From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753892AbcDZW7K (ORCPT ); Tue, 26 Apr 2016 18:59:10 -0400 Received: from mail-bn1on0087.outbound.protection.outlook.com ([157.56.110.87]:30127 "EHLO na01-bn1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753861AbcDZW7E (ORCPT ); Tue, 26 Apr 2016 18:59:04 -0400 Authentication-Results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=amd.com; From: Tom Lendacky Subject: [RFC PATCH v1 17/18] x86/kvm: Enable Secure Memory Encryption of nested page tables To: , , , , , , , , CC: Radim =?utf-8?b?S3LEjW3DocWZ?= , Arnd Bergmann , Jonathan Corbet , Matt Fleming , Joerg Roedel , "Konrad Rzeszutek Wilk" , Paolo Bonzini , "Ingo Molnar" , Borislav Petkov , "H. Peter Anvin" , Andrey Ryabinin , "Alexander Potapenko" , Thomas Gleixner , "Dmitry Vyukov" Date: Tue, 26 Apr 2016 17:58:55 -0500 Message-ID: <20160426225855.13567.53070.stgit@tlendack-t1.amdoffice.net> In-Reply-To: <20160426225553.13567.19459.stgit@tlendack-t1.amdoffice.net> References: <20160426225553.13567.19459.stgit@tlendack-t1.amdoffice.net> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-Originating-IP: [165.204.77.1] X-ClientProxiedBy: SN2PR10CA0006.namprd10.prod.outlook.com (10.160.12.144) To DM3PR1201MB1120.namprd12.prod.outlook.com (10.164.198.20) X-MS-Office365-Filtering-Correlation-Id: 142c030f-1a0e-4211-4478-08d36e265a5e X-Microsoft-Exchange-Diagnostics: 1;DM3PR1201MB1120;2:B6Zoixo4jmaElsD/LSpH3P0c4zWMc7txY86wSr4CUN9sT5e92jteEj7eLg56nlzOyCzlCVS3mGDmQWW4p3U81o7stYGI+Yl9ghGLZq1bhzQJj7BF7PXASP9d+/kzJkDrdgYg9q3qKTcb6uAat/WJOYvxQzQroGvUEmbxcPwoqc4heR7+aXTS+BvW+kbc7ww8;3:M1IjzFZCqmjeBnl7C/rnbFwFjHfBI/lMF+5SGr4vogVIMP8L52sCLd8ohZEewvl/PROrp0Mcfl0qMXrK+HVaIWh4S9Ekz94I58V6gR06ScEiHsD+YyoqP1ePZTA+wz8U;25:akHuVTIdGSkI1SNu5Mi3A6NglKn/jRFciKQr2s8ApGO19l01Zc9uiVomq3zSlkagF5c0hS6m1vQE6oQScGEnF0zrIWoMdeOxv1MLvPMlpjdeArjse4hlGW8PDNEoesXGDSGq7KhkYhPvsb7IyUyHZ32snRdi3z3dwrsDkVH5WAtcwJEkGc2gL/Of2u0ECUOQujsvSl134Ezcbl+VD69L2veU2DLRwxMHXV67BMnQd/lrH14TxQljHpmxwNgDvwOFWwtRe2iZMwaGJd/f3ht+/SQyjo3zyWqMG/tTvh/3XIrTwS57TroEMP0bWjSqwM6gd18Xc6VZcJccc4j+BZ8Olw== X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:DM3PR1201MB1120; X-Microsoft-Exchange-Diagnostics: 1;DM3PR1201MB1120;20:bXz5ZHPG3UsBi5rsagnH9+mfkmaK9Vp3VYkEY6YvSfjs1YstL/Go6OwwDZxtufzGoDgpV+YNJLWZEGBpk844MP8T0I4ynevRwc8YJjGyykJ9FtPrbtTZoIGzGd2Roo2hqyP+WxgyeyyfeTIoNM/HWvpsSFVrVKoV+Dg1UoA0emuN5eKnAhwS84MtU/CcKe1/PL5P94qOQNsizLtpld1QbNZhNQkS/55HeSZq6akNQF/HyuRTyVPDdU6Pq53KTgM8ziNqBFvs4FHNEr4aa83zl8H+l/c2MNnstm5FnOEhxMmF0hXkBYp175HwgLJUcu8bVi0RgyCADdl1K/sCIbXjT2PLtzRDSm98BSMAtM1hkRPHZ2ln2OD2x7H8eIEYh7FeCx7dcA5ONYW7+UBC4eJ7lFhbSjLawHV8pyZWmj2SiKZwZQWKEN8pocPp0FTlFC+1XBw68M5Ie7l8Da3pQD4z27pLsdmGaYB+E1ds/ObZQAHkjeGVQznmFzJgAoWRVcGR;4:vX8YjtKijnIjtKo/KEnl1wM/JG5+/4iByJvhvHC5olKerYXy10E08fVQQKoAYCTWt2VRR0d00gSbxb7hlIVBTnE1+FlO2ZTRNzdSt2LWtmLhJexqKT30gyISXz+tLCsS1SycBdekum0H/fmYkG7WRkpmWkZRlK3qOipMJlTavIgwdYMvBW+uUOUOFcGZU3+EpayTTrUkVCbDuDhKopCvMv8lChIazA8mdg4GQbh2xAi4cRLY3+Zj+yPgH+fnaUo0X/FvD2ZpMozOfhhnU5VDyw7EUON0StiIS6zI/iL5KXo8H4Kq0U36k4ttpnGdZmMA3a6pg2JA+zeDk3dELGP8j5Ul18vk8BeVXasN2UhwyvrD+uXLgw934B73IsQlNqfFC6qL/VHq1hENutqnWhMG/L/D4OWPVd+9B+xzr0pAurk= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(9101521072)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6055026);SRVR:DM3PR1201MB1120;BCL:0;PCL:0;RULEID:;SRVR:DM3PR1201MB1120; X-Forefront-PRVS: 0924C6A0D5 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(4630300001)(6009001)(42186005)(97746001)(81166005)(5008740100001)(5004730100002)(66066001)(47776003)(2201001)(2950100001)(92566002)(103116003)(53416004)(19580395003)(77096005)(19580405001)(50466002)(86362001)(5001770100001)(4326007)(4001350100001)(23676002)(33646002)(230700001)(9686002)(76176999)(50986999)(189998001)(2906002)(1096002)(1076002)(6116002)(586003)(54356999)(229853001)(71626007)(217873001);DIR:OUT;SFP:1101;SCL:1;SRVR:DM3PR1201MB1120;H:tlendack-t1.amdoffice.net;FPR:;SPF:None;MLV:sfv;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtETTNQUjEyMDFNQjExMjA7MjM6TllLZlEveTBRWW1xVjI5b0NnZzNYaXdz?= =?utf-8?B?SHNSSGdUblM1dGRDUERSYXltVDZja0FUVm9zOGE4OG1ZWWFNdHlGVUZoMFU1?= =?utf-8?B?eTFTVGgyUFFhS0lkcWlBdVk5NWR1RXB3NjF6T010VnJyZDNHS2RHY0JrdVFr?= =?utf-8?B?UUwxZG5tSjFDMngzdWV3QXlhYlBsVEczTWdWTU9LZ2hnNWpXa0xrNkRBQmNL?= =?utf-8?B?akR4UlhIRU1kQ1BXNForVVdiNlVwSTNZSUF1QWl2dHhzMDBRSTFMb2pYWkRT?= =?utf-8?B?bFExODVPaCttQUZHVU9oUVZ4RUlrVWp2NjMxdkViRXdmVzNPQjNkaGw1RGdo?= =?utf-8?B?K3ZBOGI5MGdQYVlyd2xxNGRuSUw1ellDMldOdXhPZVdrSWE5M3VKaVpQNmpT?= =?utf-8?B?bjV3OGozYWxENHkwUGhoQ0tQSi9QWnAvQWVzYXo2U1cyWjNJQndqSDlsT0wr?= =?utf-8?B?dm94TEI4eVZHM2hxSTRhbEw1Z1JKOWxnQ3lFUi9nVk1HNlBvNUxJcktnTmxD?= =?utf-8?B?dStNNHIzdmx4cU1ZYlNldDNqblFFRUhkRWtGRWRBQUhUcXpnS2xxRitleFcv?= =?utf-8?B?Y1lpZUF0RTN6amF3S0NlazdHRmlBUUVlTnlVNDg0MXczL0FMUDZBeEduMklx?= =?utf-8?B?cEVmYjlSZytJMEo3cDZhdUZXRldwa2JoRTh4ZHgxT0lBUGxKTlh0cWhQbDMz?= =?utf-8?B?YXQyeXVFZjZyWkduU2l0WDVINU5pNlZodDZLRUpkM1ZicFluRVFTM0hSUnY2?= =?utf-8?B?dXAxaEFRVEFmcEtDbWtqWG9TcnlOOU0yTnEwOGtDT3FhQnhUTFdBaE5yTmh0?= =?utf-8?B?OGlETU1QYkhqTE5YSWN4NU1DUTBSMVU4UjI1aklJUnFwV24zVE5iZmNoN3Qr?= =?utf-8?B?MVhxVUJ6cEg1ZnZXc3djckpEMlQrTXRHR0RJSzdUQ1Q0Tm9XeXhjMG1USGRT?= =?utf-8?B?SXFDdUJ5QkxQcHV6aGFuWVl6TnhhaFc2aklKcmpseUt5bndjRzFVZG5BNWFP?= =?utf-8?B?RGhyYTMxQlFsR2l2NlBmSFY1QkhTSzlNT3BOL3hOTmFscEczUm1YRkJBalRF?= =?utf-8?B?UlUrMXl0RGJmOHBxUUYvVFhXNFFTNVAvSkJ3ZU5YQW9XUndTOTNldHVkcEp0?= =?utf-8?B?Q3NyWUlqSjhIQUM0QlFsdFFTQW9ScXlaRVJ1NVA5UzA2U3dGOVR5N1RqMEw3?= =?utf-8?B?SFd2VFdhbzVTb2d5V1VMcU9wMVVUbkFiTHVqZjQ1NnBkNmF1ajNDNGZ4dGxG?= =?utf-8?B?QVY2WUlPU0ptME55TDh5ZUs1RXBTdjVIMFF5WllSREtmbWJiWGZrWldXZEtI?= =?utf-8?B?dHJkbHJ6Sk13NnFBR3g3bUpXN3ZTY1kwcExtMWp6Y1A0R1ZuYXFGT1hHVnFK?= =?utf-8?B?UkRLVUFMWHJQdzdLUUdnQm1LY3Zxc2xCN0pqSzF5Snc9PQ==?= X-Microsoft-Exchange-Diagnostics: 1;DM3PR1201MB1120;5:mCVPh8YAE2uIGyiEtJX1pNOYPzjrExaOPSZfB/zYA+0P4xgsJucwCcFlFNj9AvxoCiYpCXQ52UnOEvnqHY37v0hmK/iuOyyJo33C9qIMpqKWsnDAtJ1hfi7lX9DSIV73WrEHmd8cyBaDvjVCFVTPqw==;24:oCcBGnvULhWzT+h+Ye0EhW6j89NByAxO4cX06n0QVYj8or/3safKrYBHTXTmZrA1iD7SgMAfAxA7Rtz/G0ru7lsY2CvGy9QIICENiYSEURU=;7:yz7luG889GmYNcTGJ8lzL1vj3DQmkV+SgC8yGbOqE8qUT7rzisTJcovz24ss4Ri3H4ipreOadxJAMnmaQrrQX0+eW3YzM5Ii+GEVa/QQeP3W7i5SF/ADv1UzE68VocAFoFjeLE8F561GORTHWbNSIOZzFiHVprThhljTb8jq0SY=;20:HNsFbRDGV7gr3fOeukZq+DKtd70LesnK0Y5+SPHLWZI7zAtlOQZIM+ck80uPyurOOlt+bpm+ePpFH8Q7fhO19OZMAxSBQFJzrskZkRo/HwDtrVo/SDEKn0dUuFyERxIpdcQXqBBvH4my3ctbL/EPx/oYrHqUw0FBWypoKIoJgJvxbxmJj3OcgdndyZqq6IIkvpxzuX0i3kFVQCqXik2hFUYRG7ICgAEueG2ihvPaKeh84Vw/7VRdfNyT98tb1wWn X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Apr 2016 22:58:58.2998 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM3PR1201MB1120 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Update the KVM support to include the memory encryption mask when creating and using nested page tables. Signed-off-by: Tom Lendacky --- arch/x86/include/asm/kvm_host.h | 2 +- arch/x86/kvm/mmu.c | 7 +++++-- arch/x86/kvm/vmx.c | 2 +- arch/x86/kvm/x86.c | 3 ++- 4 files changed, 9 insertions(+), 5 deletions(-) diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h index b7e3944..75f1e30 100644 --- a/arch/x86/include/asm/kvm_host.h +++ b/arch/x86/include/asm/kvm_host.h @@ -1012,7 +1012,7 @@ void kvm_mmu_setup(struct kvm_vcpu *vcpu); void kvm_mmu_init_vm(struct kvm *kvm); void kvm_mmu_uninit_vm(struct kvm *kvm); void kvm_mmu_set_mask_ptes(u64 user_mask, u64 accessed_mask, - u64 dirty_mask, u64 nx_mask, u64 x_mask); + u64 dirty_mask, u64 nx_mask, u64 x_mask, u64 me_mask); void kvm_mmu_reset_context(struct kvm_vcpu *vcpu); void kvm_mmu_slot_remove_write_access(struct kvm *kvm, diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c index 4c6972f..5c7d939 100644 --- a/arch/x86/kvm/mmu.c +++ b/arch/x86/kvm/mmu.c @@ -121,7 +121,7 @@ module_param(dbg, bool, 0644); * PT32_LEVEL_BITS))) - 1)) #define PT64_PERM_MASK (PT_PRESENT_MASK | PT_WRITABLE_MASK | shadow_user_mask \ - | shadow_x_mask | shadow_nx_mask) + | shadow_x_mask | shadow_nx_mask | shadow_me_mask) #define ACC_EXEC_MASK 1 #define ACC_WRITE_MASK PT_WRITABLE_MASK @@ -175,6 +175,7 @@ static u64 __read_mostly shadow_user_mask; static u64 __read_mostly shadow_accessed_mask; static u64 __read_mostly shadow_dirty_mask; static u64 __read_mostly shadow_mmio_mask; +static u64 __read_mostly shadow_me_mask; static void mmu_spte_set(u64 *sptep, u64 spte); static void mmu_free_roots(struct kvm_vcpu *vcpu); @@ -282,13 +283,14 @@ static bool check_mmio_spte(struct kvm_vcpu *vcpu, u64 spte) } void kvm_mmu_set_mask_ptes(u64 user_mask, u64 accessed_mask, - u64 dirty_mask, u64 nx_mask, u64 x_mask) + u64 dirty_mask, u64 nx_mask, u64 x_mask, u64 me_mask) { shadow_user_mask = user_mask; shadow_accessed_mask = accessed_mask; shadow_dirty_mask = dirty_mask; shadow_nx_mask = nx_mask; shadow_x_mask = x_mask; + shadow_me_mask = me_mask; } EXPORT_SYMBOL_GPL(kvm_mmu_set_mask_ptes); @@ -2549,6 +2551,7 @@ static int set_spte(struct kvm_vcpu *vcpu, u64 *sptep, pte_access &= ~ACC_WRITE_MASK; spte |= (u64)pfn << PAGE_SHIFT; + spte |= shadow_me_mask; if (pte_access & ACC_WRITE_MASK) { diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index d5908bd..5d8eb4b 100644 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -6351,7 +6351,7 @@ static __init int hardware_setup(void) kvm_mmu_set_mask_ptes(0ull, (enable_ept_ad_bits) ? VMX_EPT_ACCESS_BIT : 0ull, (enable_ept_ad_bits) ? VMX_EPT_DIRTY_BIT : 0ull, - 0ull, VMX_EPT_EXECUTABLE_MASK); + 0ull, VMX_EPT_EXECUTABLE_MASK, 0ull); ept_set_mmio_spte_mask(); kvm_enable_tdp(); } else diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 12f33e6..9432e27 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -67,6 +67,7 @@ #include #include #include +#include #define MAX_IO_MSRS 256 #define KVM_MAX_MCE_BANKS 32 @@ -5859,7 +5860,7 @@ int kvm_arch_init(void *opaque) kvm_x86_ops = ops; kvm_mmu_set_mask_ptes(PT_USER_MASK, PT_ACCESSED_MASK, - PT_DIRTY_MASK, PT64_NX_MASK, 0); + PT_DIRTY_MASK, PT64_NX_MASK, 0, sme_me_mask); kvm_timer_init();