From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id BC7C9EB64DC for ; Wed, 21 Jun 2023 09:43:32 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 1655E8D0002; Wed, 21 Jun 2023 05:43:32 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 1155B8D0001; Wed, 21 Jun 2023 05:43:32 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id F1E448D0002; Wed, 21 Jun 2023 05:43:31 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id E11FD8D0001 for ; Wed, 21 Jun 2023 05:43:31 -0400 (EDT) Received: from smtpin13.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id A4E26C06F7 for ; Wed, 21 Jun 2023 09:43:31 +0000 (UTC) X-FDA: 80926267422.13.63FC5F5 Received: from mail.skyhub.de (mail.skyhub.de [5.9.137.197]) by imf17.hostedemail.com (Postfix) with ESMTP id 7967340003 for ; Wed, 21 Jun 2023 09:43:28 +0000 (UTC) Authentication-Results: imf17.hostedemail.com; dkim=pass header.d=alien8.de header.s=dkim header.b=fGGGFOcm; dkim=pass header.d=alien8.de header.s=alien8 header.b=fyQVwBnA; spf=pass (imf17.hostedemail.com: domain of bp@alien8.de designates 5.9.137.197 as permitted sender) smtp.mailfrom=bp@alien8.de; dmarc=pass (policy=none) header.from=alien8.de ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1687340608; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=yXKcV3auqZiH5ablDN0OpddtOVM62a/D928JjKMNXI0=; b=FbGj6+2Tf2LA8bcouiFniPFh8EU+KFeKhvAGOaUbgLEsFvZ6prPj2F+M+2f2RcPKO0VkUq y33MUv/fAyilsMe7CMrwwpU+NRUsZzxEZ4QcFB5AQXMrxqr8jiV1/X9h4MkwHsnaVXIMKr KXGSdu9CS1Ksp0v8JpLGktyr7AFcxZQ= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1687340608; a=rsa-sha256; cv=none; b=IfYTtZM4HMPch/zPePxPWeB6iwk1fTjLPEz+09wo37fw+w0VjDUKjdP6xHcxF0/KXPJzAA hsnIA9jIE0s4OEOEE3EUFrFimmM1gYaodN0ISY37YdO1OjvtQfkamN4URK4yUpkWHqQp1D 2OObqIaqCHPUSS9zgaf5+TKsck+SaGg= ARC-Authentication-Results: i=1; imf17.hostedemail.com; dkim=pass header.d=alien8.de header.s=dkim header.b=fGGGFOcm; dkim=pass header.d=alien8.de header.s=alien8 header.b=fyQVwBnA; spf=pass (imf17.hostedemail.com: domain of bp@alien8.de designates 5.9.137.197 as permitted sender) smtp.mailfrom=bp@alien8.de; dmarc=pass (policy=none) header.from=alien8.de Received: from mail.alien8.de (mail.alien8.de [IPv6:2a01:4f9:3051:3f93::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.skyhub.de (SuperMail on ZX Spectrum 128k) with ESMTPSA id D62E51EC0645; Wed, 21 Jun 2023 11:43:25 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=alien8.de; s=dkim; t=1687340605; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:in-reply-to:in-reply-to: references:references; bh=yXKcV3auqZiH5ablDN0OpddtOVM62a/D928JjKMNXI0=; b=fGGGFOcm/j1jBRRvN7zXyPW4PWbANeEwKO58akYk3HFwWVhSbZepdoK1UDfltiq3BVsgxV afZo1xjFVpNXrOgPFEwzSrf+otLk2UgZpxcxQ/SMfzX2uiICQenOugsvfjtw+5jxoMDWDm xejbSVf4LXHZHL2lKqvLKvAqigR5Qp0= X-Virus-Scanned: Debian amavisd-new at mail.alien8.de Received: from mail.alien8.de ([127.0.0.1]) by localhost (mail.alien8.de [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id e4WsilyJ1x43; Wed, 21 Jun 2023 09:43:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=alien8.de; s=alien8; t=1687340602; bh=yXKcV3auqZiH5ablDN0OpddtOVM62a/D928JjKMNXI0=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=fyQVwBnAueySdbG0xMg34yXlW/XbZoa2fdHIxCPpbUpUvZTzceVEGqhpKf26M8jvh cQZrHrd4NDWJ1hZ9bhyVgh1pjqJKNLWEMiP5gA2Xv7wshI3Zdr7Ezl3oUQ1uk4hncH ktCnJjrTimE6r2iOMN1pBLtXrLeF2ISV/Nw1dqvQxfSDmKyO1yF4mNSg9urBDIt19l MOyDgIo8MpE4vooEPqEEgYB5Z2olkoquqbzGNxggefTMMtCyztPuHGCPg3nmVx4ozu EPUIsYbiqJxia1qErD6CYuMaJsODWsvZ+ZOAudy/BD72pBpc6AID/bTPdb3fSif4he YJqerDK6aM/oRya8NBWdn0pUP0ZzfKFVhaEGbiIc4fDLSmxsPt/LcKMFID505QCQeF bjPZumWkHDakTZMlxA5hv+gLVXfkr8mXNg4pxO6pnDXgITMEpqFW+4/KcWboFFnXik eYdNfzumlPl4OwXJ2X2A32oLbFraGQgho7WNG4HzPbuRoBvfnE4AFk+MN58iiXan/d 7YOKobJsShP6uAB/bu/hmdcuAF7hFSyLfx/3ll177T7PJLSzJNTbdqHS6oTgMKbf+/ /6fWRvqQT2vKqfHn6HtALNs+cMMAqD4RPO04QOQCVFEvh56EOxuwc3EewsfN5vk7wX dCgtDPf8uUZqB0n1/xsXwixA= Received: from zn.tnic (p200300ea971Dc592329c23FffEA6a903.dip0.t-ipconnect.de [IPv6:2003:ea:971d:c592:329c:23ff:fea6:a903]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail.alien8.de (SuperMail on ZX Spectrum 128k) with ESMTPSA id 3EDD640E019B; Wed, 21 Jun 2023 09:42:42 +0000 (UTC) Date: Wed, 21 Jun 2023 11:42:36 +0200 From: Borislav Petkov To: Michael Roth Cc: kvm@vger.kernel.org, linux-coco@lists.linux.dev, linux-mm@kvack.org, linux-crypto@vger.kernel.org, x86@kernel.org, linux-kernel@vger.kernel.org, tglx@linutronix.de, mingo@redhat.com, jroedel@suse.de, thomas.lendacky@amd.com, hpa@zytor.com, ardb@kernel.org, pbonzini@redhat.com, seanjc@google.com, vkuznets@redhat.com, jmattson@google.com, luto@kernel.org, dave.hansen@linux.intel.com, slp@redhat.com, pgonda@google.com, peterz@infradead.org, srinivas.pandruvada@linux.intel.com, rientjes@google.com, dovmurik@linux.ibm.com, tobin@ibm.com, vbabka@suse.cz, kirill@shutemov.name, ak@linux.intel.com, tony.luck@intel.com, marcorr@google.com, sathyanarayanan.kuppuswamy@linux.intel.com, alpergun@google.com, dgilbert@redhat.com, jarkko@kernel.org, ashish.kalra@amd.com, nikunj.dadhania@amd.com, liam.merwick@oracle.com, zhi.a.wang@intel.com, Brijesh Singh Subject: Re: [PATCH RFC v9 07/51] x86/sev: Add the host SEV-SNP initialization support Message-ID: <20230621094236.GZZJLGDAicp1guNPvD@fat_crate.local> References: <20230612042559.375660-1-michael.roth@amd.com> <20230612042559.375660-8-michael.roth@amd.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20230612042559.375660-8-michael.roth@amd.com> X-Rspamd-Queue-Id: 7967340003 X-Rspam-User: X-Stat-Signature: ejokhiq7njakutpug8f3xm6gkmxizh75 X-Rspamd-Server: rspam03 X-HE-Tag: 1687340608-766354 X-HE-Meta: U2FsdGVkX1/dVqTHdxk7wV+cukNjs5xWTL9+vxSnrlR//h3jijyYL5F69F7brtYcUV2VIIo58VPKFDgr1ZL2NLJ3IIm0tPVnOzd5O3N0EuqBrvlHxv3r5TZNjXybctzVV+/9qUYZoZLYZWzG2FVlBlLklaoPcV6NCMS0YKfcNR1seGeKFWYGJhamx/EfKrwuU2QyJW2W40+b/nmZe/IyaLnKIOraW/v2gP2DN6bhbxM4G1fCcOmjna6EflefONstVezTRQyzrGb4jKek1IPtqZ4qqWpSghxums57hmsjTSBNROizyO0xFnwhPTrRNbTiN1DhDDm7jvja+6dB6J1O2vD/MP00XA0H0rSRVIEC0loIykSC7WeX35y04WEihGbKjutgXswwcLLd3ajdZ+XGRk5WuZtCzXz/T14XZ4pKnVCHCrZItL2q6Sd1ZkkHFCM3ZIvqOTAoeKfHyMZF7WJBZNaU9R6oBs71WrKYI4Wx+evJOEiDxtSVuGzPHFoQktrSSv/QBFgslcg6m0NVF23Ec16bE2mYTSdAiphmoiGNPgWUmuaN1TUUyoMSvDcxzGWMUxGx0B6zrzlfSbANdt4vhchB0/uSpSZiLJfMLMNF1BCE6Hyz3t9JLuVXgedOyO2+6HzxY0toEX5t0BFr6I1ml2dbogTnbz54CNCgtSOz6KrNjhAl+IotaO4z1YzymJp8jV8bziJyZktB6iSWyMQHa1SiH+CfRxQhfaSfOJ9NNh2aEUgkrSJHRI8cvXrnIwW6DiYdNhENTZdrBrQoTS3ZHaYuZTzwgiTh31I4BWSZIVEMHLNSe2VQnuBvb4t7M99sgOfdK0vNwTx2VXnHQZC1lT2H5RkPbyq2EZotcoA/eEAGN2ccARpn9h5ScGb+5yvAR2wulfKwAbGB27qsIHTH21YVfWwAzJcfcWVpGmlORJUpXH3ALsZYQI/dbtcETEg3/+9ZoEg2B5GIfHsg+jx kLAfR6jG +W2e4FXNf7VD7UxafCCzsxH9LOfOh7vm08grfUP5VWXiv615iAHN+gXVWwkOAa+ogBc6JyCYwkssh+31ZLPnuA0VDpsKDrURMpRgoE1nuCwhsgw6Zp48RcwEVSbjAq5jho5tJGfVeLOlNaaN65cTRJFMbOqcRzsxIHHi9441SUVOlrYafnAIfbaFdUglv6dyDMDwAPnBwsxNNRh9YAVxO6IJRhSv0OLJUuxQhcYfRW1qV9xMrc63wJAH1Bp4wDY5ktdrL6pnkc4tYBz2+AO16QA36zw== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Sun, Jun 11, 2023 at 11:25:15PM -0500, Michael Roth wrote: > From: Brijesh Singh > > The memory integrity guarantees of SEV-SNP are enforced through a new > structure called the Reverse Map Table (RMP). The RMP is a single data > structure shared across the system that contains one entry for every 4K > page of DRAM that may be used by SEV-SNP VMs. APM2 section 15.36 details Rather say 'APM v2, section "Secure Nested Paging (SEV-SNP)"' because the numbering is more likely to change than the name in the future. With the name, people can find it faster. > a number of steps needed to detect/enable SEV-SNP and RMP table support > on the host: > > - Detect SEV-SNP support based on CPUID bit > - Initialize the RMP table memory reported by the RMP base/end MSR > registers and configure IOMMU to be compatible with RMP access > restrictions > - Set the MtrrFixDramModEn bit in SYSCFG MSR > - Set the SecureNestedPagingEn and VMPLEn bits in the SYSCFG MSR > - Configure IOMMU > > RMP table entry format is non-architectural and it can vary by > processor. It is defined by the PPR. Restrict SNP support to CPU > models/families which are compatible with the current RMP table entry > format to guard against any undefined behavior when running on other > system types. Future models/support will handle this through an > architectural mechanism to allow for broader compatibility. I'm guessing this is all for live migration between SNP hosts. If so, then there will have to be a guest API to handle the differences. > SNP host code depends on CONFIG_KVM_AMD_SEV config flag, which may be > enabled even when CONFIG_AMD_MEM_ENCRYPT isn't set, so update the > SNP-specific IOMMU helpers used here to rely on CONFIG_KVM_AMD_SEV > instead of CONFIG_AMD_MEM_ENCRYPT. Does that mean that even on CONFIG_AMD_MEM_ENCRYPT=n kernels, host SNP can function? Do we even want that? I'd expect that a host SNP kernel should have SME enabled too even though it is not absolutely necessary. > Co-developed-by: Ashish Kalra > Signed-off-by: Ashish Kalra > Co-developed-by: Tom Lendacky > Signed-off-by: Tom Lendacky > Signed-off-by: Brijesh Singh > [mdr: rework commit message to be clearer about what patch does, squash > in early_rmptable_check() handling from Tom] > Signed-off-by: Michael Roth > --- > arch/x86/coco/Makefile | 1 + > arch/x86/coco/sev/Makefile | 3 + > arch/x86/coco/sev/host.c | 212 +++++++++++++++++++++++ > arch/x86/include/asm/disabled-features.h | 8 +- > arch/x86/include/asm/msr-index.h | 11 +- > arch/x86/include/asm/sev.h | 2 + > arch/x86/kernel/cpu/amd.c | 19 ++ > drivers/iommu/amd/init.c | 2 +- > include/linux/amd-iommu.h | 2 +- > 9 files changed, 256 insertions(+), 4 deletions(-) > create mode 100644 arch/x86/coco/sev/Makefile > create mode 100644 arch/x86/coco/sev/host.c Ignored review comments here: https://lore.kernel.org/r/Y9ubi0i4Z750gdMm@zn.tnic Ignoring this one for now too. -- Regards/Gruss, Boris. https://people.kernel.org/tglx/notes-about-netiquette