From patchwork Tue Aug 24 11:04:35 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Kalra, Ashish" X-Patchwork-Id: 12454795 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 22BE4C4338F for ; Tue, 24 Aug 2021 11:05:23 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id EF60061371 for ; Tue, 24 Aug 2021 11:05:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236421AbhHXLFf (ORCPT ); Tue, 24 Aug 2021 07:05:35 -0400 Received: from mail-bn8nam11on2078.outbound.protection.outlook.com ([40.107.236.78]:9635 "EHLO NAM11-BN8-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S236327AbhHXLFe (ORCPT ); Tue, 24 Aug 2021 07:05:34 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=EumJEpxVrbP2emah4yPo7zBzuWY0d+3sJJvd3qcOX9YGPGwYG3+CQ8Px3wuXpjs48CHNPl5sbYt3jUqdCanZxNIBdJtlLL6I4SatfK9NXzaCzjfBdQqFMD/WBedYzT7426/mQ9NZm7R+fgxrCcrp6s6kjnNeOuU3hFt2imQ7z8KyZnBIxpsWTLEB7zQzsAI3YRQfTeQDAy/MqjAQQqOgqDAOPRrh42sw850BFqNu8E4Jr4RJ9YOXCKRL6OFXp35z7BXR8cd260pfN4ogOT2AcEcbrh++CMJv0pnp1F4XBtktQVidVg8oWDD5aM7FdnJtygZrj8/Ga/FdfffOX73p+g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/XBquK0XcJHWbJXF9Y6rxYl4ULJia69zhpS5165zn+M=; b=ZRYkIJlN5DjTPS+crp05X55NTHnmq5c2g7E1o6SiXxZCvzcCCaldvbJw/q+6jk+RC6W4qZCInz8NFbLgxeRdrQLC41tuLoPyDCQ7uhpeY2oLoFuCe5eACyvprWbAOQ3iB4VHvWTpwR48QyKYQOEezMEwwM0mfiQ0/Ysc4azHt6LFjIOnGnHYowdvTF4JDg2GIIwF3ROqVRrEE7Lxt1OvBzglaBxbRj2VOavxwEG4ePflfSkfozbv2xAd6YHKOD/py5Ppk1nG7HKrOebTLxVypQZx9dVXWDB1G42wcGKgUIPhUCbb51ZF3yT8JOYIr+vmLSBxrgpOiiNs/5Lk0HGezQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/XBquK0XcJHWbJXF9Y6rxYl4ULJia69zhpS5165zn+M=; b=aGIbges/5clJRztotilWLDsKMT0rpwD8UnaCoFufuOgttbGo+VjvNwzvTvVIc+XpPwbqG+YqujimvUltqACTFl0Rv38T4sJ9fEr1GAMTyl7yGIFfN4eZoMsNh07sBH91Io+KwGSiRj8hFUka/96glr3sv2G58tFbByZacNe5JHA= Authentication-Results: redhat.com; dkim=none (message not signed) header.d=none;redhat.com; dmarc=none action=none header.from=amd.com; Received: from SN6PR12MB2767.namprd12.prod.outlook.com (2603:10b6:805:75::23) by SN1PR12MB2544.namprd12.prod.outlook.com (2603:10b6:802:2b::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4436.19; Tue, 24 Aug 2021 11:04:47 +0000 Received: from SN6PR12MB2767.namprd12.prod.outlook.com ([fe80::491e:2642:bae2:8b73]) by SN6PR12MB2767.namprd12.prod.outlook.com ([fe80::491e:2642:bae2:8b73%7]) with mapi id 15.20.4436.024; Tue, 24 Aug 2021 11:04:47 +0000 From: Ashish Kalra To: pbonzini@redhat.com Cc: seanjc@google.com, tglx@linutronix.de, mingo@redhat.com, hpa@zytor.com, joro@8bytes.org, bp@alien8.de, Thomas.Lendacky@amd.com, x86@kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org, srutherford@google.com, brijesh.singh@amd.com, dovmurik@linux.ibm.com, tobin@linux.ibm.com, jejb@linux.ibm.com, dgilbert@redhat.com Subject: [PATCH v6 1/5] x86/kvm: Add AMD SEV specific Hypercall3 Date: Tue, 24 Aug 2021 11:04:35 +0000 Message-Id: <6fd25c749205dd0b1eb492c60d41b124760cc6ae.1629726117.git.ashish.kalra@amd.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: References: X-ClientProxiedBy: SA0PR11CA0101.namprd11.prod.outlook.com (2603:10b6:806:d1::16) To SN6PR12MB2767.namprd12.prod.outlook.com (2603:10b6:805:75::23) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from ashkalra_ubuntu_server.amd.com (165.204.77.1) by SA0PR11CA0101.namprd11.prod.outlook.com (2603:10b6:806:d1::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4436.19 via Frontend Transport; Tue, 24 Aug 2021 11:04:47 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 7edf858c-7cc4-44de-9be0-08d966eefc81 X-MS-TrafficTypeDiagnostic: SN1PR12MB2544: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:9508; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: lxtgLBUWjH1ifRpqQYS7rU5yCKLQ9MP+iERcGc7iHiSUimb5xw+ogL+1zYyxtXqGUXIAABWyMiEO7qsy9zssQC5DxVwFKq83FrGBaPy+V4edqhQRvJ3x+SwjFtQ7kE/MZaomYlObMgcFCl0l7N5ps+vDyvm2XczTS8DlGj4gkCAOzfdmMk9dyRsWjDVBH7MD8i1XnNcq6VuZ7MKCTVVGA1WRJtGkBgS6wo4XyaTNBqjoFTRfb49ahuEyH4OXuZ4a4ARm0mQKMRfWUvvcakPcNjotFDxyGhY3lhiOPOrjN6qf95GesBEg8UzmGBvkR+fgoHNt8ZH4NUiS/T3OGjXc88PqLmGerTAzd1R80WsnvSHPEbKOCKy/VWoeQpKRi98iA91bB3rm2dTg/9zhqvD+Keog21WnTpmOnn+6UIw+sS58tIQ2pQ3/hfydCBl+NeQgBqV6pr5PHCwmmLoYPBDRT9m4LaHAZ7y5o1nCTz5uTnIfDq1QPvTjkpDMgVJNp/RDq//8yFTDgYUEhZIZq7i4ZR24zzR2Oz0Om9yXQYqf+nSZQamSt71buRgY2AZcDWGyJ7GfuoO+RKR75I31S0GfkenDyEnvBbeoPLo6c1Jxhqb8q5WsPmxJfQ8vzH8XzsSxduu2srT5/B6dhYgdwr+pn82N41p9Str3Se2HX4Y3Ygah5A8MSyzpJN/wEPljnVLzEb7Unl8Y/8jTK2acY74Dfg== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SN6PR12MB2767.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(366004)(136003)(376002)(396003)(39860400002)(346002)(36756003)(83380400001)(2906002)(6666004)(6916009)(956004)(86362001)(66476007)(5660300002)(52116002)(8936002)(26005)(2616005)(7696005)(66946007)(478600001)(38350700002)(38100700002)(6486002)(186003)(4326008)(316002)(8676002)(7416002)(66556008);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: MCa4hGGuCYkgUPgpRzXT35H6GZeVHKrT3d+YYr0IFPc5vZGMZorswSLGSplFFNtEAsLLW6r72UiggS8KvCfTMoAn04UTXrdzOaRiF1j2x+fGQCduuwnXE7ySzxDWSOZoCVu+cw/oNLmUY7UVh4XUh65m4lFfsTwJVeC5hTc2t+VpSoYrq2anYN8rTsBbT7W1WiRM8+xyyl6LSzi0BYV4weyf+Zc+XpnhM5X9ZhZNcVrfvYWnQLs9454uGO7nar4SSqBcQEUq1BK+MzyxshVeuIq8GdXcxzaBR2uxCq3gfN8XeT0vniiar/ktYhkewUylUi/gZvKVblsDYoAKXik4Z4UQwYkrHqut+k7I6STTX+9zFAluOSTzWAq3+oVc3Hk1qw5nmmlFuZvVSJhAZB0SFk3jA7BP5JagtIC7Beo/BbKbRw7L0FRGmb+yxTIZDNlPHucje+FCJtODh3ATOq/UO2t1taOewI59X4LYYTLc/6qtLmfuAtARDWTP74cGaej9/60x/7/sgrmq3RqyhHb5ilNwgVa56S0KKoO8rVJbohgNXjvaoO+owvieJjiuzP03XqFYHfUzirWm4uTjRxKQmfJlpX3lkwdlKBcPWZTHDVI8rdg1kR3XIST9XHZQV6J4XOxb+IMEuMZAJVD9VOT0+HiAa5l+PZqlu08mdH5/tOsFuXsbFGQl/b9uSdGNeUxl1CN4gcbC8GczfBn9oJrCzEoCTQyHsXfZtZ1atljECEJ0nO6UfKnQq6gqQvWhMq46TLUGCPDiL/OEgYFbbHFq1XVJYviY/d7vtn2rU6ZffQ4aSH8pDPB0vfgnVDGzN3tN6AwxhETgJ9ZaReu1w2fNXJQahkSy98aHlLUNACKOTnFgZw4yA52gW9oCih43jtGU1oY87hBhvwqSKFm8deQ+nhsAMDe2xANX3XfoUd1Yi0to65+cwiK+NA5ooIQeMQ5qpB12YS+Wd2jpLcLoDFYzwDtfGsS2K1+K2k7ke3fGyKQmin9RO9fgZtf8Y7wQmo0M2aNyx32WW3rSASVdNStDUNceXkGO7EPI9WDtEVJxlxgNEAKKtQCHJ7+U3DpGJyO++HmTu+qxBfnDncCvbBsr5ecB3O1Fcx0OStxhReZLJixtZFJAapL6wRsMalENMc46dXsucW7JWlP94zjxKoqsv5GeZRY6/PjoZi12ySk2/hsd8RDpcdJI/bTabvZhJJRirAZo4RYa9bRs1+paWsqQjHJ4IGUv1+Srom40Zlidxuza0pPiVbWjz0RIkBEn/+8Jfk+/cv8gKNai1jpPjfyJIMkyf1UQ0XDhNok6Udqxz+9QhPwv3no81R4Fkw8a4ecY X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7edf858c-7cc4-44de-9be0-08d966eefc81 X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2767.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Aug 2021 11:04:47.6186 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: mHBzsXcelvdeKJRsdLoFzPAJLfMg767hmyBhYHeGf8f8Tz6uJ/tr1S8kdryr1T/xjjXbhffM5Mycdht/goX+Aw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN1PR12MB2544 Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org From: Brijesh Singh KVM hypercall framework relies on alternative framework to patch the VMCALL -> VMMCALL on AMD platform. If a hypercall is made before apply_alternative() is called then it defaults to VMCALL. The approach works fine on non SEV guest. A VMCALL would causes #UD, and hypervisor will be able to decode the instruction and do the right things. But when SEV is active, guest memory is encrypted with guest key and hypervisor will not be able to decode the instruction bytes. To highlight the need to provide this interface, capturing the flow of apply_alternatives() : setup_arch() call init_hypervisor_platform() which detects the hypervisor platform the kernel is running under and then the hypervisor specific initialization code can make early hypercalls. For example, KVM specific initialization in case of SEV will try to mark the "__bss_decrypted" section's encryption state via early page encryption status hypercalls. Now, apply_alternatives() is called much later when setup_arch() calls check_bugs(), so we do need some kind of an early, pre-alternatives hypercall interface. Other cases of pre-alternatives hypercalls include marking per-cpu GHCB pages as decrypted on SEV-ES and per-cpu apf_reason, steal_time and kvm_apic_eoi as decrypted for SEV generally. Add SEV specific hypercall3, it unconditionally uses VMMCALL. The hypercall will be used by the SEV guest to notify encrypted pages to the hypervisor. This kvm_sev_hypercall3() function is abstracted and used as follows : All these early hypercalls are made through early_set_memory_XX() interfaces, which in turn invoke pv_ops (paravirt_ops). This early_set_memory_XX() -> pv_ops.mmu.notify_page_enc_status_changed() is a generic interface and can easily have SEV, TDX and any other future platform specific abstractions added to it. Currently, pv_ops.mmu.notify_page_enc_status_changed() callback is setup to invoke kvm_sev_hypercall3() in case of SEV. Similarly, in case of TDX, pv_ops.mmu.notify_page_enc_status_changed() can be setup to a TDX specific callback. Cc: Thomas Gleixner Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: Paolo Bonzini Cc: Joerg Roedel Cc: Borislav Petkov Cc: Tom Lendacky Cc: x86@kernel.org Cc: kvm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Reviewed-by: Steve Rutherford Reviewed-by: Venu Busireddy Signed-off-by: Brijesh Singh Signed-off-by: Ashish Kalra --- arch/x86/include/asm/kvm_para.h | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/arch/x86/include/asm/kvm_para.h b/arch/x86/include/asm/kvm_para.h index 69299878b200..56935ebb1dfe 100644 --- a/arch/x86/include/asm/kvm_para.h +++ b/arch/x86/include/asm/kvm_para.h @@ -83,6 +83,18 @@ static inline long kvm_hypercall4(unsigned int nr, unsigned long p1, return ret; } +static inline long kvm_sev_hypercall3(unsigned int nr, unsigned long p1, + unsigned long p2, unsigned long p3) +{ + long ret; + + asm volatile("vmmcall" + : "=a"(ret) + : "a"(nr), "b"(p1), "c"(p2), "d"(p3) + : "memory"); + return ret; +} + #ifdef CONFIG_KVM_GUEST void kvmclock_init(void); void kvmclock_disable(void); From patchwork Tue Aug 24 11:05:00 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Kalra, Ashish" X-Patchwork-Id: 12454797 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4798BC432BE for ; Tue, 24 Aug 2021 11:05:23 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 20239613AB for ; Tue, 24 Aug 2021 11:05:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236610AbhHXLGD (ORCPT ); Tue, 24 Aug 2021 07:06:03 -0400 Received: from mail-bn8nam11on2085.outbound.protection.outlook.com ([40.107.236.85]:65342 "EHLO NAM11-BN8-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S236601AbhHXLF6 (ORCPT ); Tue, 24 Aug 2021 07:05:58 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=dbB0QrTTv96fyGWJnf0mRrgFn5rddDDn0Ef8CUEW6inpWCVuVYjROUAOtnaT1MhxPXoAhgK0GWfh4NQkPhKUNT/sz0bPgVuzXsSDIxrok6P7coQ/JSxyW3u4JeIC8zGJWE0WX2MrWYPngJ4kRrsWl7uPoDcQhuuvLMR8CoO1vBNaqAs2fILh1wVTFlOF0sLYrPRCYazkfe/cqYUcQSuuTWHh3Emz2f2o+r9t+Q0VaoG7VEgeeWTP+eRjFsrmfRQcHIkVc+1Cw7HPzBvDM9MOA1rM/sGCsHMI3svg3TSqJ5jICOZTe/dx0EMDSwvctK9zrBExOZBFaQbAWj6MZ0s8pA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=slkbt5DX+7qkTH/MJzZRKo3B9pqMRUFT25eGHR/gFjM=; b=jlB8AqNAhiBgZCzTlgFCRtV7gwuk4NrBFS/VOTeAay9mSJDbsto6q2trIDHyYXdlsSH1h9FV3ORMxz3vVpaKJ7moJQp4DqJsVTls7e3RYOsJhO5yLBF3Q5mXc/fk+rBQ5d1eXTAXuG801fawYkcToZ2EO1IMZvNDjU8yB1FBFkCmWN+erK8SEx7sX9VSKq11DWN4w/VznouTR+Lnno4XCwGSu8sHCuPhJJ+5qpvEPdLQHVDZN0PR+3S5qfO6/DkYUXEduQdOoeahDkBZjDIWHWZIr3mgFPFK76HqDaMDe7p5MP9wqvoOuapDpx4/Vlpc4PVp2yb4bbo0pfNW1rUZog== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=slkbt5DX+7qkTH/MJzZRKo3B9pqMRUFT25eGHR/gFjM=; b=i/KJQq+c8Xr1UW+45gg3sqa4XYm7ml8mrONWvU/G0w6xLuVu0wXJxVxm6UZNFHJ5gXREEHODW2w+BX6Uh0AixsEOagg7Qcrn5THQERkEd/LzTF2aGE5a2EuxpI9otTUAD5J+MPrS/CBYqo2tzEQXkps7QLF30AtdNrlb2gYtNbw= Authentication-Results: redhat.com; dkim=none (message not signed) header.d=none;redhat.com; dmarc=none action=none header.from=amd.com; Received: from SN6PR12MB2767.namprd12.prod.outlook.com (2603:10b6:805:75::23) by SN1PR12MB2544.namprd12.prod.outlook.com (2603:10b6:802:2b::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4436.19; Tue, 24 Aug 2021 11:05:11 +0000 Received: from SN6PR12MB2767.namprd12.prod.outlook.com ([fe80::491e:2642:bae2:8b73]) by SN6PR12MB2767.namprd12.prod.outlook.com ([fe80::491e:2642:bae2:8b73%7]) with mapi id 15.20.4436.024; Tue, 24 Aug 2021 11:05:11 +0000 From: Ashish Kalra To: pbonzini@redhat.com Cc: seanjc@google.com, tglx@linutronix.de, mingo@redhat.com, hpa@zytor.com, joro@8bytes.org, bp@alien8.de, Thomas.Lendacky@amd.com, x86@kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org, srutherford@google.com, brijesh.singh@amd.com, dovmurik@linux.ibm.com, tobin@linux.ibm.com, jejb@linux.ibm.com, dgilbert@redhat.com Subject: [PATCH v6 2/5] mm: x86: Invoke hypercall when page encryption status is changed Date: Tue, 24 Aug 2021 11:05:00 +0000 Message-Id: <0a237d5bb08793916c7790a3e653a2cbe7485761.1629726117.git.ashish.kalra@amd.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: References: X-ClientProxiedBy: SN6PR01CA0005.prod.exchangelabs.com (2603:10b6:805:b6::18) To SN6PR12MB2767.namprd12.prod.outlook.com (2603:10b6:805:75::23) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from ashkalra_ubuntu_server.amd.com (165.204.77.1) by SN6PR01CA0005.prod.exchangelabs.com (2603:10b6:805:b6::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4457.17 via Frontend Transport; Tue, 24 Aug 2021 11:05:11 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 691855f7-6a39-4d2a-6fb5-08d966ef0af9 X-MS-TrafficTypeDiagnostic: SN1PR12MB2544: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:4502; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: osG6ehWtsCqZKomiJ0rpNUGXw0QlF2QO2hxji311rQFnxPiSizmgH5CDD3+wv1i5QxxqZDrGW6ha/o22QE7aktUeMAdo8RoYGK0wO82VYBc73E5AQXuPWTRkJBAflCplZWXAT3XkwE6ngCp/h72x9WOec+eUjSWbb/kot8XrqidCC5if4HmsgdHGSCuBYuClfKsS73cV8yUP/Or8ywFYoBInJTjGNRRhSCjBKQ5zY4q5vNbJVZl3J1E/DORU47BqWuJEiNW5xZzqEoYi+wYL7vnM3I8BnhGSh00JJE7+yxh+nOfc/4U0wXEqcTlvbUMCpkFiL4qjH9DuXNrwV2Ub8/IBYABOuQzEvF4K6W9U23RFVUudIIcwPlqKA9PHZW0D+FrYzaQi8rAph/bSANLvQPYcea1TQvCY/rlAcayFToRyeVjXWn2K1sB6f9vRYyK5e38usxA2uYpeRjP1dFDN0Ej60+OiNRexMEcne+3ayIobXwq/xCIrCEl1+2m7Pt1/kImAJADWopTa5gzvdSrhAzY3VznnvmfVwls4yCcDZb7pTxydAM4zXecdKBZHza2dgk8rpULDucIxDx5goLKfj+w6SKQkMb91ol9fJduhMBazHUraSzaa1JwKwVEfUdlliPWVwYz+kc1lZvOggdwU2GQhxtvr1Koqgwn0IXcUc7NNELU6roNgIrfVCW7otIzwS/yEW7QYPlO6lAF1EJ0vJg== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SN6PR12MB2767.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(366004)(136003)(376002)(396003)(39860400002)(346002)(36756003)(83380400001)(2906002)(6666004)(6916009)(956004)(86362001)(66476007)(5660300002)(52116002)(8936002)(26005)(2616005)(7696005)(66946007)(478600001)(38350700002)(38100700002)(6486002)(186003)(4326008)(316002)(8676002)(7416002)(66556008);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: mJIb+olE7bPbXhgscNUP6P1VVRb+1AaAqSkWzpDr2SdmyoMVUbQcBElQ7pnjmOA6MEI16nFzI2rIkdfQ8A0/7Y3SaTum/L7XDN+Yl6TS+11spTWBl4cDP1Vm5ZXR0N52VD2an0fdwvNJaEcPfQdia8saTJFveQsYBxzxkeSe/Bap2dVTdKCLTmikGY48G/+MLkhoX7noSOKmPN7oB6ODq3aVoeAgL9JW3RLp36tlI6XIezAgIt2mnZRa2hQa+toxYooOaqwsbrSsgSFhxPVSAOnpdbe41m0Mxo7JzQDE9Xhot9tJZ4dkiV0ssy8Hebcgr2WBtDIjNNf/EhZcAbopym73wmPU/j6ToXzLZV4H3K2VL82fMEhlz6gsJcrHS1lwcc48qWJemDms6OrvryBtnlHpQzBN+LExhlGX2CphUhEh8q+v/ocf6Qx883koJ7wcZlkMWML8uKdW8S+AdwQBNqX21mKbDiZG3H7ApvXNPBYnFf9bNMtWT1BUV43XzYJUKu1yf5teDvSlhRNH8RYKSBNFKYibfHe+w25Zu7cbK0g6HhrwEZW2zr06wACqSd/fO3PigNDmrLL9FSFU96z4zpiq7GN1byHZZVLGhLzGotZrLU5C2wzRyqqBAKMzqL8dNHDUbKClQsk7v7s+yYxqlIoPgMZGpVRk6KIc+tQ4n5wKzl5HAJjkEY2Fa7ena5e5KyJdH0hnFw9aQvZSjfiRhgM9zk7odiD9kyag29+vShK30KC3Jn+FuzUvuvbN1RTo5JRVMwe35q6L/41hd01DbFuUahsaZVS8arrZEirnw1I21+b/wJNAd37GEIbHHXeBIF5YVC25fbB3FwEU30LcT/WRsaFH7WjuLRGTTqrfZdspHtBCoqlB3j7Yttg+yZKj6aNWBM9ePrcU5oETMtS+Ul9VA9c28VexUvg5NaR1xrVxpu4ObIhGbfR6X94JynsKRZO5t7s/IDDxhrlBrCweyfO3gwjUHdZngL+AvaNpYf6Hm226k0nU3wwMLt4nuCFOkNpCJlmA8+IFSHd+TDbUP7iDSfCgFXHKg9mcF3mWpElMhHqrZPeaBuVlJZNyHp8rw9BfxXjR0AzbSPPJX8TevhEWZt3l3/FkZhDh5PDEZNUpk34N5kpi9jc/rgit6uTVxTW4fXRHOLQvLRQUDh7eWtOP5ynMe94pstAcgtiHoo+la626TonRKuWbwma7sX1zShN3FPb/LgLLRDdHwtTyH/Z4dCcta1m0yi5p3PxNlIxhy0ZCK/2DriKh/Uw05YCpVujR4GffZiQHe/wbntvkICNXHT3/rqZAyeUhPY/a7pzZs5PQx9kiZNVuSnPywWdC X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 691855f7-6a39-4d2a-6fb5-08d966ef0af9 X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2767.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Aug 2021 11:05:11.8351 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: pYaW78HTf8ShvNkUm2L3Civ/TD/xYCxE8wGiVlsbs+1rME70kbTcqNXTQeFNDE9n/hhCNeB9vmvRYBeh4yCAHw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN1PR12MB2544 Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org From: Brijesh Singh Invoke a hypercall when a memory region is changed from encrypted -> decrypted and vice versa. Hypervisor needs to know the page encryption status during the guest migration. Cc: Thomas Gleixner Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: Paolo Bonzini Cc: Joerg Roedel Cc: Borislav Petkov Cc: Tom Lendacky Cc: x86@kernel.org Cc: kvm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Reviewed-by: Steve Rutherford Reviewed-by: Venu Busireddy Signed-off-by: Brijesh Singh Signed-off-by: Ashish Kalra Reviewed-by: Borislav Petkov --- arch/x86/include/asm/paravirt.h | 6 +++ arch/x86/include/asm/paravirt_types.h | 1 + arch/x86/include/asm/set_memory.h | 1 + arch/x86/kernel/paravirt.c | 1 + arch/x86/mm/mem_encrypt.c | 67 +++++++++++++++++++++++---- arch/x86/mm/pat/set_memory.c | 6 +++ 6 files changed, 73 insertions(+), 9 deletions(-) diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h index da3a1ac82be5..540bf8cb37db 100644 --- a/arch/x86/include/asm/paravirt.h +++ b/arch/x86/include/asm/paravirt.h @@ -97,6 +97,12 @@ static inline void paravirt_arch_exit_mmap(struct mm_struct *mm) PVOP_VCALL1(mmu.exit_mmap, mm); } +static inline void notify_page_enc_status_changed(unsigned long pfn, + int npages, bool enc) +{ + PVOP_VCALL3(mmu.notify_page_enc_status_changed, pfn, npages, enc); +} + #ifdef CONFIG_PARAVIRT_XXL static inline void load_sp0(unsigned long sp0) { diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h index d9d6b0203ec4..664199820239 100644 --- a/arch/x86/include/asm/paravirt_types.h +++ b/arch/x86/include/asm/paravirt_types.h @@ -168,6 +168,7 @@ struct pv_mmu_ops { /* Hook for intercepting the destruction of an mm_struct. */ void (*exit_mmap)(struct mm_struct *mm); + void (*notify_page_enc_status_changed)(unsigned long pfn, int npages, bool enc); #ifdef CONFIG_PARAVIRT_XXL struct paravirt_callee_save read_cr2; diff --git a/arch/x86/include/asm/set_memory.h b/arch/x86/include/asm/set_memory.h index 43fa081a1adb..872617542bbc 100644 --- a/arch/x86/include/asm/set_memory.h +++ b/arch/x86/include/asm/set_memory.h @@ -83,6 +83,7 @@ int set_pages_rw(struct page *page, int numpages); int set_direct_map_invalid_noflush(struct page *page); int set_direct_map_default_noflush(struct page *page); bool kernel_page_present(struct page *page); +void notify_range_enc_status_changed(unsigned long vaddr, int npages, bool enc); extern int kernel_set_to_readonly; diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c index 04cafc057bed..1cc20ac9a54f 100644 --- a/arch/x86/kernel/paravirt.c +++ b/arch/x86/kernel/paravirt.c @@ -296,6 +296,7 @@ struct paravirt_patch_template pv_ops = { (void (*)(struct mmu_gather *, void *))tlb_remove_page, .mmu.exit_mmap = paravirt_nop, + .mmu.notify_page_enc_status_changed = paravirt_nop, #ifdef CONFIG_PARAVIRT_XXL .mmu.read_cr2 = __PV_IS_CALLEE_SAVE(native_read_cr2), diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c index ff08dc463634..455ac487cb9d 100644 --- a/arch/x86/mm/mem_encrypt.c +++ b/arch/x86/mm/mem_encrypt.c @@ -228,29 +228,76 @@ void __init sev_setup_arch(void) swiotlb_adjust_size(size); } -static void __init __set_clr_pte_enc(pte_t *kpte, int level, bool enc) +static unsigned long pg_level_to_pfn(int level, pte_t *kpte, pgprot_t *ret_prot) { - pgprot_t old_prot, new_prot; - unsigned long pfn, pa, size; - pte_t new_pte; + unsigned long pfn = 0; + pgprot_t prot; switch (level) { case PG_LEVEL_4K: pfn = pte_pfn(*kpte); - old_prot = pte_pgprot(*kpte); + prot = pte_pgprot(*kpte); break; case PG_LEVEL_2M: pfn = pmd_pfn(*(pmd_t *)kpte); - old_prot = pmd_pgprot(*(pmd_t *)kpte); + prot = pmd_pgprot(*(pmd_t *)kpte); break; case PG_LEVEL_1G: pfn = pud_pfn(*(pud_t *)kpte); - old_prot = pud_pgprot(*(pud_t *)kpte); + prot = pud_pgprot(*(pud_t *)kpte); break; default: - return; + WARN_ONCE(1, "Invalid level for kpte\n"); + return 0; } + if (ret_prot) + *ret_prot = prot; + + return pfn; +} + +void notify_range_enc_status_changed(unsigned long vaddr, int npages, bool enc) +{ +#ifdef CONFIG_PARAVIRT + unsigned long sz = npages << PAGE_SHIFT; + unsigned long vaddr_end = vaddr + sz; + + while (vaddr < vaddr_end) { + int psize, pmask, level; + unsigned long pfn; + pte_t *kpte; + + kpte = lookup_address(vaddr, &level); + if (!kpte || pte_none(*kpte)) { + WARN_ONCE(1, "kpte lookup for vaddr\n"); + return; + } + + pfn = pg_level_to_pfn(level, kpte, NULL); + if (!pfn) + continue; + + psize = page_level_size(level); + pmask = page_level_mask(level); + + notify_page_enc_status_changed(pfn, psize >> PAGE_SHIFT, enc); + + vaddr = (vaddr & pmask) + psize; + } +#endif +} + +static void __init __set_clr_pte_enc(pte_t *kpte, int level, bool enc) +{ + pgprot_t old_prot, new_prot; + unsigned long pfn, pa, size; + pte_t new_pte; + + pfn = pg_level_to_pfn(level, kpte, &old_prot); + if (!pfn) + return; + new_prot = old_prot; if (enc) pgprot_val(new_prot) |= _PAGE_ENC; @@ -285,12 +332,13 @@ static void __init __set_clr_pte_enc(pte_t *kpte, int level, bool enc) static int __init early_set_memory_enc_dec(unsigned long vaddr, unsigned long size, bool enc) { - unsigned long vaddr_end, vaddr_next; + unsigned long vaddr_end, vaddr_next, start; unsigned long psize, pmask; int split_page_size_mask; int level, ret; pte_t *kpte; + start = vaddr; vaddr_next = vaddr; vaddr_end = vaddr + size; @@ -345,6 +393,7 @@ static int __init early_set_memory_enc_dec(unsigned long vaddr, ret = 0; + notify_range_enc_status_changed(start, PAGE_ALIGN(size) >> PAGE_SHIFT, enc); out: __flush_tlb_all(); return ret; diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c index ad8a5c586a35..4f0cd505f924 100644 --- a/arch/x86/mm/pat/set_memory.c +++ b/arch/x86/mm/pat/set_memory.c @@ -2020,6 +2020,12 @@ static int __set_memory_enc_dec(unsigned long addr, int numpages, bool enc) */ cpa_flush(&cpa, 0); + /* + * Notify hypervisor that a given memory range is mapped encrypted + * or decrypted. + */ + notify_range_enc_status_changed(addr, numpages, enc); + return ret; } From patchwork Tue Aug 24 11:06:40 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Kalra, Ashish" X-Patchwork-Id: 12454799 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 14316C432BE for ; Tue, 24 Aug 2021 11:06:57 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id F2B7D613AB for ; Tue, 24 Aug 2021 11:06:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236630AbhHXLHj (ORCPT ); Tue, 24 Aug 2021 07:07:39 -0400 Received: from mail-dm6nam11on2075.outbound.protection.outlook.com ([40.107.223.75]:13466 "EHLO NAM11-DM6-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S236443AbhHXLHi (ORCPT ); Tue, 24 Aug 2021 07:07:38 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=j0afvSI5T55wiq45my1TKXbU4uUWghYID/qlOmW0NZJVQMZ6WIZKHek4yTGxpM57mLShAygHYtAOpvM+O+1VKA1ngSsp4ZumU+BSQnT/HIku8ad+FOlynY4FTLEQcj2TuTamAeHdBja+6TTom5PXtS3D0WPusstfzA/Et7gFkOET/gZNUnXCauk34RhtMjBWjFpxB0csvUuNf3Nv7r6KoH0qeigXVJPQan9L372vmFwTv+9fTrQHeZyeT9QU2VOxcNyJo2iUucFct/bBBSI9DuBCP6X9Yn7Jh+fku10fFTHIZuonOgPccK5xOjK+pOsFlvt5Vl/YDKqnNrR+qfifUw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ImYRURSA0MWns+++F1GteOzG2evYIUzjTgbdkzculhc=; b=VqKEqV2Rj9WNViTlG9F5PIC3ghxZVCD3lrZZzeBKE+18n5lWcQFKScJJ9NqcRLBMRRyNLUaGzVrItHmDt8biw/BsoFXP/oKk6vsl4ZoRgOPFDKleoL00bnijhADGhAcQjw95ROLOqE2l6BkLF9guBDKrCnN4trVepuWLAw8nQgG5RADd5aApAtRuYWWliTlVr2h3U3pRPrdW825gLqHNLyVL+nKTEwjgsm1EHMaB9YrSsAjRZ+qjlULA+OoVPBHTkfdTH435eWLPiyUA0uVEThpP3EPT0e2tK8lYV0JaHQL1lwVWFIN3KK2nKr4e/L7NErUgVf7U30Hq4Z2FOzBHHg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ImYRURSA0MWns+++F1GteOzG2evYIUzjTgbdkzculhc=; b=mmujYlpBmKOtV88GIKOsXuA6K2vxM5OA5J3gsyBFtw5eoChWFEzTbWtc/ypWVisKHgVxeHOcC9L2U/G0ckiTq0upyCc6FoWBpxatMh1Xx0lsH1QB6D9ZUt62faFZf+XFRqITP6Dzzij8x+5QqUGUygJ/58duX/fwFg/aVU+zhLU= Authentication-Results: redhat.com; dkim=none (message not signed) header.d=none;redhat.com; dmarc=none action=none header.from=amd.com; Received: from SN6PR12MB2767.namprd12.prod.outlook.com (2603:10b6:805:75::23) by SN6PR12MB2637.namprd12.prod.outlook.com (2603:10b6:805:6b::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4436.22; Tue, 24 Aug 2021 11:06:51 +0000 Received: from SN6PR12MB2767.namprd12.prod.outlook.com ([fe80::491e:2642:bae2:8b73]) by SN6PR12MB2767.namprd12.prod.outlook.com ([fe80::491e:2642:bae2:8b73%7]) with mapi id 15.20.4436.024; Tue, 24 Aug 2021 11:06:51 +0000 From: Ashish Kalra To: pbonzini@redhat.com Cc: seanjc@google.com, tglx@linutronix.de, mingo@redhat.com, hpa@zytor.com, joro@8bytes.org, bp@alien8.de, Thomas.Lendacky@amd.com, x86@kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org, srutherford@google.com, brijesh.singh@amd.com, dovmurik@linux.ibm.com, tobin@linux.ibm.com, jejb@linux.ibm.com, dgilbert@redhat.com, linux-efi@vger.kernel.org Subject: [PATCH v6 3/5] EFI: Introduce the new AMD Memory Encryption GUID. Date: Tue, 24 Aug 2021 11:06:40 +0000 Message-Id: <1cea22976d2208f34d47e0c1ce0ecac816c13111.1629726117.git.ashish.kalra@amd.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: References: X-ClientProxiedBy: SN7PR04CA0185.namprd04.prod.outlook.com (2603:10b6:806:126::10) To SN6PR12MB2767.namprd12.prod.outlook.com (2603:10b6:805:75::23) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from ashkalra_ubuntu_server.amd.com (165.204.77.1) by SN7PR04CA0185.namprd04.prod.outlook.com (2603:10b6:806:126::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4436.19 via Frontend Transport; Tue, 24 Aug 2021 11:06:50 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 9d163462-e9e9-4395-8c2f-08d966ef464c X-MS-TrafficTypeDiagnostic: SN6PR12MB2637: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:4941; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: oVBffnSLbMtbxCuc65Brh6ZwHH8JTomT2Z8Ai0O/Y0MSWoSzxfUuP4xcRMJlduHaCxv9kO27hWwF51uRR6r2eISkXv5RKKF/FLPKxHF0aRkQWvCGpqjaSuefcECYWtFeqf8wLTyJWFL0tb060JTW0RPx7CNlVhlGj6XDCIUW9Xv27jW7wyPDZ3prJHb2QhC4sdcaRqfhoND0mvaqDSycuvkalNjAzDghmPW1MQA05yF6CpvRMvYbhFpk99L7CXbRGWTEva/M9L7ImgnGx6oCOox5oXmXHlHs4Ve2vI4XKfj0qxKsaNmB1TifGC3OfF7eUSoceSX1Vth59GyN7gp/dstB/U6YsxwxFK8j9gZKCmaLEffYAPuVx/qm2h49ujyCp8cgcxZEuni9DF4/e7+BiCWyDG6n3UEfa45igP+3HtyYBNBviPsjc7g8UXBDUeNcDCNImkKRoESlqB5rtx3wUznYy8brQWKQykkYy+EcKoScSj3DK+VmJq56CZQsnrmFSk0sNqdj9UCZB/l3C3ZszL5QDNUBiljGRvQxFODIGrifcLAoHU0l5ODKx4Zvnf0faKpp1W+2p7Fx6MA6A9o7F8VnQW58T0QYHewn+z2JElxJ41NYlqp7Fpak9SbZldokHxFLv/tjRO1LLyc3odIUsy4dqWOxrwsrm0FPq4eZ6MOGQESn/1HxoFlftzsb1/ynjHGIZi2hOSw0A3Dw1lhqDA== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SN6PR12MB2767.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(136003)(376002)(366004)(396003)(39860400002)(346002)(26005)(38100700002)(38350700002)(7416002)(478600001)(186003)(86362001)(8936002)(5660300002)(6916009)(6666004)(83380400001)(7696005)(316002)(6486002)(2906002)(52116002)(66946007)(4326008)(36756003)(8676002)(66476007)(66556008)(956004)(2616005);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: sbkiJOO9R/W5w1/+kmgEzwlEwZwuv/EA81aY2dkDEpii61vyarV1Mmp0oJmKaXhZtHIiCDSZwDFxPo+e6TeVi/ZEk5+1vixmcx4FoMqauhnJZcU0Bt18I1Zn79yz7AWMEwUsbkrEAD7BqRZJ6HbwBUCIqHO3VmtPzhMtgnWMAW9tOOt+mHBHDN037/vkmW8Rx1g39IuAf34tJNF38VQsU6e8HRYYjcVP/yJeSM/AXsBQQhh0HFuVoZm0a+OVadIQbHFzRQNf+ryaQ4MbFX2W7YM7lEi+Mx6mpBrXZFybJ3xy9Qac0BEGGSjtE9dJik+JvWYxbCjpVp5Um5zBDlRO203ZdiZVxbbqKKymerjVLcymLMVWe7emy9JodzKclbd8T9SoIiQ4S+XKzd/zAEq394H+O7KJZqNSawmMJwnuAHcEHZBhDvGDLUF3sJTM8iQH+Tw81sFFnAdDTwLqU8iP+b6ArjRWP9H8WRavWlEK9dyk+gdVukjBrc3HpM9Zw+//JK6hsKv0nQI8VJUjpB41cmqO++aMIaTXEnAZAtIBfqW3ixrf90SNxqBWtW4G66CA0XvuVNpVasYsLFy1qbPgCsiMH3dIAquEMZCcbBtqddfE0ipFQuWUH0m5fr7gkFgd9D+16BFbQiYTi/cBq0UiOP6zXbRuajcyzUhdkVRYL0M7u0PoeqhiIbXYNfapao9Gd1Zq86299tJVwB0geQIl2qECFx3PTS6SchLjZVX4OFRHqN3H/1aiNO1Nojo8FXEmmmsbYNGrvPQhsdui/Fecc3tktezABDNJ9811zUXtrWJoJpGLlp8WjOlH2Br7p+fTh5/lAdSc7rWg0qKuWemxD17Wpx0EQuxR+q/h8XBtc6Ec/oON+9qCkMpGCVJeg7GJ0TTg2Zd1C/48nnErzh28tPlPMvHsDNr0vHdxlDniVE5VzzNg0QDE6ifAMpKtYyl10JR0HXD5/Maa85Y+Nk3ZufE4Vpd4FF7MW/M56TiLkrkrXLaXJjunVgLbFlrg0vcDWdWVcnKyE2i+1R0Mwu0SJtoW7K8nKAojD7XENHOhDP1Jy0vLkw4SqJYCejv8u1+73unotGCTXKKPqnpIqr9EuFSPEPB80W/q46DC5xgGKey0K0U73NXIEUjZ0bvmAoZ5k0zuoOVuzyntjGEVfn8V7Mne+mk9NJkWzlRhz6gKkocr3xHy9XMPnOtoeMMlyufJExC8l1fGCNk6RI47Z0umJxpZwv86pKjylLWEoh5cUhTta8sGbdjrO+jM/BDeqIFyCHLUwf85gMhaikfuhwESq1k8y3FBi7jw+K9Ul8LDpuKloDAaK2E/AXZSxBpIcWHQ X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 9d163462-e9e9-4395-8c2f-08d966ef464c X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2767.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Aug 2021 11:06:51.3853 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: o+IaSgxukaz8Q3N6D6oaXjpKVsqwjiHZCgDYVOJ59Vz2FSSJQVMRLo6o48mL1waU/xqG89e91QmSY58fSCADFg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR12MB2637 Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org From: Ashish Kalra Introduce a new AMD Memory Encryption GUID which is currently used for defining a new UEFI environment variable which indicates UEFI/OVMF support for the SEV live migration feature. This variable is setup when UEFI/OVMF detects host/hypervisor support for SEV live migration and later this variable is read by the kernel using EFI runtime services to verify if OVMF supports the live migration feature. Signed-off-by: Ashish Kalra Acked-by: Ard Biesheuvel --- include/linux/efi.h | 1 + 1 file changed, 1 insertion(+) diff --git a/include/linux/efi.h b/include/linux/efi.h index 6b5d36babfcc..dbd39b20e034 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h @@ -362,6 +362,7 @@ void efi_native_runtime_setup(void); /* OEM GUIDs */ #define DELLEMC_EFI_RCI2_TABLE_GUID EFI_GUID(0x2d9f28a2, 0xa886, 0x456a, 0x97, 0xa8, 0xf1, 0x1e, 0xf2, 0x4f, 0xf4, 0x55) +#define AMD_SEV_MEM_ENCRYPT_GUID EFI_GUID(0x0cf29b71, 0x9e51, 0x433a, 0xa3, 0xb7, 0x81, 0xf3, 0xab, 0x16, 0xb8, 0x75) typedef struct { efi_guid_t guid; From patchwork Tue Aug 24 11:07:07 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Kalra, Ashish" X-Patchwork-Id: 12454801 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2CF45C4338F for ; Tue, 24 Aug 2021 11:07:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 01DEE613AD for ; Tue, 24 Aug 2021 11:07:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236682AbhHXLIH (ORCPT ); Tue, 24 Aug 2021 07:08:07 -0400 Received: from mail-dm6nam12on2055.outbound.protection.outlook.com ([40.107.243.55]:2624 "EHLO NAM12-DM6-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S236483AbhHXLIF (ORCPT ); Tue, 24 Aug 2021 07:08:05 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ZMQkUYT+6L2mGAuEGescFkk6hsXsGuXQcyn+acU1hIB396ok0ftn6Uk6lEyh99K00F4qwEQSpZ5G8AMoIVSlS47wKcUysMJhSbjI+BC/N6m7al9o53puuhaL+9HOJWS//XCm6e+vEks9yvD73/5azJWkx9QCTKG3BvTvqIbiZfSFSrFIRHlr1F3Dk6fvv1aLx3yJ3vZH2wkpM4/tQV0+WNJBcJcLPElgofYrBzwSAkxbyYlV/atPk5j5gt2K+DBJ4PAu2ol+G3TRDntSBoxs9sLZvJYWXtnwtHVSX+0gvkLJqbFzVvyZraB6nB9khTzbhBFmw5zRNsSSyaqcmDP1Ew== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OjIJRxj24NM2NvlJ/4DT9cHOeuohjVrsiLWhnHXBXrg=; b=CS86lzcKBexZlGqAx4gODL9Tyg4P+qncwPIAPtLyUFN1eU+l0FADG9XPjceFkcTiD386emm5fJ58FdGh4knXJ0Fe59839gQh9kkEc45N1zpELZSRGAmvc59pbyjNdXNiAXzJfW2NaeuHaDr6rLO0d/TzBV6/Dm6xcdYgjU3mgvUEDbVslOu95ejMbxpLWAh5IV/8j/wd+n1JQFy5VdJJfkPekFxUTB/Bpm8TTak8H3h1b+n2Q2349xmcMRnZUvYe3URayCRhTmHigq5ZYFu9b7hlNpMO8eW9LwbRFLYZ0MoVmEBgtT0NZE4lX+PInZh/PycA2hF+oAmrKMGsBAIWug== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OjIJRxj24NM2NvlJ/4DT9cHOeuohjVrsiLWhnHXBXrg=; b=GtZXfIA1P82GDL6XOwcMP3w4tORrG84+sjuvqQCIyf7FQfKPrWUDSP0Jo9o4KwyHLP3raq/Kzqw+ACDiQxOIUhvqJS+4fvG5fMMvW1J49SKEQmUVPtACZ5nzcKjBW+1bvPdx/F17HXPMQnjRlNYjcbqsIkKM0sbf7X3ik0y03qc= Authentication-Results: redhat.com; dkim=none (message not signed) header.d=none;redhat.com; dmarc=none action=none header.from=amd.com; Received: from SN6PR12MB2767.namprd12.prod.outlook.com (2603:10b6:805:75::23) by SN6PR12MB2637.namprd12.prod.outlook.com (2603:10b6:805:6b::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4436.22; Tue, 24 Aug 2021 11:07:19 +0000 Received: from SN6PR12MB2767.namprd12.prod.outlook.com ([fe80::491e:2642:bae2:8b73]) by SN6PR12MB2767.namprd12.prod.outlook.com ([fe80::491e:2642:bae2:8b73%7]) with mapi id 15.20.4436.024; Tue, 24 Aug 2021 11:07:18 +0000 From: Ashish Kalra To: pbonzini@redhat.com Cc: seanjc@google.com, tglx@linutronix.de, mingo@redhat.com, hpa@zytor.com, joro@8bytes.org, bp@alien8.de, Thomas.Lendacky@amd.com, x86@kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org, srutherford@google.com, brijesh.singh@amd.com, dovmurik@linux.ibm.com, tobin@linux.ibm.com, jejb@linux.ibm.com, dgilbert@redhat.com Subject: [PATCH v6 4/5] x86/kvm: Add guest support for detecting and enabling SEV Live Migration feature. Date: Tue, 24 Aug 2021 11:07:07 +0000 Message-Id: X-Mailer: git-send-email 2.17.1 In-Reply-To: References: X-ClientProxiedBy: SN1PR12CA0094.namprd12.prod.outlook.com (2603:10b6:802:21::29) To SN6PR12MB2767.namprd12.prod.outlook.com (2603:10b6:805:75::23) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from ashkalra_ubuntu_server.amd.com (165.204.77.1) by SN1PR12CA0094.namprd12.prod.outlook.com (2603:10b6:802:21::29) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4436.19 via Frontend Transport; Tue, 24 Aug 2021 11:07:18 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: e2a5ab36-6110-4990-d219-08d966ef56b7 X-MS-TrafficTypeDiagnostic: SN6PR12MB2637: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:205; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: r+d1SyDXWtQUoEAGRH42XLBIO3gNbYBflrPaYMFIwkz1BC/o6Acd88879rsRjn9qNcosAr9G+NIBz0JZHvsfdZjtzaaLV4BLCAzL6mV+a+c07WH/T+oVFhU6T9efJrHZeuuHPrq9hDmq14MdSZAvmurLx+VViclmQEHppiEvQ7KkOFaxF8hNLgnboma8P0HUaOj1MuTwtgqA+IPhcDz6Iq05/kfmw8KJPeO7LPa8jmdhrz1p6JEapHHw+o4i7yuBLtmsLzL0vRLXUSwhFqkkwQ2dXb45tOeqmMR43GdWKCp7Nah5wjeFfH4llJWqfxJIw8+1FjucA3XZi89Pjsq9Vj9dfQgQlCEK4XDWR6zAqZoCWzFAg87mx0aJU5/v35qLky+3Um7wFQFpiRpcoDLrco0rJ2BG+z7TZfKLhiUROESe+fX7Nc2dcONg49O9+6vkHfB3SXsoBHr5ZcteXc8OYYtWbH1nak8yH5z0+GdhpIQMV/EZnDgD7Vy0FytW79wr/Dz5Zxl45soxm618l/6w6ghZ9izklRVZJdb58WD9+nYLcvJVrcgr/eNhr/L0VcFWSv3Evpoavu5RD2opJyNxN/KYsEfFpci1yEXmbT4Q3ijeGMzGnrl/wSiJI6etMddcPA5ZZejMLoKIAC3Q7VOtm5TIH9OHFfkj3Iu0RiIeqjVo9akbf9xvX9tiDSHs/DBETy8DQOS9Lp6ga8BTMVgjKQ== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SN6PR12MB2767.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(136003)(376002)(366004)(396003)(39860400002)(346002)(26005)(38100700002)(38350700002)(7416002)(478600001)(186003)(86362001)(8936002)(5660300002)(6916009)(6666004)(83380400001)(7696005)(316002)(6486002)(2906002)(52116002)(66946007)(4326008)(36756003)(8676002)(66476007)(66556008)(956004)(2616005);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: zCPCLcmiuOjfoMnyVzJv5sgP4Pw/Nd0EET8RPf9DddibxVgAaHWPJDkrL9G904aI8HrS4+waV5APNAB/yy7AK1jdjT6l3+a4UPOstz0B4SRaY4Qs7FNDWG4Bofso0elD8cgmGMKZtxqUyl7LUP9CCyZZRDgOTYXq46HEdX1WVP4RHi0DisGsvmIvSnVF6bYASaZB63irsf7biYLKFOzp/hMD1sOyct8dHIg2N2oiV0QeHWiwRs3/bT8AaSwHj2PMTzrnGuDp927rX+0rsqGouC68yAbqBcYJy3FTLkQt46xibATiO3RkToSi98VHesL8eBwMQy3H8bSmWJ7Pwi/osZ/X4gTTzUGDLpIRYrJhoqpfiByPtLzFuZq1G7MFmsBTSEA9iUmpMh9nABccgv0odGLc5IT4ychUsoxrRWoNg5oBHwZwdbNxrWv5xfXgoQGjw7XJIJPD5OXEzCSOBJcjdrBhwPeWRahX8EU9FXYXwO4HZRri07xLgK6sX0JN9VIg/c78sZ5ouR/xReDOyUGqGNss+548SXcxH77Tysq6OoAD5EB8jXZp6VwTH+ze6hkcSZ/4v055QlG2Lv49Rn7O4PkBPN/fxwtkgg5osjl3N4V18E/l5orwyetlF6vyKF5DF3RAgjQNkrMCdFe6TjB+tVo9Pn7DLuR3DfhCc6o7WlFE6RwgA1eo3olSCSy1O/1nnSooxV43FeKmlQBtOdGy2riqxBxEzg1IaLiOhuJAZPdcFKM7CQ0HwnUsBOyCUCmErWTcCTbzmkfgXFiCCeW1qFQ2D9oakMkTcZt5jW6j/ZTyXpTyRbrh13jVDwulm0jiAuaexXVN0vzhfdt0XQz0CRQEmPnkExAmDbG1ZPIIsp3XSxMz5yRuHbt4dfimnkGMZMwq44A8eUmIztAgQKD88HwE/clVKKIb5pdU27zjI2eeRa4YNIrrmvxXtZjlIkfTdOUAVrNmJS+bHJ44mhej8szb7qKMJfZM5+XNP8ykdjyN5ezTnzA9Y9a90KosRgKXGnb0rYXmpTSbXn+h9FIFfZT03MfXLXYkFA7GjYiDExrjSO8LGI9UmZhh/VZVQCdVqyxX+i1bPGdJilV7v8sB1VROe5uJ+Ws995mub1YMidIXvIRCM6tdh6eJ1b+7A1wbZMo7QS/qDIa5ZviSaxUKui8hR/Q+GN9yyiqEj4H0OLW0usOs3EUv0Q3TkpfukhefXkKhA1KW6Bt7kHw0TzZwdVVl5nrkH4r8twO6nx/3gCVzWxOGpNv9d11hKKx6rpRGhPb8uzN5bWw5Lb2BNv3baj286sVLhtqR0oF+SCoJuKy3/AtQlJiNH4UCMAZXcJWb X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: e2a5ab36-6110-4990-d219-08d966ef56b7 X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2767.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Aug 2021 11:07:18.9599 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: z56xPlcpWEtwUkLhuSER4umoxzyMbswHICsqb2HodgAcDq2Cl2mgKu87Xgp+9G2LpX/v1rwyQvv/UgCdLVauuA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR12MB2637 Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org From: Ashish Kalra The guest support for detecting and enabling SEV Live migration feature uses the following logic : - kvm_init_plaform() checks if its booted under the EFI - If not EFI, i) if kvm_para_has_feature(KVM_FEATURE_MIGRATION_CONTROL), issue a wrmsrl() to enable the SEV live migration support - If EFI, i) If kvm_para_has_feature(KVM_FEATURE_MIGRATION_CONTROL), read the UEFI variable which indicates OVMF support for live migration ii) the variable indicates live migration is supported, issue a wrmsrl() to enable the SEV live migration support The EFI live migration check is done using a late_initcall() callback. Also, ensure that _bss_decrypted section is marked as decrypted in the hypervisor's guest page encryption status tracking. Signed-off-by: Ashish Kalra Reviewed-by: Steve Rutherford --- arch/x86/include/asm/mem_encrypt.h | 4 ++ arch/x86/kernel/kvm.c | 82 ++++++++++++++++++++++++++++++ arch/x86/mm/mem_encrypt.c | 5 ++ 3 files changed, 91 insertions(+) diff --git a/arch/x86/include/asm/mem_encrypt.h b/arch/x86/include/asm/mem_encrypt.h index 9c80c68d75b5..8dd373cc8b66 100644 --- a/arch/x86/include/asm/mem_encrypt.h +++ b/arch/x86/include/asm/mem_encrypt.h @@ -43,6 +43,8 @@ void __init sme_enable(struct boot_params *bp); int __init early_set_memory_decrypted(unsigned long vaddr, unsigned long size); int __init early_set_memory_encrypted(unsigned long vaddr, unsigned long size); +void __init early_set_mem_enc_dec_hypercall(unsigned long vaddr, int npages, + bool enc); void __init mem_encrypt_free_decrypted_mem(void); @@ -83,6 +85,8 @@ static inline int __init early_set_memory_decrypted(unsigned long vaddr, unsigned long size) { return 0; } static inline int __init early_set_memory_encrypted(unsigned long vaddr, unsigned long size) { return 0; } +static inline void __init +early_set_mem_enc_dec_hypercall(unsigned long vaddr, int npages, bool enc) {} static inline void mem_encrypt_free_decrypted_mem(void) { } diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c index a26643dc6bd6..7d36b98b567d 100644 --- a/arch/x86/kernel/kvm.c +++ b/arch/x86/kernel/kvm.c @@ -27,6 +27,7 @@ #include #include #include +#include #include #include #include @@ -40,6 +41,7 @@ #include #include #include +#include DEFINE_STATIC_KEY_FALSE(kvm_async_pf_enabled); @@ -433,6 +435,8 @@ static void kvm_guest_cpu_offline(bool shutdown) kvm_disable_steal_time(); if (kvm_para_has_feature(KVM_FEATURE_PV_EOI)) wrmsrl(MSR_KVM_PV_EOI_EN, 0); + if (kvm_para_has_feature(KVM_FEATURE_MIGRATION_CONTROL)) + wrmsrl(MSR_KVM_MIGRATION_CONTROL, 0); kvm_pv_disable_apf(); if (!shutdown) apf_task_wake_all(); @@ -547,6 +551,55 @@ static void kvm_send_ipi_mask_allbutself(const struct cpumask *mask, int vector) __send_ipi_mask(local_mask, vector); } +static int __init setup_efi_kvm_sev_migration(void) +{ + efi_char16_t efi_sev_live_migration_enabled[] = L"SevLiveMigrationEnabled"; + efi_guid_t efi_variable_guid = AMD_SEV_MEM_ENCRYPT_GUID; + efi_status_t status; + unsigned long size; + bool enabled; + + if (!sev_active() || + !kvm_para_has_feature(KVM_FEATURE_MIGRATION_CONTROL)) + return 0; + + if (!efi_enabled(EFI_BOOT)) + return 0; + + if (!efi_enabled(EFI_RUNTIME_SERVICES)) { + pr_info("%s : EFI runtime services are not enabled\n", __func__); + return 0; + } + + size = sizeof(enabled); + + /* Get variable contents into buffer */ + status = efi.get_variable(efi_sev_live_migration_enabled, + &efi_variable_guid, NULL, &size, &enabled); + + if (status == EFI_NOT_FOUND) { + pr_info("%s : EFI live migration variable not found\n", __func__); + return 0; + } + + if (status != EFI_SUCCESS) { + pr_info("%s : EFI variable retrieval failed\n", __func__); + return 0; + } + + if (enabled == 0) { + pr_info("%s: live migration disabled in EFI\n", __func__); + return 0; + } + + pr_info("%s : live migration enabled in EFI\n", __func__); + wrmsrl(MSR_KVM_MIGRATION_CONTROL, KVM_MIGRATION_READY); + + return 1; +} + +late_initcall(setup_efi_kvm_sev_migration); + /* * Set the IPI entry points */ @@ -805,8 +858,37 @@ static bool __init kvm_msi_ext_dest_id(void) return kvm_para_has_feature(KVM_FEATURE_MSI_EXT_DEST_ID); } +static void kvm_sev_hc_page_enc_status(unsigned long pfn, int npages, bool enc) +{ + kvm_sev_hypercall3(KVM_HC_MAP_GPA_RANGE, pfn << PAGE_SHIFT, npages, + KVM_MAP_GPA_RANGE_ENC_STAT(enc) | KVM_MAP_GPA_RANGE_PAGE_SZ_4K); +} + static void __init kvm_init_platform(void) { + if (sev_active() && + kvm_para_has_feature(KVM_FEATURE_MIGRATION_CONTROL)) { + unsigned long nr_pages; + + pv_ops.mmu.notify_page_enc_status_changed = + kvm_sev_hc_page_enc_status; + + /* + * Ensure that _bss_decrypted section is marked as decrypted in the + * shared pages list. + */ + nr_pages = DIV_ROUND_UP(__end_bss_decrypted - __start_bss_decrypted, + PAGE_SIZE); + early_set_mem_enc_dec_hypercall((unsigned long)__start_bss_decrypted, + nr_pages, 0); + + /* + * If not booted using EFI, enable Live migration support. + */ + if (!efi_enabled(EFI_BOOT)) + wrmsrl(MSR_KVM_MIGRATION_CONTROL, + KVM_MIGRATION_READY); + } kvmclock_init(); x86_platform.apic_post_init = kvm_apic_init; } diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c index 455ac487cb9d..2673a89d17d9 100644 --- a/arch/x86/mm/mem_encrypt.c +++ b/arch/x86/mm/mem_encrypt.c @@ -409,6 +409,11 @@ int __init early_set_memory_encrypted(unsigned long vaddr, unsigned long size) return early_set_memory_enc_dec(vaddr, size, true); } +void __init early_set_mem_enc_dec_hypercall(unsigned long vaddr, int npages, bool enc) +{ + notify_range_enc_status_changed(vaddr, npages, enc); +} + /* * SME and SEV are very similar but they are not the same, so there are * times that the kernel will need to distinguish between SME and SEV. The From patchwork Tue Aug 24 11:07:45 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Kalra, Ashish" X-Patchwork-Id: 12454803 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BCF7FC4338F for ; Tue, 24 Aug 2021 11:08:04 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9EAC861373 for ; Tue, 24 Aug 2021 11:08:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236685AbhHXLIr (ORCPT ); Tue, 24 Aug 2021 07:08:47 -0400 Received: from mail-dm6nam11on2059.outbound.protection.outlook.com ([40.107.223.59]:38497 "EHLO NAM11-DM6-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S236606AbhHXLIm (ORCPT ); Tue, 24 Aug 2021 07:08:42 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=hfF3DQoP4o2FcJedClMWup0TDNZ7rEPPe5P0CgvxiGmZs3FiHq1/q5c1tNtoPIwaxTv3YddEB5eZRgVAJUrgpXbh3tRlGZegyFBecK4HN+/5Js+M3Q+WAMBWEyW33fMosonkFK2GwLfRDZbuPSxi5FzWUfnP09hR3saBvG19gyFutOwt5Qy+BZkwPjCW/klsuq3s4C42XGOlw/FHAourOkeOnHGo67mRe0F5/IyHvHa3PaRyuE9qDrBnWx/imLDuG573v5Jy82VtlXlvxxuNa/PCbEyKEA1gxTopZPsQwZhwoeap93eKapuZN+WhZewP5zJ2AmgnSQhKmCMR3h4oMw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rSdJXXgv4wIE3DgoSk3huqwGy0iT0Qq+ISanik4sM6A=; b=L44pXnjfGujZSzs9yZUGcrxZtMcOvq9+GFyQBbnMtjgdhruSqt6z+qobXHQAsD2YCJtdw3iu+9aIhdQ7qGwKGuQVkVPa9ELpgPLPKUFv2vNT94D2UaLI1fMWhl8TjuCHbC98my49lP26ETDM0O5zlcpohNugwhDDxz46UlXvC0ne1FeY/4WB+ihxqM7hzwSMJcWle2K117WPZRPmPsjiBYMR1ob997bhRxbbFRY/1Q9b+DgyYOMyH+eF5/38/Yd6Rr0RDmy4Xh1LbxHZP/OywCjheSlfwDN3WOpqL6PjxB3fWXJU4m6MW0p57IemunQqO9udMHJLNJVij6LpmLJMzA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rSdJXXgv4wIE3DgoSk3huqwGy0iT0Qq+ISanik4sM6A=; b=DbBwNi6+i5CpMTJVIIT2qkRMV9lYZ+AeSu/ESTTlq3bK6OxlCVSHZzfICF3UfMwiShz2waJZ937VozVJPe5DNjSnk0Ig91aAaiaUHQK0IMKGnU/9t/rUi0HSTA5OvF5wBOvOjxEYDFM0snt20I/FEoKlcQYs6fN0FOAXlt4YMwA= Authentication-Results: redhat.com; dkim=none (message not signed) header.d=none;redhat.com; dmarc=none action=none header.from=amd.com; Received: from SN6PR12MB2767.namprd12.prod.outlook.com (2603:10b6:805:75::23) by SN6PR12MB2637.namprd12.prod.outlook.com (2603:10b6:805:6b::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4436.22; Tue, 24 Aug 2021 11:07:56 +0000 Received: from SN6PR12MB2767.namprd12.prod.outlook.com ([fe80::491e:2642:bae2:8b73]) by SN6PR12MB2767.namprd12.prod.outlook.com ([fe80::491e:2642:bae2:8b73%7]) with mapi id 15.20.4436.024; Tue, 24 Aug 2021 11:07:56 +0000 From: Ashish Kalra To: pbonzini@redhat.com Cc: seanjc@google.com, tglx@linutronix.de, mingo@redhat.com, hpa@zytor.com, joro@8bytes.org, bp@alien8.de, Thomas.Lendacky@amd.com, x86@kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org, srutherford@google.com, brijesh.singh@amd.com, dovmurik@linux.ibm.com, tobin@linux.ibm.com, jejb@linux.ibm.com, dgilbert@redhat.com, kexec@lists.infradead.org Subject: [PATCH v6 5/5] x86/kvm: Add kexec support for SEV Live Migration. Date: Tue, 24 Aug 2021 11:07:45 +0000 Message-Id: <3e051424ab839ea470f88333273d7a185006754f.1629726117.git.ashish.kalra@amd.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: References: X-ClientProxiedBy: SN4PR0201CA0015.namprd02.prod.outlook.com (2603:10b6:803:2b::25) To SN6PR12MB2767.namprd12.prod.outlook.com (2603:10b6:805:75::23) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from ashkalra_ubuntu_server.amd.com (165.204.77.1) by SN4PR0201CA0015.namprd02.prod.outlook.com (2603:10b6:803:2b::25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4436.19 via Frontend Transport; Tue, 24 Aug 2021 11:07:56 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: be13c8be-1947-4037-68d0-08d966ef6d4e X-MS-TrafficTypeDiagnostic: SN6PR12MB2637: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:2958; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: is+lQwkywHe8exxFtQwrqbyQZGSeM7Z7V+RcDczg06pNTZjGf6+/n/xNMiWhL/l5+uyLyZalW7Ic647LFr6ZFxb3eG2EFylgBLBD27WxJ4QN9Ck69vDaD0aHJj4gg7WuDQQU6GjnQzH9QtTz7B3lbb4lsJmBlzjwKh3/BYL+yezvY+I7gGf44pzOBuoyp6XKhGX7d1N47rzWXSl3QLlWt0+hkS+Fqo2z/gcPMmAO5vDAzfA39Dq8eG6H2h34A/8oc2dBkHrj3PH3//QkeY2aBLjDmqEGfwrwbFXfCJJtXgoFsaSVxYKx8WaN/Viht6d2HYyniIm+OEKLnO64PyK+BVWIOvWvPV9WIbe1pO/cw5ukGGDzJ4x52AdBfLYJkLdw+ZGDPZgp9EkCenx5IU/vgs+S40u+w5BZn14Okj5VDirUoeZ9omj04pATGQ02c177Bm8f7iui/4JipdjkM0g5XoFvPoDT81UJ5FrrTWVLwq1XKgrFAzasmAvfBa8oFWZhH/Cg4ycWkoK5mM+a+5gzAMqNvCe76KEl8z3avWXLZ+auCma4FtKkiujDdZl+WXpZAFU0079Iq+LL6dS917vAlJIijwbB0XdWBH9T8N1T9kNmRW94Y1htD25hDZY0qmk32IOmVIqGQf1ILicyKQ1aBkyD4QR9z2IxefVtnSxuYbZds2xrYcRGoYNFZrsBzwaEWJEvM/qyTldJx7Tf9+9ilA== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SN6PR12MB2767.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(136003)(376002)(366004)(396003)(39860400002)(346002)(26005)(38100700002)(38350700002)(7416002)(478600001)(186003)(86362001)(8936002)(5660300002)(6916009)(6666004)(7696005)(316002)(6486002)(2906002)(52116002)(66946007)(4326008)(36756003)(8676002)(66476007)(66556008)(956004)(2616005);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: y3M3jXjeBIgMSLjB7hABWSorf0vlisFixmrxoDVrPcD+6/ZQmilSXE9vM5Rdg5NGwTsOA8p2kvFUV1RNziMxkgXV7/4iJetAwkPOR5zD2BzVPALmriE2tlpdI6JDNnT5BHjbgHHAvd1zxOgUEBdZXYJIbr6t11Mkll4i+lsBptiqr2+vjERbAWG7GrQLSZWHej0D5nt4eftthSY+sfPfg3omu4uLHKbI/OmA0/F9fX8E+kQBF0SS0QrmmWWgs2jo7zFbtgakLL8JrI+F5Add8aeKudSiDJuUhJthH3nwlYusSpC4fRU8HJGI/c6YMEM2D2fYdBjua0Hv3F4YF88J0C5TZ3m7xIcgwBIUmLCCxudtt2d5kGAXWxL9zY80b31NvA5UEay2/xa+C1z1Oj4DObj98zkM/FR/KX0/YxKL3Sr+s2juYbU6kXVncG7yYB/7vyZDizPV6G0ul9PvcpJt2OZgvn6pxgArpTW0QUY54eu4NdOosKvlgxpqPDPulw3qPaCYuFXM867GvK15DwuAn9Oriso6iNi0cremDzzQwAQYR7oL6dplOn2WQ4P6nIcMQrOp+pxcIipAwCQWslNp7oINvxcnc2UXisNUvYP3M/Y/f90jc85fSAlB45EHk3ORz2DE3dUYRQKqgnRZKDOBNg3MvyXnTCuVV9bWgdwqQ4Mbo+YgujPLj3BcV2zSUmTFI1A5wrbv8ALkIKWET1VeMGTUZOtzD9jqfqKTLTJoRX4finia10eM5j3JtwcN6YtIVJlBzOOZNs76URPuYP0mBpTDIoOaiM9UeWUJXlSMfYAQxXbB7VD2GExlYOqs1wa5PTwFpxqHbT2aVjNvcXo5wEGJ0HRgzvB2sBbslW0iLorTRMifxUiBdFGMpiCSe5LdeAfvSrwB0+EupuRHbCe3+R3hs2ruJC9gXje3FEUVuh9ceFSUeb4+d9bH59/oXveUokBcppr6RDusO4LVdZ9G93UH9Xhgolrzyd4wLQOwMJAWyTg7h34oWS0zektzw+lSda4qG95C614hOM3HHnf2svqnRiLUEyaRqUtO3qYVF9QXrCykmnObwu4l3e+s0iWVb4bFHeG2GHO5zcFmv7TiwWqkk+pnHmIjhXsU5mBAzOJOhu03/m3CMTCF5invGQ8Doh5LBzlOQlmNWfLXetFGY3DYN0Iz6lCsMys1HdtNOrqoSyfaUhq0UhK1W27bgMDMO3JVJgIKavzYkOydnsLPgvHeIFUtwC0uRcsNTcz8M575hb+jEUFDg4TR47PP3ya0HVXkLpdYkrVjHO8P5DKlhXqQfdYJg4L89KkkCaaaQ01q6Nepw+aXYply+NH1/GgJ X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: be13c8be-1947-4037-68d0-08d966ef6d4e X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2767.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Aug 2021 11:07:56.8376 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 05alGUCSoIdvf/j5aASuoxD2v1ebPT3daDVwhOZxS6bdO7YM4gn2E6NgHW0sWLTq2KqgbuQy/ORujKDVVpgFHw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR12MB2637 Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org From: Ashish Kalra Reset the host's shared pages list related to kernel specific page encryption status settings before we load a new kernel by kexec. We cannot reset the complete shared pages list here as we need to retain the UEFI/OVMF firmware specific settings. The host's shared pages list is maintained for the guest to keep track of all unencrypted guest memory regions, therefore we need to explicitly mark all shared pages as encrypted again before rebooting into the new guest kernel. Signed-off-by: Ashish Kalra Reviewed-by: Steve Rutherford --- arch/x86/kernel/kvm.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c index 7d36b98b567d..025d25efd7e6 100644 --- a/arch/x86/kernel/kvm.c +++ b/arch/x86/kernel/kvm.c @@ -869,10 +869,35 @@ static void __init kvm_init_platform(void) if (sev_active() && kvm_para_has_feature(KVM_FEATURE_MIGRATION_CONTROL)) { unsigned long nr_pages; + int i; pv_ops.mmu.notify_page_enc_status_changed = kvm_sev_hc_page_enc_status; + /* + * Reset the host's shared pages list related to kernel + * specific page encryption status settings before we load a + * new kernel by kexec. Reset the page encryption status + * during early boot intead of just before kexec to avoid SMP + * races during kvm_pv_guest_cpu_reboot(). + * NOTE: We cannot reset the complete shared pages list + * here as we need to retain the UEFI/OVMF firmware + * specific settings. + */ + + for (i = 0; i < e820_table->nr_entries; i++) { + struct e820_entry *entry = &e820_table->entries[i]; + + if (entry->type != E820_TYPE_RAM) + continue; + + nr_pages = DIV_ROUND_UP(entry->size, PAGE_SIZE); + + kvm_sev_hypercall3(KVM_HC_MAP_GPA_RANGE, entry->addr, + nr_pages, + KVM_MAP_GPA_RANGE_ENCRYPTED | KVM_MAP_GPA_RANGE_PAGE_SZ_4K); + } + /* * Ensure that _bss_decrypted section is marked as decrypted in the * shared pages list.