC1s85ZM5HGei41NM1RuozBGDrdrfykXCFD/mHYQv/bkXGjALMhILPK6aFMksWYnZT9vTSw1CXJX4xFMlKhpS+/y120OF/CL29zdlMix/HLAwxwdZhCSaRye+EdjAQKsqcAhhMqZx88CzvFUOSDBU2dpEQyERa2VJI+AhGmJgdclALlWucHehhp0vBhalFwTBZEGxomu2jv0GqCqvkhmURxOFODkDhW3aYlv69nJLpsE0I7g4MaJM2XDDNlTxCVGlZH0RrddXXzcHKGifjpc0euSN0ajTkzVVSgL7lmjCzdthuNecrvDIX8lXam701aACuG4fqVbKScABQ== X-Exchange-Antispam-Report-Test: UriScan:(9452136761055)(767451399110); X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(5005006)(8121501046)(10201501046)(3002001)(100000703101)(100105400095)(93006095)(93001095)(6055026)(6041248)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123560025)(20161123562025)(20161123558100)(20161123555025)(20161123564025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:BY2PR12MB0146;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:BY2PR12MB0146; X-Forefront-PRVS: 0465429B7F X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(6009001)(39860400002)(346002)(376002)(199003)(189002)(81156014)(68736007)(316002)(8936002)(66066001)(36756003)(86362001)(81166006)(76176999)(50466002)(6916009)(8676002)(53936002)(4326008)(97736004)(50986999)(478600001)(54906003)(47776003)(2950100002)(6486002)(7416002)(101416001)(3846002)(6116002)(1076002)(16526018)(6666003)(105586002)(23676002)(5660300001)(2870700001)(33646002)(106356001)(25786009)(305945005)(53416004)(189998001)(50226002)(7736002)(2906002);DIR:OUT;SFP:1101;SCL:1;SRVR:BY2PR12MB0146;H:ubuntu-010236106000.amd.com;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtCWTJQUjEyTUIwMTQ2OzIzOk85bG1SWlUwRlZLbkM3TDRmMjN3VlBBR1lX?= =?utf-8?B?S3dzdDV1VE82eUhuMk42cmJqaGpIK2IyMEZBajdkbnI1a051NGRMaXlqcFBB?= =?utf-8?B?TzEvRkhpMVIxRGRHT2VjUmhVbUxMdDNMaktFK2FUYWxsdTh2WVRJd21BNE9r?= =?utf-8?B?SFlYY2lwUzgxZG40Q2I4M2twUUozL0lzaUo2Y05oaGFuY1AzQWJHS0hUN1Mx?= =?utf-8?B?MXo5eTdZNEw4eldTTmxXenhiK3F3dWk0dm9nam9rdUNRWng4bm5SalJQRGd3?= =?utf-8?B?RVZuR3FmSXViU1UwVldVL0w3UGh5RmEyaDRhdDJLNW1zUVllM3VvMDdzcDU4?= =?utf-8?B?dmdCdVE2M1UvUThWd0VoaUlDcDJsV0tlUWxLTmlmWG1hWVIxbFFXZVlzU0Nh?= =?utf-8?B?bUtOck9temh0ODc4VHRiR3F0V250Y3hZV0pidFNkN2FSUTFBTmh0eU9WWHJ3?= =?utf-8?B?Tmlidm1BQjk5MkJ4cjFTTG10bG1UVnFFN3BMckhoQnorcy9VY1pWVEorZS92?= =?utf-8?B?di9VWitwSWlIOVJhcmZyQ3oxV0kzWWNkQlhReHNvOHNnMzhxbjRJelZsVGg4?= =?utf-8?B?VFBzVUNmQzZvWkRXZURORUNLV2lpbGdlU2VkK2lIZHRUd3FMRC9RalVERDZE?= =?utf-8?B?azdSN1dBZVFZNjdFaXArYVFHUGhTbEs0amlta3lJRmNVVXNISS9hVEJ3ODBZ?= =?utf-8?B?YkpBQ0VqeWErbURQZjFQbmhpL2tGdSs5WHErcXJJc040Um5UbWRsNk5ibE96?= =?utf-8?B?Y01uTUplMG5odHZQOGlIOGR6REwvRjRqM0x4WStLcmNNRFBySDRMNThVRXFU?= =?utf-8?B?K0pza1pPb29iN2Y0cDhCRm1hU0F0ZEhPZ3B1Q29rVnppY3NpS0Y0d2FWenlG?= =?utf-8?B?N3NTRXRtTkFBTlhBQTNJNWo3cHMxK1RoMU9CZ0lyRnlSRFpyanFHdGgraEdY?= =?utf-8?B?Y1dSeG52MEdRWXArcjZySFpMRlN2TkpERDFqWU1nOWlRQkNPclFEcGRjSEdE?= =?utf-8?B?cFZid21vQXM1WitjVmI0c21mNERBOGppOFB2QlVodmN5akpyUkxGamxoMlBR?= =?utf-8?B?bHQyZmxaLzhCU2M4cXNZV3J5eGE1bFpSdHZjY3BJQmZ1WEcxcEUwb0t6c1ZM?= =?utf-8?B?dHpLaHROVDFhYmFZYllod2dqdzM2eXJaRStIa1BwQUhyNW4wY1JLOHYra0hY?= =?utf-8?B?TmVnQ1k4cXBiSWZDMG8yQkpXYjBMRlcrVUlldWJMWW51SWNBNlBoWDJiR2NS?= =?utf-8?B?VGlPQjIzKzNFb0t5S05ZL3ZEN2xSOHI2U1BYMEV6TWg0dlFwZENleFBIMnZF?= =?utf-8?B?TlNjSGhhc1dka1BFYng2VDc1ckFmVE1xTEpMNjU1UEpacDlXcEFBcFB6YVVH?= =?utf-8?B?Z2tUeFlEdTMzaUVHQUNSMS91bURYb3FqeExLdldNWGdLeHg3bG0rYlIwdi9x?= =?utf-8?B?TFc1aFdDT0FmblhXT2xQcGJJc3RVcVl5bnhGM2RDTGtiUUpRMHNRT3loOWRR?= =?utf-8?B?Q2M5Zz09?= X-Microsoft-Exchange-Diagnostics: 1;BY2PR12MB0146;6:Aaip6xRDJy6m3w/VKtCRhrq1Mm4z1gThBwvIsqRAp8y3ReoIeQKUCsdZi2z737xlZ7IY4jgukYpwZM2mF1R09mer+p2BpMui5sqggwcbf/8+x/ttClaACsdF8d4g6fqWRlyUPA3poaTuPHm/+uNUxHmQRMGeOxABpZPhDLIpxOvkeva3R99fVzxm86H54iDvmxEf16VSc9YliDsVHjgLirlQzOhqMKDQweBKHgxhbqAFE+uLwDi86jM9CUcoC4WcDexa+GCC1pdyTTDWwrQr1t+iiVOPRqKH9I27EBaIlXb/QmWJwVlnWUgo6uSuE/nZ8xbQ9S08bab63fTMB0qlHQ==;5:z26uAxxgy7PENQzEBbU0IPw4bmwV+ZsWFNAMz1a9MTC5DZyCv5iciDn6xGzRMT+yA42z0xXQ8MfX9CF5Hs7Aqtu3iwuQSHLFkRftJLRIaKTV/SfNwVQvz3yV1UZg8hnK8jZDvwT7Dy0jkvwGENAKIA==;24:anuvpIkqD6ze/aN0D+okynGD/blVHwiicLPNCmSKM/470uabjAybjXeuBaZ0KNA16ZH6qaGFcrGKIbQtv6xZuIyM98EOD5H7N/SPrx8eGF0=;7:Vad+B1bfsIDqGfQhBaDVV4vFBnDt0/aYMgUSz/5oHWzUdLu+R4E0761Rk+m13hGIbpoSvxsadoMlADoKQK34SAHNfWVr1NHz/c0qF9JYb/yNo6GgnJi/pKmez0aw6QqTeQAl9fmsTwEWQqu+Yyp5pYMPwNh/B9twCdkFye/JBhNyxXq3LT39gTJU5pdh8XjXNz9GVq9H0zkurYkse5BjEtridF1lnMTnWXvrP9Sqxb4= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;BY2PR12MB0146;20:wBkuM1EMltOtvLKu2cu5bCOjZa5F3kfeWOPEdQvnnqh3ybkHlbmaKhZcWwt/qOIAoWY6xPb1Cg9B+C9kJbD1tYSa+yAunM4Umuv/mdFh5WJ0VP7dPGs+unJDaGMJmnI7CPLTT6VXmdFKlcQ/lvT1zbc4MYlcBbCv9J1GGo3UE7p0CBB1Lfy55X1f+lYyDxbOOdLeSoKjX4E0Rjnf2IGlVKJnNUX6TyrLSrnMjjVxx3qeZOJXb9upLC7cmsRbidDn X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Oct 2017 13:45:01.6020 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY2PR12MB0146 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org When SEV is active, guest memory is encrypted with a guest-specific key, a guest memory region shared with the hypervisor must be mapped as decrypted before we can share it. Cc: Thomas Gleixner Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: Borislav Petkov Cc: Paolo Bonzini Cc: "Radim Krčmář" Cc: Tom Lendacky Cc: x86@kernel.org Cc: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org Signed-off-by: Brijesh Singh --- Changes since v6: * use virtual address when call early_set_memory_decrypted() arch/x86/kernel/kvm.c | 40 +++++++++++++++++++++++++++++++++++++--- 1 file changed, 37 insertions(+), 3 deletions(-) diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c index 8bb9594d0761..3df743b60c80 100644 --- a/arch/x86/kernel/kvm.c +++ b/arch/x86/kernel/kvm.c @@ -75,8 +75,8 @@ static int parse_no_kvmclock_vsyscall(char *arg) early_param("no-kvmclock-vsyscall", parse_no_kvmclock_vsyscall); -static DEFINE_PER_CPU(struct kvm_vcpu_pv_apf_data, apf_reason) __aligned(64); -static DEFINE_PER_CPU(struct kvm_steal_time, steal_time) __aligned(64); +static DEFINE_PER_CPU_DECRYPTED(struct kvm_vcpu_pv_apf_data, apf_reason) __aligned(64); +static DEFINE_PER_CPU_DECRYPTED(struct kvm_steal_time, steal_time) __aligned(64); static int has_steal_clock = 0; /* @@ -312,7 +312,7 @@ static void kvm_register_steal_time(void) cpu, (unsigned long long) slow_virt_to_phys(st)); } -static DEFINE_PER_CPU(unsigned long, kvm_apic_eoi) = KVM_PV_EOI_DISABLED; +static DEFINE_PER_CPU_DECRYPTED(unsigned long, kvm_apic_eoi) = KVM_PV_EOI_DISABLED; static notrace void kvm_guest_apic_eoi_write(u32 reg, u32 val) { @@ -426,9 +426,42 @@ void kvm_disable_steal_time(void) wrmsr(MSR_KVM_STEAL_TIME, 0, 0); } +static inline void __set_percpu_decrypted(void *ptr, unsigned long size) +{ + early_set_memory_decrypted((unsigned long) ptr, size); +} + +/* + * Iterate through all possible CPUs and map the memory region pointed + * by apf_reason, steal_time and kvm_apic_eoi as decrypted at once. + * + * Note: we iterate through all possible CPUs to ensure that CPUs + * hotplugged will have their per-cpu variable already mapped as + * decrypted. + */ +static void __init sev_map_percpu_data(void) +{ + int cpu; + + if (!sev_active()) + return; + + for_each_possible_cpu(cpu) { + __set_percpu_decrypted(&per_cpu(apf_reason, cpu), sizeof(apf_reason)); + __set_percpu_decrypted(&per_cpu(steal_time, cpu), sizeof(steal_time)); + __set_percpu_decrypted(&per_cpu(kvm_apic_eoi, cpu), sizeof(kvm_apic_eoi)); + } +} + #ifdef CONFIG_SMP static void __init kvm_smp_prepare_boot_cpu(void) { + /* + * Map the per-cpu variables as decrypted before kvm_guest_cpu_init() + * shares the guest physical address with the hypervisor. + */ + sev_map_percpu_data(); + kvm_guest_cpu_init(); native_smp_prepare_boot_cpu(); kvm_spinlock_init(); @@ -496,6 +529,7 @@ void __init kvm_guest_init(void) kvm_cpu_online, kvm_cpu_down_prepare) < 0) pr_err("kvm_guest: Failed to install cpu hotplug callbacks\n"); #else + sev_map_percpu_data(); kvm_guest_cpu_init(); #endif -- 2.9.5