From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751880AbdJBPHm (ORCPT ); Mon, 2 Oct 2017 11:07:42 -0400 Received: from mail-sn1nam01on0071.outbound.protection.outlook.com ([104.47.32.71]:11680 "EHLO NAM01-SN1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751128AbdJBPHk (ORCPT ); Mon, 2 Oct 2017 11:07:40 -0400 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; Cc: brijesh.singh@amd.com, Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , Paolo Bonzini , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , kvm@vger.kernel.org, x86@kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] x86/CPU/AMD, mm: Extend with mem_encrypt=sme option To: Borislav Petkov References: <20171001171617.uzwfzps7sxowfram@pd.tnic> <20171001194509.4187-1-brijesh.singh@amd.com> <20171001220216.nhwc5momrn7wq3kj@pd.tnic> <6de5cc08-0a0d-cb45-9518-e5b30fd7e276@amd.com> <20171002124107.rwn5ww3wkynxwmsa@pd.tnic> From: Brijesh Singh Message-ID: <715846be-0f2e-07ee-63a0-ba1794d1bcbd@amd.com> Date: Mon, 2 Oct 2017 10:07:33 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.3.0 MIME-Version: 1.0 In-Reply-To: <20171002124107.rwn5ww3wkynxwmsa@pd.tnic> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-Originating-IP: [165.204.77.1] X-ClientProxiedBy: MWHPR08CA0054.namprd08.prod.outlook.com (10.173.236.28) To SN1PR12MB0158.namprd12.prod.outlook.com (10.162.3.145) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 3aa97dab-199d-4989-f1c2-08d509a75222 X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(2017030254152)(48565401081)(2017052603199)(201703131423075)(201703031133081)(201702281549075);SRVR:SN1PR12MB0158; X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0158;3:JXQbt9VO5oY5ACarmf33bhZHZixUSMrtNwH2Yj6sVuA+DXyGve92zve955z5iu67bmCHTaA9gqxZccx73lLFLUbPBhbYfCtDaZ8oMF2kBNR9L/zxzBSEhJPNozAyjlCS/tYYGthBC1P5tXPNrGDa23sNU2QVS8PjfLnsLy5UuiHlbc3ooCOlvU3psUCL6mxxTda1aFAXfyIwJJjS0dsNoyi5RsD4RHjDbTcGoXp1Ib8yGzcAKX8pgopMw7TYVpqa;25:ndQ7PswaLhv7iBeBnd5bW903ifBHhw+svXPv6tnZdd9glhcDIZlwJC8s8g9SPJJp85lsyHf/Gajtjq4ZN85Pvv4mYa9CLjDCtnsxexErkkocIHduTY/6lAGbgWZwl+8qXwTyIRduSC30maU2I3OSzn2n3+3lZhF0sdWwDI3Tr25EaQk41PU7h0culyNlLkevN0uDhOpW0Afl/4WoLt1WQW7F4/FKl5WB4vORmccXcD3Y/QTgajyR0ASp2HjzwfmRWCzX5xJLeRVSYpYXfXDYBlLH+cg+mbtYa0JECBP81sw7NUFvitoupu8qg/3IWzGnhdYExEDRibRl0q47ANS7lg==;31:65Aav6iLO67Aif1unpUqjagAl9MhOTbm/3XvV3Owo976yZPhorx3lQOCvNXK7litUfHAIyrSezEKZdEFJnlvyQjo6tQA5Rli6JuegoeWVPbjFikzhIug5xcvUtqVkxJEp31xyntxj65LZpngeivFtNm5g94HxhJqxceBsZ62UtM87HIc2o52N8dYfAcf/9WJoVVtqhx9wo8nzIz+SMrVxXkoIKYAYsNGqLhvcc7W1sc= X-MS-TrafficTypeDiagnostic: SN1PR12MB0158: X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0158;20:evE1Y5mlz67sOmy0kFw5jIzkeULF+CNhYXDtFLdMVrM1GkYuoXsPsXLCcMfHEDoLyMUyJ0uwk6u+5CbLYNsx79v/S5aZLYn/QGRu+hfaiSn3DQ8hZh/+gvlWGuoBWr/VUp6oxiy8vJ54Nwlqmdo/NNgtAQLlZ14rdPNBFgTo0eFNYbxWv88D4ZosYG4vLBIK1R4Tkx+/bpxb+ssD9T1prvnSkYRbwBfXWzjKRAI/9DakIlb1Sj1WYPbt92ZmMCIu4zx6E9Mu762bnE9EubJDf6TFGUvtwYbRfEXjW/vWVwGwKj2GS77X3mlG8pWUXqGUTBLdZ0qMbI4gcYPnxf4s3MJ5OigvFbSM5iB/IFOnmoEJxxWAi1QCIv8YyYxWW3XrUyKY5vyVLCgySmslvHRnRLulsUtNU3Ob+LpyUwngmxQBoACReqM0x455GVQPTIQb2HB5U6YlMy3sW4GBH10sqxkLofhurKBXckst7rnCtXxGiiPTQrouXtL0TivrKTyL;4:NLmj/SYgfmr0Oi1JUefUEJ4sWd0iMtwOqLY+ji39dc2Ux4uF3L7tgK2wo+TMlMtDHbKZ6IkrxcO8OgvcUyel7es/qjBoyExh+4LHUjXXI/wFOAJCiJyvBro1YOc2wkZFBhv4Dc4uBGNzXBbCsnh/SKq9Scqbr3rhErE9wMt5JkzyHH1QY+emqHimuc15IGRowgASYoPjWBaQlL4+HXwbzKktPDnXE7XSjntEW7EIzb0Vh/cY21tcJqChelCZT42y X-Exchange-Antispam-Report-Test: UriScan:; X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(5005006)(8121501046)(10201501046)(100000703101)(100105400095)(3002001)(93006095)(93001095)(6055026)(6041248)(20161123564025)(20161123558100)(20161123555025)(20161123562025)(20161123560025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:SN1PR12MB0158;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:SN1PR12MB0158; X-Forefront-PRVS: 0448A97BF2 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(6049001)(6009001)(39860400002)(376002)(346002)(43544003)(199003)(377454003)(24454002)(189002)(66066001)(65956001)(101416001)(25786009)(6246003)(65806001)(2906002)(5660300001)(50986999)(4326008)(76176999)(54356999)(3846002)(53936002)(65826007)(6116002)(478600001)(106356001)(230700001)(105586002)(8676002)(81166006)(81156014)(47776003)(189998001)(8936002)(316002)(305945005)(83506001)(33646002)(58126008)(16576012)(7736002)(16526017)(53546010)(93886005)(6666003)(2950100002)(97736004)(6916009)(31686004)(90366009)(36756003)(23676002)(64126003)(50466002)(54906003)(86362001)(229853002)(31696002)(68736007)(6486002)(77096006)(21314002);DIR:OUT;SFP:1101;SCL:1;SRVR:SN1PR12MB0158;H:[10.236.136.62];FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtTTjFQUjEyTUIwMTU4OzIzOlNXTTZCUUVZaldkMWdWR2FoRjhGVHRRSU0y?= =?utf-8?B?ZlRCZVc1dkF3ZFhRd3F0RTZhdGtpeVlsbU9SN3ZLWDYvekh5T2txMVlwRzdo?= =?utf-8?B?b1FpUzczdFRKQ1AvZWliaCtjRG5CVXliTmV1TExBM0hhM2JCMXhXcmo2QldB?= =?utf-8?B?RzBSN1lvKzZOc3RHR1ROTkwyNUFJaHdaOVNYdmNmemxjazhSOWp3cWw4bm0x?= =?utf-8?B?em02NUVadlkzT2ROMUhRUHZhTHY3dkVLQXVCMVdYQmZRMEtrcGZBNzNJUHY4?= =?utf-8?B?Rk53YkFWbWM1TlhWTU5nMGphUU9kcmFzN2t0ZGdSNjNhYklGZitJTGlVa2I4?= =?utf-8?B?SVdpY1JCY3B5cEVpMHdTdGNwU0Q1Wnc3T3UvcW51ZDF3Q1dZM2s1TlJoOS90?= =?utf-8?B?MEJUajZDMU9Ib1hiVEpUS1EvTWxRT3AySy9IYVA5czJWSDVGZ2MzcUg5UlNP?= =?utf-8?B?UzJLajEybFUydWZDakVabjNxajBnWTgxVU1INWJKWTBJNkRqMmE3ZEx0c3ZQ?= =?utf-8?B?cjEyZit5VVoweHQ4YjdPU2JCakE5Q25RVTE2UVRpazc4NzdEVkRnRmtiZS9l?= =?utf-8?B?dkdjcEwrR2Y0ZmdsUnRubUl1SnF4RmpjcXRlOThZaWtBb3hyclROdiszdTM3?= =?utf-8?B?bm11QzVWWDRtUmdUTG5CWFBDYmcyTDBna0c3NHZ2WkJYQUl6YVNxeWRNeUNh?= =?utf-8?B?dCtaMFJScytLTGV0Z1I5Z0RGVVZ1cnNvRHpxRXhwS012Qm1wSnlsRGplcXA1?= =?utf-8?B?aC9zVk9ZKzYxTjcxdkY4Y3hham83UzFHUWZ4SkNkR3FyQmxkd1FKZzUvS0py?= =?utf-8?B?T1EyZ2RTa3ZZZHh4KzBwcGxwQzRMZjlpZkRMWVZVYUxYOE9pcllSNHpDOWR2?= =?utf-8?B?cG9WUTZ5eUU2M3ZhZFNaTC9xcHZYc2NCTVFNeWdZQnVNSFhmUU4xWUVqRnho?= =?utf-8?B?VURlOWx6WEYxTERiazJ3SkdHcElPczJodkFhdXNadGJNekFQMUFTaE9zVU5G?= =?utf-8?B?NTVhc084c3NoenZpbnNCSDM2dDFsOW9QR0F0N1NUZlBVOGVCR2pXUGc2ME45?= =?utf-8?B?Y3FnMDUvNDBaWjFHUU1PWTB1U29GWkpEbEdNMVVmckMzQzRITmFSb21VYVZJ?= =?utf-8?B?b3A5c1hBSmd6RGY4TnlXanBlaEJyZ0xTT014V0hSZ0U1ZHVHL0RpdTI5bFl2?= =?utf-8?B?V014V1A0SUhtVHhOYkNXWDAxTHhzRm9CTGxCNThCam5HMDZUR1V2VEVNSDVk?= =?utf-8?B?eU5YVldzWnQrQ25PcXV6NnAyS2pVbVNISjNZbHJMOFpaSkk3Q2xnYUNLYlpq?= =?utf-8?B?YVdLZ29ZQm5BY1RvbW1TU3B1QjlkVXdHeHVxVkxZOEd0MG5MOEtocXQ2VGFC?= =?utf-8?B?L0RjN1pZZU9JdU5hYzFsZGtDT2cySFoxMXJTVWZQU0VFNUpMa2VyYm04ZW93?= =?utf-8?B?c0hIcjY1dUNYRkZlTmRUYUlFbTc2SlBIdEZHNXBCUWh1b0lsbXRacnR6cm95?= =?utf-8?B?ZjhSeHVFWjRaUU1qV1BUVEdYaWZvRVdFTitJaGpMeWtaUDJQUk0yS2hVNUh2?= =?utf-8?B?ZGNXMnZqN1U5ek1oWHlDM1I0azVsMFpaVUl5NmJ0c2pIeFRGaFBmZ2ltWm9t?= =?utf-8?B?c2k2QjRqUHM2TFp5KzNBWm9PWXV1aHhMQTVPU1BiTHVZWFJ6US93Y2VDajQ2?= =?utf-8?B?b09yNlVJdUdjTi82Y1g4NUJZV29QZ2FaOHYvYVAvbGsxaVNCbW4zc3RYUTk3?= =?utf-8?B?LzdFNWx3aWNJSVhDQS85R0RrVGZ3MzZwRFFudkFLRWRIbGR2b25samJuQVBI?= =?utf-8?B?UjVwamtDTmxYZU9BVGwrVTNWL0hRdUlhcExHZkNONnA2dUNjY3lCVXNvLyta?= =?utf-8?B?Uk1qczZ0QndZRS80Ty9WVlZvMlJleTJkNWo3c3lhNXI0Z0pEMk03ZWhxQTBC?= =?utf-8?B?MTR0QlNzdEo3anpiQXRMMHA2WGhGbS9tTkltUUs5UGVCdjlkWlYwRTVjYlFF?= =?utf-8?Q?N63308?= X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0158;6:YbxxCN5ea9P7lE1lSTC/zAuf4zeZrzcaobME2q0mu3rsnS4Eq8wNNAaFYunQbGbn0vlmaL9ioYgdmUg5iFJ+Yy35wxCvrRvcDOIToZ9MpkswsHYdr3w/vxyLoQHK+QuiE+zniEWYoIw/5x8totb/b4PmyiMXnKqPnVobNS3A7S9LNqdaEVMRZ7mCbEtCzTYR1CS7+aPDBdeX0NFDLeoTw4w1Fs3LzdcI22daoKcx89asKIPOOMT5++acsBiPcS6vlGsiGu2AM66bzcWrJJV3adTE6hiAWb/n6ev4i2z1wmHyIz1v38Jsh547U8S7cRDDuyyx9Y4C4bTvZ+zcwoTkmA==;5:fE0h/i39NFHUdVwQg70lho5b08T1tPXSoShLEm6JTz2+2dEvAxxGCDOKQIth42CrYhpsgiwLsUtvIG0fLimDUzloRZWZyv2ZvyJi6mqcJKz+Sbvf+Ee6rLkW+pt1i6GotvqmrQKVazH89UsIggTCpw==;24:QbR5c3/gBmIon+TQmCHTQg+YiZU9FlncdEEoD9EEPuskC/8kmlffwNuq/rdsnCFnMI/HDcZjhwzhO6OXAIpZgVA1RbVW6gf6KTS2XGtEde0=;7:lD9J4aSi8V7Uxxaa6BrbNz1u4czS7JBuIKfCCXsMyzzoAJnYnfE+2eveXvgbrpB7AXDENvffCkeF/HMokK1RxwGF8r/rFrowhr33wkVh8vajsRXPbtFCtjzKwYU8Tfemr2QaBJZL7pQ98f8jsNBQOxj60GVaAh0T8gqC0cssAI0vDrSqHBvXvRNSFisuoDY3vcPHLjw/P/gnfdz97R63GYm90r298UMUKey9+mS1xbg= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0158;20:h7fmqrcvAzo9l9mKIjD3y0FE4hkbKTBeav9Wfx8S4lKFmAN6HDFY7O6oclXnVguo046d8atfJHfqpfLpht1bNLrzvPtDmTLHf8BQXJubMe9nCY5NM/8ZOkC/hLIhV1MnbpTQHfNMYTQgrKaR1cXQsLTxnzR4zTpCjlDTWJjobz1lB1kt9kzWXeRZRdCjCoLvxvc3Eg0dMPebzRdFxLPTGkvbAmKrGFl+plytI9VBawWNws1xASPX7YHH4Ijwg1DI X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Oct 2017 15:07:37.1878 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN1PR12MB0158 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 10/02/2017 07:41 AM, Borislav Petkov wrote: > On Mon, Oct 02, 2017 at 06:32:18AM -0500, Brijesh Singh wrote: >> Because sev_enabled will always be 'false' when we are booting on bare >> metal. Whereas when we are running under hypervisor then this variable >> will be true for the SEV guest, please see [1]. > > Ok, then. This needs absolutely to be documented. Please add a comment > over sev_enabled's definition. > >> Both sev_active() and sme_active() make use of this variable >> hence we will not be able to set the sev_enabled variable on bare >> metal. Basically none of the SEV cases will be executed on bare >> metal -- only thing which we need to take care of is clearing the >> X86_FEATURE_SEV flag so that hypervisor will never launch SEV guest >> when mem_encrypt=sme option is provided. > > In that case, you want to disable SEV at the guest loading point, > i.e., sev_guest_init() AFAICT is the earliest time we start prepping > a SEV guest. You can add a __setup() early param which parses > "mem_encrypt=sme", to arch/x86/kernel/cpu/amd.c and which sets a > sev_host_enabled bool or so. sev_guest_init() can then check that > variable before going any further. No need for any of that early parsing > changes. Yep, that will work just fine. There are couple of ways we can limit hypervisor from creating the SEV guest 1) clear the X86_FEATURE_SEV bit when mem_encrypt=sme is passed or 2) parse the mem_encrypt=xxx in kvm-amd.ko and fail the KVM_SEV_INIT when mem_encrpt=sme or mem_encrypt=off. I was not sure which way to go. We can go with #2 and kvm folks have any concern then we can go back to #1. I will update KVM_SEV_INIT patch and send you v4.1. -Brijesh