From: Michael Kelley <mikelley@microsoft.com>
To: Tianyu Lan <ltykernel@gmail.com>,
KY Srinivasan <kys@microsoft.com>,
Haiyang Zhang <haiyangz@microsoft.com>,
Stephen Hemminger <sthemmin@microsoft.com>,
"wei.liu@kernel.org" <wei.liu@kernel.org>,
Dexuan Cui <decui@microsoft.com>,
"tglx@linutronix.de" <tglx@linutronix.de>,
"mingo@redhat.com" <mingo@redhat.com>,
"bp@alien8.de" <bp@alien8.de>, "x86@kernel.org" <x86@kernel.org>,
"hpa@zytor.com" <hpa@zytor.com>,
"dave.hansen@linux.intel.com" <dave.hansen@linux.intel.com>,
"luto@kernel.org" <luto@kernel.org>,
"peterz@infradead.org" <peterz@infradead.org>,
"davem@davemloft.net" <davem@davemloft.net>,
"kuba@kernel.org" <kuba@kernel.org>,
"gregkh@linuxfoundation.org" <gregkh@linuxfoundation.org>,
"arnd@arndb.de" <arnd@arndb.de>,
"brijesh.singh@amd.com" <brijesh.singh@amd.com>,
"jroedel@suse.de" <jroedel@suse.de>,
Tianyu Lan <Tianyu.Lan@microsoft.com>,
"thomas.lendacky@amd.com" <thomas.lendacky@amd.com>,
"rientjes@google.com" <rientjes@google.com>,
"pgonda@google.com" <pgonda@google.com>,
"akpm@linux-foundation.org" <akpm@linux-foundation.org>,
"kirill.shutemov@linux.intel.com"
<kirill.shutemov@linux.intel.com>,
"rppt@kernel.org" <rppt@kernel.org>,
"saravanand@fb.com" <saravanand@fb.com>,
"aneesh.kumar@linux.ibm.com" <aneesh.kumar@linux.ibm.com>,
"hannes@cmpxchg.org" <hannes@cmpxchg.org>,
"tj@kernel.org" <tj@kernel.org>
Cc: "linux-arch@vger.kernel.org" <linux-arch@vger.kernel.org>,
"linux-hyperv@vger.kernel.org" <linux-hyperv@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"netdev@vger.kernel.org" <netdev@vger.kernel.org>,
vkuznets <vkuznets@redhat.com>,
"konrad.wilk@oracle.com" <konrad.wilk@oracle.com>,
"hch@lst.de" <hch@lst.de>,
"robin.murphy@arm.com" <robin.murphy@arm.com>,
"joro@8bytes.org" <joro@8bytes.org>,
"parri.andrea@gmail.com" <parri.andrea@gmail.com>,
"dave.hansen@intel.com" <dave.hansen@intel.com>
Subject: RE: [PATCH V8 0/9] x86/Hyper-V: Add Hyper-V Isolation VM support(First part)
Date: Fri, 22 Oct 2021 21:25:12 +0000 [thread overview]
Message-ID: <MWHPR21MB15931B80A8431CF46B6CE11FD7809@MWHPR21MB1593.namprd21.prod.outlook.com> (raw)
In-Reply-To: <20211021154110.3734294-1-ltykernel@gmail.com>
From: Tianyu Lan <ltykernel@gmail.com> Sent: Thursday, October 21, 2021 8:41 AM
>
> Hyper-V provides two kinds of Isolation VMs. VBS(Virtualization-based
> security) and AMD SEV-SNP unenlightened Isolation VMs. This patchset
> is to add support for these Isolation VM support in Linux.
>
> The memory of these vms are encrypted and host can't access guest
> memory directly. Hyper-V provides new host visibility hvcall and
> the guest needs to call new hvcall to mark memory visible to host
> before sharing memory with host. For security, all network/storage
> stack memory should not be shared with host and so there is bounce
> buffer requests.
>
> Vmbus channel ring buffer already plays bounce buffer role because
> all data from/to host needs to copy from/to between the ring buffer
> and IO stack memory. So mark vmbus channel ring buffer visible.
>
> For SNP isolation VM, guest needs to access the shared memory via
> extra address space which is specified by Hyper-V CPUID HYPERV_CPUID_
> ISOLATION_CONFIG. The access physical address of the shared memory
> should be bounce buffer memory GPA plus with shared_gpa_boundary
> reported by CPUID.
>
> This patchset is rebased on the commit d9abdee of Linux mainline tree
> and plus clean up patch from Borislav
> Petkov
>
> Change since v7
> - Rework sev_es_ghcb_hv_call() and export it for Hyper-V
> according to suggestion from Borislav Petkov.
>
> Change since v6
> - Add hv_set_mem_host_visibility() when CONFIG_HYPERV is no.
> Fix compile error.
> - Add comment to describe __set_memory_enc_pgtable().
> - Split SEV change into patch "Expose __sev_es_ghcb_hv_call()
> to call ghcb hv call out of sev code"
> - Add comment about calling memunmap() in the non-snp IVM.
>
> Change since v5
> - Replace HVPFN_UP() with PFN_UP() in the __vmbus_establish_gpadl()
> - Remove unused variable gpadl in the __vmbus_open() and vmbus_close_
> internal()
> - Clean gpadl_handle in the vmbus_teardown_gpadl().
> - Adjust change layout in the asm/mshyperv.h to make
> hv_is_synic_reg(), hv_get_register() and hv_set_register()
> ahead of the #include of asm-generic/mshyperv.h
> - Change vmbus_connection.monitor_pages_pa type from unsigned
> long to phys_addr_t
>
> Change since v4:
> - Hide hv_mark_gpa_visibility() and set memory visibility via
> set_memory_encrypted/decrypted()
> - Change gpadl handle in netvsc and uio driver from u32 to
> struct vmbus_gpadl.
> - Change vmbus_establish_gpadl()'s gpadl_handle parameter
> to vmbus_gpadl data structure.
> - Remove hv_get_simp(), hv_get_siefp() hv_get_synint_*()
> helper function. Move the logic into hv_get/set_register().
> - Use scsi_dma_map/unmap() instead of dma_map/unmap_sg() in storvsc driver.
> - Allocate rx/tx ring buffer via alloc_pages() in Isolation VM
>
> Change since V3:
> - Initalize GHCB page in the cpu init callbac.
> - Change vmbus_teardown_gpadl() parameter in order to
> mask the memory back to non-visible to host.
> - Merge hv_ringbuffer_post_init() into hv_ringbuffer_init().
> - Keep Hyper-V bounce buffer size as same as AMD SEV VM
> - Use dma_map_sg() instead of dm_map_page() in the storvsc driver.
>
> Change since V2:
> - Drop x86_set_memory_enc static call and use platform check
> in the __set_memory_enc_dec() to run platform callback of
> set memory encrypted or decrypted.
>
> Change since V1:
> - Introduce x86_set_memory_enc static call and so platforms can
> override __set_memory_enc_dec() with their implementation
> - Introduce sev_es_ghcb_hv_call_simple() and share code
> between SEV and Hyper-V code.
> - Not remap monitor pages in the non-SNP isolation VM
> - Make swiotlb_init_io_tlb_mem() return error code and return
> error when dma_map_decrypted() fails.
>
> Change since RFC V4:
> - Introduce dma map decrypted function to remap bounce buffer
> and provide dma map decrypted ops for platform to hook callback.
> - Split swiotlb and dma map decrypted change into two patches
> - Replace vstart with vaddr in swiotlb changes.
>
> Change since RFC v3:
> - Add interface set_memory_decrypted_map() to decrypt memory and
> map bounce buffer in extra address space
> - Remove swiotlb remap function and store the remap address
> returned by set_memory_decrypted_map() in swiotlb mem data structure.
> - Introduce hv_set_mem_enc() to make code more readable in the __set_memory_enc_dec().
>
> Change since RFC v2:
> - Remove not UIO driver in Isolation VM patch
> - Use vmap_pfn() to replace ioremap_page_range function in
> order to avoid exposing symbol ioremap_page_range() and
> ioremap_page_range()
> - Call hv set mem host visibility hvcall in set_memory_encrypted/decrypted()
> - Enable swiotlb force mode instead of adding Hyper-V dma map/unmap hook
> - Fix code style
>
> Tianyu Lan (9):
> x86/hyperv: Initialize GHCB page in Isolation VM
> x86/hyperv: Initialize shared memory boundary in the Isolation VM.
> x86/hyperv: Add new hvcall guest address host visibility support
> Drivers: hv: vmbus: Mark vmbus ring buffer visible to host in
> Isolation VM
> x86/sev-es: Expose sev_es_ghcb_hv_call() to call ghcb hv call out of
> sev code
> x86/hyperv: Add Write/Read MSR registers via ghcb page
> x86/hyperv: Add ghcb hvcall support for SNP VM
> Drivers: hv: vmbus: Add SNP support for VMbus channel initiate
> message
> Drivers: hv : vmbus: Initialize VMbus ring buffer for Isolation VM
>
> arch/x86/hyperv/Makefile | 2 +-
> arch/x86/hyperv/hv_init.c | 78 ++++++--
> arch/x86/hyperv/ivm.c | 286 +++++++++++++++++++++++++++++
> arch/x86/include/asm/hyperv-tlfs.h | 17 ++
> arch/x86/include/asm/mshyperv.h | 64 +++++--
> arch/x86/include/asm/sev.h | 12 ++
> arch/x86/kernel/cpu/mshyperv.c | 5 +
> arch/x86/kernel/sev-shared.c | 26 ++-
> arch/x86/kernel/sev.c | 13 +-
> arch/x86/mm/pat/set_memory.c | 23 ++-
> drivers/hv/Kconfig | 1 +
> drivers/hv/channel.c | 72 +++++---
> drivers/hv/connection.c | 101 +++++++++-
> drivers/hv/hv.c | 82 +++++++--
> drivers/hv/hv_common.c | 12 ++
> drivers/hv/hyperv_vmbus.h | 2 +
> drivers/hv/ring_buffer.c | 55 ++++--
> drivers/net/hyperv/hyperv_net.h | 5 +-
> drivers/net/hyperv/netvsc.c | 15 +-
> drivers/uio/uio_hv_generic.c | 18 +-
> include/asm-generic/hyperv-tlfs.h | 1 +
> include/asm-generic/mshyperv.h | 20 +-
> include/linux/hyperv.h | 12 +-
> 23 files changed, 783 insertions(+), 139 deletions(-)
> create mode 100644 arch/x86/hyperv/ivm.c
>
> --
> 2.25.1
For the entire series, modulo a minor missing argument error in a
declaration in Patch 5 that I noted separately,
Reviewed-by: Michael Kelley <mikelley@microsoft.com>
prev parent reply other threads:[~2021-10-22 21:25 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-10-21 15:41 [PATCH V8 0/9] x86/Hyper-V: Add Hyper-V Isolation VM support(First part) Tianyu Lan
2021-10-21 15:41 ` [PATCH V8 1/9] x86/hyperv: Initialize GHCB page in Isolation VM Tianyu Lan
2021-10-21 15:41 ` [PATCH V8 2/9] x86/hyperv: Initialize shared memory boundary in the " Tianyu Lan
2021-10-21 15:41 ` [PATCH V8 3/9] x86/hyperv: Add new hvcall guest address host visibility support Tianyu Lan
2021-10-21 15:41 ` [PATCH V8 4/9] Drivers: hv: vmbus: Mark vmbus ring buffer visible to host in Isolation VM Tianyu Lan
2021-10-21 15:41 ` [PATCH V8 5/9] x86/sev-es: Expose sev_es_ghcb_hv_call() to call ghcb hv call out of sev code Tianyu Lan
2021-10-21 16:22 ` Borislav Petkov
2021-10-22 13:39 ` Tianyu Lan
2021-10-25 11:20 ` Wei Liu
2021-10-25 11:24 ` Borislav Petkov
2021-10-25 12:27 ` Tianyu Lan
2021-10-25 16:37 ` Borislav Petkov
2021-10-25 20:54 ` Wei Liu
2021-10-22 13:37 ` [PATCH V8.1 " Tianyu Lan
2021-10-22 20:58 ` Michael Kelley
2021-10-23 17:29 ` Borislav Petkov
2021-10-21 15:41 ` [PATCH V8 6/9] x86/hyperv: Add Write/Read MSR registers via ghcb page Tianyu Lan
2021-10-21 15:41 ` [PATCH V8 7/9] x86/hyperv: Add ghcb hvcall support for SNP VM Tianyu Lan
2021-10-21 15:41 ` [PATCH V8 8/9] Drivers: hv: vmbus: Add SNP support for VMbus channel initiate message Tianyu Lan
2021-10-21 15:41 ` [PATCH V8 9/9] Drivers: hv : vmbus: Initialize VMbus ring buffer for Isolation VM Tianyu Lan
2021-10-22 13:47 ` [PATCH V8.1 6/9] x86/hyperv: Add Write/Read MSR registers via ghcb page Tianyu Lan
2021-10-22 21:25 ` Michael Kelley [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=MWHPR21MB15931B80A8431CF46B6CE11FD7809@MWHPR21MB1593.namprd21.prod.outlook.com \
--to=mikelley@microsoft.com \
--cc=Tianyu.Lan@microsoft.com \
--cc=akpm@linux-foundation.org \
--cc=aneesh.kumar@linux.ibm.com \
--cc=arnd@arndb.de \
--cc=bp@alien8.de \
--cc=brijesh.singh@amd.com \
--cc=dave.hansen@intel.com \
--cc=dave.hansen@linux.intel.com \
--cc=davem@davemloft.net \
--cc=decui@microsoft.com \
--cc=gregkh@linuxfoundation.org \
--cc=haiyangz@microsoft.com \
--cc=hannes@cmpxchg.org \
--cc=hch@lst.de \
--cc=hpa@zytor.com \
--cc=joro@8bytes.org \
--cc=jroedel@suse.de \
--cc=kirill.shutemov@linux.intel.com \
--cc=konrad.wilk@oracle.com \
--cc=kuba@kernel.org \
--cc=kys@microsoft.com \
--cc=linux-arch@vger.kernel.org \
--cc=linux-hyperv@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=ltykernel@gmail.com \
--cc=luto@kernel.org \
--cc=mingo@redhat.com \
--cc=netdev@vger.kernel.org \
--cc=parri.andrea@gmail.com \
--cc=peterz@infradead.org \
--cc=pgonda@google.com \
--cc=rientjes@google.com \
--cc=robin.murphy@arm.com \
--cc=rppt@kernel.org \
--cc=saravanand@fb.com \
--cc=sthemmin@microsoft.com \
--cc=tglx@linutronix.de \
--cc=thomas.lendacky@amd.com \
--cc=tj@kernel.org \
--cc=vkuznets@redhat.com \
--cc=wei.liu@kernel.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).