From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965242AbdKGOvc (ORCPT ); Tue, 7 Nov 2017 09:51:32 -0500 Received: from terminus.zytor.com ([65.50.211.136]:46625 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933147AbdKGOv3 (ORCPT ); Tue, 7 Nov 2017 09:51:29 -0500 Date: Tue, 7 Nov 2017 06:49:04 -0800 From: tip-bot for Brijesh Singh Message-ID: Cc: pbonzini@redhat.com, brijesh.singh@amd.com, bp@suse.de, mingo@kernel.org, thomas.lendacky@amd.com, linux-kernel@vger.kernel.org, tglx@linutronix.de, hpa@zytor.com, bp@alien8.de, rkrcmar@redhat.com Reply-To: pbonzini@redhat.com, brijesh.singh@amd.com, bp@suse.de, mingo@kernel.org, linux-kernel@vger.kernel.org, thomas.lendacky@amd.com, tglx@linutronix.de, hpa@zytor.com, rkrcmar@redhat.com, bp@alien8.de In-Reply-To: <20171020143059.3291-17-brijesh.singh@amd.com> References: <20171020143059.3291-17-brijesh.singh@amd.com> To: linux-tip-commits@vger.kernel.org Subject: [tip:x86/asm] X86/KVM: Decrypt shared per-cpu variables when SEV is active Git-Commit-ID: 4716276184ec67a123a4eab81609a0688b1d650b X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: 4716276184ec67a123a4eab81609a0688b1d650b Gitweb: https://git.kernel.org/tip/4716276184ec67a123a4eab81609a0688b1d650b Author: Brijesh Singh AuthorDate: Fri, 20 Oct 2017 09:30:58 -0500 Committer: Thomas Gleixner CommitDate: Tue, 7 Nov 2017 15:36:00 +0100 X86/KVM: Decrypt shared per-cpu variables when SEV is active When SEV is active, guest memory is encrypted with a guest-specific key, a guest memory region shared with the hypervisor must be mapped as decrypted before it can be shared. Signed-off-by: Brijesh Singh Signed-off-by: Thomas Gleixner Reviewed-by: Borislav Petkov Tested-by: Borislav Petkov Cc: Tom Lendacky Cc: kvm@vger.kernel.org Cc: Radim Krčmář Cc: Borislav Petkov Cc: Paolo Bonzini Link: https://lkml.kernel.org/r/20171020143059.3291-17-brijesh.singh@amd.com --- arch/x86/kernel/kvm.c | 40 +++++++++++++++++++++++++++++++++++++--- 1 file changed, 37 insertions(+), 3 deletions(-) diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c index 8bb9594..3df743b 100644 --- a/arch/x86/kernel/kvm.c +++ b/arch/x86/kernel/kvm.c @@ -75,8 +75,8 @@ static int parse_no_kvmclock_vsyscall(char *arg) early_param("no-kvmclock-vsyscall", parse_no_kvmclock_vsyscall); -static DEFINE_PER_CPU(struct kvm_vcpu_pv_apf_data, apf_reason) __aligned(64); -static DEFINE_PER_CPU(struct kvm_steal_time, steal_time) __aligned(64); +static DEFINE_PER_CPU_DECRYPTED(struct kvm_vcpu_pv_apf_data, apf_reason) __aligned(64); +static DEFINE_PER_CPU_DECRYPTED(struct kvm_steal_time, steal_time) __aligned(64); static int has_steal_clock = 0; /* @@ -312,7 +312,7 @@ static void kvm_register_steal_time(void) cpu, (unsigned long long) slow_virt_to_phys(st)); } -static DEFINE_PER_CPU(unsigned long, kvm_apic_eoi) = KVM_PV_EOI_DISABLED; +static DEFINE_PER_CPU_DECRYPTED(unsigned long, kvm_apic_eoi) = KVM_PV_EOI_DISABLED; static notrace void kvm_guest_apic_eoi_write(u32 reg, u32 val) { @@ -426,9 +426,42 @@ void kvm_disable_steal_time(void) wrmsr(MSR_KVM_STEAL_TIME, 0, 0); } +static inline void __set_percpu_decrypted(void *ptr, unsigned long size) +{ + early_set_memory_decrypted((unsigned long) ptr, size); +} + +/* + * Iterate through all possible CPUs and map the memory region pointed + * by apf_reason, steal_time and kvm_apic_eoi as decrypted at once. + * + * Note: we iterate through all possible CPUs to ensure that CPUs + * hotplugged will have their per-cpu variable already mapped as + * decrypted. + */ +static void __init sev_map_percpu_data(void) +{ + int cpu; + + if (!sev_active()) + return; + + for_each_possible_cpu(cpu) { + __set_percpu_decrypted(&per_cpu(apf_reason, cpu), sizeof(apf_reason)); + __set_percpu_decrypted(&per_cpu(steal_time, cpu), sizeof(steal_time)); + __set_percpu_decrypted(&per_cpu(kvm_apic_eoi, cpu), sizeof(kvm_apic_eoi)); + } +} + #ifdef CONFIG_SMP static void __init kvm_smp_prepare_boot_cpu(void) { + /* + * Map the per-cpu variables as decrypted before kvm_guest_cpu_init() + * shares the guest physical address with the hypervisor. + */ + sev_map_percpu_data(); + kvm_guest_cpu_init(); native_smp_prepare_boot_cpu(); kvm_spinlock_init(); @@ -496,6 +529,7 @@ void __init kvm_guest_init(void) kvm_cpu_online, kvm_cpu_down_prepare) < 0) pr_err("kvm_guest: Failed to install cpu hotplug callbacks\n"); #else + sev_map_percpu_data(); kvm_guest_cpu_init(); #endif