All of lore.kernel.org
 help / color / mirror / Atom feed
From: Borislav Petkov <bp@suse.de>
To: Brijesh Singh <brijesh.singh@amd.com>,
	Tom Lendacky <thomas.lendacky@amd.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>, "Arnd Bergmann" <arnd@arndb.de>,
	"David Laight" <David.Laight@aculab.com>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"x86@kernel.org" <x86@kernel.org>,
	"linux-efi@vger.kernel.org" <linux-efi@vger.kernel.org>,
	"linuxppc-dev@lists.ozlabs.org" <linuxppc-dev@lists.ozlabs.org>,
	"kvm@vger.kernel.org" <kvm@vger.kernel.org>,
	"Fenghua Yu" <fenghua.yu@intel.com>,
	"Matt Fleming" <matt@codeblueprint.co.uk>,
	"David Howells" <dhowells@redhat.com>,
	"Paul Mackerras" <paulus@samba.org>,
	"Christoph Lameter" <cl@linux.com>,
	"Jonathan Corbet" <corbet@lwn.net>,
	"Radim Krcmár" <rkrcmar@redhat.com>,
	"Piotr Luc" <piotr.luc@intel.com>,
	"Ingo Molnar" <mingo@redhat.com>,
	"Dave Airlie" <airlied@redhat.com>,
	"Kees Cook" <keescook@chromium.org>,
	"Konrad Rzeszutek Wilk" <konrad.wilk@oracle.com>,
	"Reza Arbab" <arbab@linux.vnet.ibm.com>,
	"Andy Lutomirski" <luto@kernel.org>,
	"Thomas Gleixner" <tglx@linutronix.de>,
	"Laura Abbott" <labbott@redhat.com>,
	"Tony Luck" <tony.luck@intel.com>,
	Ard.Biesheuvel@zytor.com
Subject: Re: [RFC Part1 PATCH v3 13/17] x86/io: Unroll string I/O when SEV is active
Date: Tue, 22 Aug 2017 18:52:48 +0200	[thread overview]
Message-ID: <20170822165248.rkbluikdgduu7ucy@pd.tnic> (raw)
In-Reply-To: <589d65a4-eb09-bae9-e8b4-a2d78ca6b509@amd.com>

On Wed, Jul 26, 2017 at 03:07:14PM -0500, Brijesh Singh wrote:
> Are you commenting on amount of code duplication ? If so, I can certainly improve
> and use the similar macro used into header file to generate the functions body.

So the argument about having CONFIG_AMD_MEM_ENCRYPT disabled doesn't
bring a whole lot because distro kernels will all have it enabled.

Optimally, it would be best if when SEV is enabled, we patch those IO
insns but we can't patch at arbitrary times - we just do it once, at
pre-SMP time.

And from looking at the code, we do set sev_enabled very early, as
part of __startup_64() -> sme_enable() so I guess we can make that
set a synthetic X86_FEATURE_ bit and then patch REP IN/OUT* with a
CALL, similar to what we do in arch/x86/include/asm/arch_hweight.h with
POPCNT.

But there you need to pay attention to registers being clobbered, see

  f5967101e9de ("x86/hweight: Get rid of the special calling convention")

Yap, it does sound a bit more complex but if done right, we will be
patching all call sites the same way we patch hweight*() calls and there
should be no change to kernel size...

As always, the devil is in the detail.

-- 
Regards/Gruss,
    Boris.

SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
-- 

WARNING: multiple messages have this Message-ID (diff)
From: Borislav Petkov <bp-l3A5Bk7waGM@public.gmane.org>
To: Brijesh Singh <brijesh.singh-5C7GfCeVMHo@public.gmane.org>,
	Tom Lendacky <thomas.lendacky-5C7GfCeVMHo@public.gmane.org>
Cc: "H. Peter Anvin" <hpa-YMNOUZJC4hwAvxtiuMwx3w@public.gmane.org>,
	"Arnd Bergmann" <arnd-r2nGTMty4D4@public.gmane.org>,
	"David Laight"
	<David.Laight-JxhZ9S5GRejQT0dZR+AlfA@public.gmane.org>,
	"linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org"
	<linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>,
	"x86-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org"
	<x86-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>,
	"linux-efi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org"
	<linux-efi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>,
	"linuxppc-dev-uLR06cmDAlY/bJ5BZ2RsiQ@public.gmane.org"
	<linuxppc-dev-uLR06cmDAlY/bJ5BZ2RsiQ@public.gmane.org>,
	"kvm-u79uwXL29TY76Z2rM5mHXA@public.gmane.org"
	<kvm-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>,
	"Fenghua Yu" <fenghua.yu-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>,
	"Matt Fleming"
	<matt-mF/unelCI9GS6iBeEJttW/XRex20P6io@public.gmane.org>,
	"David Howells"
	<dhowells-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>,
	"Paul Mackerras" <paulus-eUNUBHrolfbYtjvyW6yDsg@public.gmane.org>,
	"Christoph Lameter" <cl-vYTEC60ixJUAvxtiuMwx3w@public.gmane.org>,
	"Jonathan Corbet" <corbet-T1hC0tSOHrs@public.gmane.org>,
	"Radim Krcmár" <rkrcmar-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>,
	"Piotr Luc" <piotr.luc-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>,
	"Ingo Molnar" <mingo-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>,
	"Dave Airlie" <airlied-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>,
	"Kees Cook" <keescook@chr>
Subject: Re: [RFC Part1 PATCH v3 13/17] x86/io: Unroll string I/O when SEV is active
Date: Tue, 22 Aug 2017 18:52:48 +0200	[thread overview]
Message-ID: <20170822165248.rkbluikdgduu7ucy@pd.tnic> (raw)
In-Reply-To: <589d65a4-eb09-bae9-e8b4-a2d78ca6b509-5C7GfCeVMHo@public.gmane.org>

On Wed, Jul 26, 2017 at 03:07:14PM -0500, Brijesh Singh wrote:
> Are you commenting on amount of code duplication ? If so, I can certainly improve
> and use the similar macro used into header file to generate the functions body.

So the argument about having CONFIG_AMD_MEM_ENCRYPT disabled doesn't
bring a whole lot because distro kernels will all have it enabled.

Optimally, it would be best if when SEV is enabled, we patch those IO
insns but we can't patch at arbitrary times - we just do it once, at
pre-SMP time.

And from looking at the code, we do set sev_enabled very early, as
part of __startup_64() -> sme_enable() so I guess we can make that
set a synthetic X86_FEATURE_ bit and then patch REP IN/OUT* with a
CALL, similar to what we do in arch/x86/include/asm/arch_hweight.h with
POPCNT.

But there you need to pay attention to registers being clobbered, see

  f5967101e9de ("x86/hweight: Get rid of the special calling convention")

Yap, it does sound a bit more complex but if done right, we will be
patching all call sites the same way we patch hweight*() calls and there
should be no change to kernel size...

As always, the devil is in the detail.

-- 
Regards/Gruss,
    Boris.

SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
-- 

  parent reply	other threads:[~2017-08-22 16:53 UTC|newest]

Thread overview: 226+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-07-24 19:07 [RFC Part1 PATCH v3 00/17] x86: Secure Encrypted Virtualization (AMD) Brijesh Singh
2017-07-24 19:07 ` Brijesh Singh
2017-07-24 19:07 ` Brijesh Singh
2017-07-24 19:07 ` [RFC Part1 PATCH v3 01/17] Documentation/x86: Add AMD Secure Encrypted Virtualization (SEV) descrption Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-07-25  5:45   ` Borislav Petkov
2017-07-25  5:45     ` Borislav Petkov
2017-07-25  5:45     ` Borislav Petkov
2017-07-25 14:59     ` Brijesh Singh
2017-07-25 14:59       ` Brijesh Singh
2017-07-25 14:59       ` Brijesh Singh
2017-07-24 19:07 ` [RFC Part1 PATCH v3 02/17] x86/CPU/AMD: Add the Secure Encrypted Virtualization CPU feature Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-07-25 10:26   ` Borislav Petkov
2017-07-25 10:26     ` Borislav Petkov
2017-07-25 10:26     ` Borislav Petkov
2017-07-25 14:29     ` Tom Lendacky
2017-07-25 14:29       ` Tom Lendacky
2017-07-25 14:29       ` Tom Lendacky
2017-07-25 14:36       ` Borislav Petkov
2017-07-25 14:36         ` Borislav Petkov
2017-07-25 14:36         ` Borislav Petkov
2017-07-25 14:58         ` Tom Lendacky
2017-07-25 14:58           ` Tom Lendacky
2017-07-25 14:58           ` Tom Lendacky
2017-07-25 15:13           ` Borislav Petkov
2017-07-25 15:13             ` Borislav Petkov
2017-07-25 15:13             ` Borislav Petkov
2017-07-25 15:29             ` Tom Lendacky
2017-07-25 15:29               ` Tom Lendacky
2017-07-25 15:29               ` Tom Lendacky
2017-07-25 15:33               ` Borislav Petkov
2017-07-25 15:33                 ` Borislav Petkov
2017-07-25 15:33                 ` Borislav Petkov
2017-08-09 18:17                 ` Tom Lendacky
2017-08-09 18:17                   ` Tom Lendacky
2017-08-17  8:12                   ` Borislav Petkov
2017-08-17  8:12                     ` Borislav Petkov
2017-08-17  8:12                     ` Borislav Petkov
2017-07-24 19:07 ` [RFC Part1 PATCH v3 03/17] x86/mm: Secure Encrypted Virtualization (SEV) support Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-07-26  4:28   ` Borislav Petkov
2017-07-26  4:28     ` Borislav Petkov
2017-07-26  4:28     ` Borislav Petkov
2017-07-26 16:47     ` Tom Lendacky
2017-07-26 16:47       ` Tom Lendacky
2017-07-26 16:47       ` Tom Lendacky
2017-07-27 13:39       ` Borislav Petkov
2017-07-27 13:39         ` Borislav Petkov
2017-07-27 13:39         ` Borislav Petkov
2017-07-24 19:07 ` [RFC Part1 PATCH v3 04/17] x86/mm: Don't attempt to encrypt initrd under SEV Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-07-26 14:44   ` Borislav Petkov
2017-07-26 14:44     ` Borislav Petkov
2017-07-26 14:44     ` Borislav Petkov
2017-07-24 19:07 ` [RFC Part1 PATCH v3 05/17] x86, realmode: Don't decrypt trampoline area " Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-07-26 16:03   ` Borislav Petkov
2017-07-26 16:03     ` Borislav Petkov
2017-07-26 16:03     ` Borislav Petkov
2017-08-10 13:03     ` Tom Lendacky
2017-08-10 13:03       ` Tom Lendacky
2017-08-10 13:03       ` Tom Lendacky
2017-07-24 19:07 ` [RFC Part1 PATCH v3 06/17] x86/mm: Use encrypted access of boot related data with SEV Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-07-27 13:31   ` Borislav Petkov
2017-07-27 13:31     ` Borislav Petkov
2017-07-27 13:31     ` Borislav Petkov
2017-08-17 18:05     ` Tom Lendacky
2017-08-17 18:05       ` Tom Lendacky
2017-08-17 18:05       ` Tom Lendacky
2017-07-24 19:07 ` [RFC Part1 PATCH v3 07/17] x86/mm: Include SEV for encryption memory attribute changes Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-07-27 14:58   ` Borislav Petkov
2017-07-27 14:58     ` Borislav Petkov
2017-07-27 14:58     ` Borislav Petkov
2017-07-28  8:47     ` David Laight
2017-07-28  8:47       ` David Laight
2017-07-28  8:47       ` David Laight
2017-08-17 18:21       ` Tom Lendacky
2017-08-17 18:21         ` Tom Lendacky
2017-08-17 18:10     ` Tom Lendacky
2017-08-17 18:10       ` Tom Lendacky
2017-08-17 18:10       ` Tom Lendacky
2017-07-24 19:07 ` [RFC Part1 PATCH v3 08/17] x86/efi: Access EFI data as encrypted when SEV is active Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-07-28 10:31   ` Borislav Petkov
2017-07-28 10:31     ` Borislav Petkov
2017-07-28 10:31     ` Borislav Petkov
2017-08-17 18:42     ` Tom Lendacky
2017-08-17 18:42       ` Tom Lendacky
2017-08-17 18:42       ` Tom Lendacky
2017-07-24 19:07 ` [RFC Part1 PATCH v3 09/17] resource: Consolidate resource walking code Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-07-28 15:23   ` Borislav Petkov
2017-07-28 15:23     ` Borislav Petkov
2017-07-28 15:23     ` Borislav Petkov
2017-08-17 18:55     ` Tom Lendacky
2017-08-17 18:55       ` Tom Lendacky
2017-08-17 18:55       ` Tom Lendacky
2017-08-17 19:03       ` Tom Lendacky
2017-08-17 19:03         ` Tom Lendacky
2017-08-17 19:03         ` Tom Lendacky
2017-07-24 19:07 ` [RFC Part1 PATCH v3 10/17] resource: Provide resource struct in resource walk callback Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-07-31  8:26   ` Borislav Petkov
2017-07-31  8:26     ` Borislav Petkov
2017-07-31  8:26     ` Borislav Petkov
2017-07-31 22:19   ` Kees Cook
2017-07-31 22:19     ` Kees Cook
2017-07-31 22:19     ` Kees Cook
2017-07-24 19:07 ` [RFC Part1 PATCH v3 11/17] x86/mm, resource: Use PAGE_KERNEL protection for ioremap of memory pages Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-08-02  4:02   ` Borislav Petkov
2017-08-02  4:02     ` Borislav Petkov
2017-08-02  4:02     ` Borislav Petkov
2017-08-17 19:22     ` Tom Lendacky
2017-08-17 19:22       ` Tom Lendacky
2017-08-17 19:22       ` Tom Lendacky
2017-07-24 19:07 ` [RFC Part1 PATCH v3 12/17] x86/mm: DMA support for SEV memory encryption Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-08-07  3:48   ` Borislav Petkov
2017-08-07  3:48     ` Borislav Petkov
2017-08-07  3:48     ` Borislav Petkov
2017-08-17 19:35     ` Tom Lendacky
2017-08-17 19:35       ` Tom Lendacky
2017-08-17 19:35       ` Tom Lendacky
2017-07-24 19:07 ` [RFC Part1 PATCH v3 13/17] x86/io: Unroll string I/O when SEV is active Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-07-25  9:51   ` David Laight
2017-07-25  9:51     ` David Laight
2017-07-25  9:51     ` David Laight
2017-07-26 10:45     ` Arnd Bergmann
2017-07-26 10:45       ` Arnd Bergmann
2017-07-26 19:24       ` Brijesh Singh
2017-07-26 19:24         ` Brijesh Singh
2017-07-26 19:26         ` H. Peter Anvin
2017-07-26 19:26           ` H. Peter Anvin
2017-07-26 19:26           ` H. Peter Anvin
2017-07-26 19:26           ` H. Peter Anvin
2017-07-26 20:07           ` Brijesh Singh
2017-07-26 20:07             ` Brijesh Singh
2017-07-27  7:45             ` David Laight
2017-07-27  7:45               ` David Laight
2017-07-27  7:45               ` David Laight
2017-08-22 16:52             ` Borislav Petkov [this message]
2017-08-22 16:52               ` Borislav Petkov
2017-09-15 12:24               ` Borislav Petkov
2017-09-15 12:24                 ` Borislav Petkov
2017-09-15 14:13                 ` Brijesh Singh
2017-09-15 14:13                   ` Brijesh Singh
2017-09-15 14:40                   ` Borislav Petkov
2017-09-15 14:40                     ` Borislav Petkov
2017-09-15 14:48                     ` Brijesh Singh
2017-09-15 14:48                       ` Brijesh Singh
2017-09-15 16:22                       ` Borislav Petkov
2017-09-15 16:22                         ` Borislav Petkov
2017-09-15 16:27                         ` Brijesh Singh
2017-09-15 16:27                           ` Brijesh Singh
2017-07-24 19:07 ` [RFC Part1 PATCH v3 14/17] x86/boot: Add early boot support when running with SEV active Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-08-23 15:30   ` Borislav Petkov
2017-08-23 15:30     ` Borislav Petkov
2017-08-23 15:30     ` Borislav Petkov
2017-08-24 18:54     ` Tom Lendacky
2017-08-24 18:54       ` Tom Lendacky
2017-08-24 18:54       ` Tom Lendacky
2017-08-25 12:54       ` Borislav Petkov
2017-08-25 12:54         ` Borislav Petkov
2017-08-25 12:54         ` Borislav Petkov
2017-07-24 19:07 ` [RFC Part1 PATCH v3 15/17] x86: Add support for changing memory encryption attribute in early boot Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-08-28 10:51   ` Borislav Petkov
2017-08-28 10:51     ` Borislav Petkov
2017-08-28 10:51     ` Borislav Petkov
2017-08-28 11:49     ` Brijesh Singh
2017-08-28 11:49       ` Brijesh Singh
2017-08-28 11:49       ` Brijesh Singh
2017-07-24 19:07 ` [RFC Part1 PATCH v3 16/17] X86/KVM: Provide support to create Guest and HV shared per-CPU variables Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-08-29 10:22   ` Borislav Petkov
2017-08-29 10:22     ` Borislav Petkov
2017-08-29 10:22     ` Borislav Petkov
2017-08-30 16:18     ` Brijesh Singh
2017-08-30 16:18       ` Brijesh Singh
2017-08-30 16:18       ` Brijesh Singh
2017-08-30 17:46       ` Borislav Petkov
2017-08-30 17:46         ` Borislav Petkov
2017-08-30 17:46         ` Borislav Petkov
2017-09-01 22:52         ` Brijesh Singh
2017-09-01 22:52           ` Brijesh Singh
2017-09-01 22:52           ` Brijesh Singh
2017-09-02  3:21           ` Andy Lutomirski
2017-09-02  3:21             ` Andy Lutomirski
2017-09-02  3:21             ` Andy Lutomirski
2017-09-03  2:34             ` Brijesh Singh
2017-09-03  2:34               ` Brijesh Singh
2017-09-03  2:34               ` Brijesh Singh
2017-09-04 17:05           ` Borislav Petkov
2017-09-04 17:05             ` Borislav Petkov
2017-09-04 17:05             ` Borislav Petkov
2017-09-04 17:47             ` Brijesh Singh
2017-09-04 17:47               ` Brijesh Singh
2017-09-04 17:47               ` Brijesh Singh
2017-07-24 19:07 ` [RFC Part1 PATCH v3 17/17] X86/KVM: Clear encryption attribute when SEV is active Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-07-24 19:07   ` Brijesh Singh
2017-08-31 15:06   ` Borislav Petkov
2017-08-31 15:06     ` Borislav Petkov
2017-08-31 15:06     ` Borislav Petkov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170822165248.rkbluikdgduu7ucy@pd.tnic \
    --to=bp@suse.de \
    --cc=Ard.Biesheuvel@zytor.com \
    --cc=David.Laight@aculab.com \
    --cc=airlied@redhat.com \
    --cc=arbab@linux.vnet.ibm.com \
    --cc=arnd@arndb.de \
    --cc=brijesh.singh@amd.com \
    --cc=cl@linux.com \
    --cc=corbet@lwn.net \
    --cc=dhowells@redhat.com \
    --cc=fenghua.yu@intel.com \
    --cc=hpa@zytor.com \
    --cc=keescook@chromium.org \
    --cc=konrad.wilk@oracle.com \
    --cc=kvm@vger.kernel.org \
    --cc=labbott@redhat.com \
    --cc=linux-efi@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linuxppc-dev@lists.ozlabs.org \
    --cc=luto@kernel.org \
    --cc=matt@codeblueprint.co.uk \
    --cc=mingo@redhat.com \
    --cc=paulus@samba.org \
    --cc=piotr.luc@intel.com \
    --cc=rkrcmar@redhat.com \
    --cc=tglx@linutronix.de \
    --cc=thomas.lendacky@amd.com \
    --cc=tony.luck@intel.com \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.