From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 753FCC3DA6E for ; Sun, 31 Dec 2023 11:51:09 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 63E056B00E0; Sun, 31 Dec 2023 06:51:08 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 5EE7A6B00EB; Sun, 31 Dec 2023 06:51:08 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 4B6126B0109; Sun, 31 Dec 2023 06:51:08 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id 3BF8F6B00E0 for ; Sun, 31 Dec 2023 06:51:08 -0500 (EST) Received: from smtpin11.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id 116E4C022A for ; Sun, 31 Dec 2023 11:51:08 +0000 (UTC) X-FDA: 81626947416.11.47425B4 Received: from mail.alien8.de (mail.alien8.de [65.109.113.108]) by imf03.hostedemail.com (Postfix) with ESMTP id 9DBC920006 for ; Sun, 31 Dec 2023 11:51:05 +0000 (UTC) Authentication-Results: imf03.hostedemail.com; dkim=pass header.d=alien8.de header.s=alien8 header.b=cl9kUDyW; spf=pass (imf03.hostedemail.com: domain of bp@alien8.de designates 65.109.113.108 as permitted sender) smtp.mailfrom=bp@alien8.de; dmarc=pass (policy=none) header.from=alien8.de ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1704023466; a=rsa-sha256; cv=none; b=1gvDTBLIOuDMiS1OSR2vEK/23/7p7zWbwrhbIAYwgEZx2cvflHdvltVfvFexSmQn2qwfvG b9cgn4jCi3l7jIyA3ULPyH5yhVlVndY14iZ0G0XA4LlzDjwNb2M9pD5WLTcU3D567V+NXt e5gUaCFb1gOg9M1WCMsbjx9MGTJtoqc= ARC-Authentication-Results: i=1; imf03.hostedemail.com; dkim=pass header.d=alien8.de header.s=alien8 header.b=cl9kUDyW; spf=pass (imf03.hostedemail.com: domain of bp@alien8.de designates 65.109.113.108 as permitted sender) smtp.mailfrom=bp@alien8.de; dmarc=pass (policy=none) header.from=alien8.de ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1704023466; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=rshc7RO4qeTYeDFjVLydvwS1x2ZSFRCAo8/CN5Dns6c=; b=m8VWVsrkclfTuUeyIebcTBD11ljCztOFGLmMf1OaDCV5ihwgoSrc/YZtqtRS2aTw5f3H7o gfLy4GejthC3ItCv3kcsR6Mfhctooji4EVP9Kf6FCeqpsyaSKdWtw0IjfkMFVrDPWkmdnH aHE9wJgTo17a9fVUAfE5pc4BQ+GIUfU= Received: from localhost (localhost.localdomain [127.0.0.1]) by mail.alien8.de (SuperMail on ZX Spectrum 128k) with ESMTP id 49E0540E016E; Sun, 31 Dec 2023 11:51:01 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at mail.alien8.de Received: from mail.alien8.de ([127.0.0.1]) by localhost (mail.alien8.de [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id 4eg0_SLg_kXx; Sun, 31 Dec 2023 11:50:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=alien8.de; s=alien8; t=1704023458; bh=rshc7RO4qeTYeDFjVLydvwS1x2ZSFRCAo8/CN5Dns6c=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=cl9kUDyWnKHtQdd3kIozQ9uHF3eWNBAkA9wIgKNRIu7FMlBgTYVYC8j3eLDIc1+Bp hkCM/Nd7vdnc1b+zGVWwr43REhIvmABVHseMEcIDn96Gx7LzqRXuybrYhAPiUWP5sC Y+JS+4LXvxMsCuf0ZcgEBL4kezJ21Q5JQPftrjJ7263+bAT8WydTNUI14eWvOQUoa7 MuR75H5YqKM/aJUMfhpWTNPKtLamIY3o/qMzhEYVBnetBqfMFoLFuqtAMdAJ7Qm4xF gDLIwz6WbJhe2mZ+JdJKrKDpUYNZzAotH/h/jJrAEbfNpKlINtQVMX6dLN+TaGh821 L4OAMbOrvvamJrpu7L6HRKkgyktN3uVI9DQeiPnHvDo5oIXW2pxRfgkd2wu4og8eOw XbTSlD3s8+Qgux9YzBYAAuo5MGTkXznhDF6wrO0oI4fN3Cx42URjZxtEG4BYS26kcb FsESawR83FkYNekXbGrwE6ZyGKbm/n+82GK36oZAZLn5vwZcDFw6etAKx0K8ZpHzOi cwjrNNoC0yFFF7VaZjIcsogfnSxgwjbOlvBHIqhRXr0+Q9thC5IdKR3jqal48lWgWP awEOLCZO8cBJ62WGwyz1cZ4+0yOfOkwBMR8MWUkqUW1jPDOP0VpS/nWzvsh8Hh5/dM hi7IT3zlZSgFvThJFDwVQDTw= Received: from zn.tnic (pd9530f8c.dip0.t-ipconnect.de [217.83.15.140]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail.alien8.de (SuperMail on ZX Spectrum 128k) with ESMTPSA id BA2A040E00C7; Sun, 31 Dec 2023 11:50:18 +0000 (UTC) Date: Sun, 31 Dec 2023 12:50:12 +0100 From: Borislav Petkov To: Michael Roth Cc: x86@kernel.org, kvm@vger.kernel.org, linux-coco@lists.linux.dev, linux-mm@kvack.org, linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, tglx@linutronix.de, mingo@redhat.com, jroedel@suse.de, thomas.lendacky@amd.com, hpa@zytor.com, ardb@kernel.org, pbonzini@redhat.com, seanjc@google.com, vkuznets@redhat.com, jmattson@google.com, luto@kernel.org, dave.hansen@linux.intel.com, slp@redhat.com, pgonda@google.com, peterz@infradead.org, srinivas.pandruvada@linux.intel.com, rientjes@google.com, tobin@ibm.com, vbabka@suse.cz, kirill@shutemov.name, ak@linux.intel.com, tony.luck@intel.com, sathyanarayanan.kuppuswamy@linux.intel.com, alpergun@google.com, jarkko@kernel.org, ashish.kalra@amd.com, nikunj.dadhania@amd.com, pankaj.gupta@amd.com, liam.merwick@oracle.com, zhi.a.wang@intel.com, Brijesh Singh , Jarkko Sakkinen Subject: Re: [PATCH v1 01/26] x86/cpufeatures: Add SEV-SNP CPU feature Message-ID: <20231231115012.GAZZFVdHCWijp7yFls@fat_crate.local> References: <20231230161954.569267-1-michael.roth@amd.com> <20231230161954.569267-2-michael.roth@amd.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20231230161954.569267-2-michael.roth@amd.com> X-Rspamd-Server: rspam08 X-Rspamd-Queue-Id: 9DBC920006 X-Stat-Signature: qeugt33gmefwueindg6uefwym5rntdjm X-Rspam-User: X-HE-Tag: 1704023465-4816 X-HE-Meta: U2FsdGVkX19xVcQV8qQCmvC8ERbsv+CFFLrKd/WPZY4+ZkPCbA16DdfIMYWlw1f79a+2UB7LEd4a8bEOeyWWhDaUYC0lV2ILMmNjhxoczghzsbnR/ZMzJk5f+D5IDYFUxGStYQ0PK31CLGtp11vJxJqdn0SjpCJ3E7RyNpNfoR1o/w5ifXrSmzgAI7/0eFQ7UkOSo5i8r8h2dE32dNdmvuUmzGPDr24dx/78qVVBzYldPIkhYgShFs6Ehx53ifIT2fEpwjMm62GuQf6b2dX2tU/qEwgKGagJVPPNIq6OWdhH5Cy0/EBUVJpzi5AYrLLyOYczjskfHzBuuDw2nm78j13qOILpfTqr9E6nQZdmEMRItOFiJhCbEEOWHAM1LCbJS/JngPm6g3dueUw/e9uf1qbSsemTZdJDtu+cGQiaU2cin032S+/9xi8+wzyzlcennt4rY/E4fT+kNO4w7BFzRYaB32nvqSjnDh9XUKgildN1syq55v+B/oMfcJ7JioCskICqXxaDakcD5A0tsq9+u5WtIHfekBISO3NWasF7/UsGGFyM1prISQoOM/bqR2xPg1te1qQAL/5enicgylB9DR9wJSlj+Mmm5hPMKU/7UN9a8b2C4JmBdU8cbdVjeWr8OUkN9UPhb9DDVc93NUMblhM6jExild1kNmWcOC9Hk7hG0+eST/z8cgeUsVFwnwOPeoti49qj1f8ssxpehJK/CsGlBbZZR/hvx7GTxZ8uwceoBD0hlDZdzAudbJoHl8XT2wPTJ336ogpOevC6IeO2ZpBd6j0Y7Y09Lu5R4LGwTlLCMGNq+BlRzWXFDiwsd+OF5KQ3QBJDgMLJKeeBBJZ3oWu8/JaYhYNyNRTZmVvcUIgKx8JzV1VdoCNeRoU/vd8GnpFYTu6yaZjvG5fF8rU9Z2oPBB0PmPaOxBRDKYYttb+e7c6kCSHw2IYYQglLiosJly3MVk2LzOsvgW6BZGv cgnEXrwH mSFJ4WtEwdr0PzFZABDcERDkfiLieOQLk1DhG36IfCKlskWMOzA9C6AXiWI9LoEoGf7I8Z4iPMrB3FwBs1TruU5+/vSoYWL3QemahSzTVA06auMWJwteVedw3bxe+6UM/ZHoqe2+jThhY19U+iq57JoK4JSmhPNvgK2WSBzPWjxpfNBQKQvzQycfItGXo3ucIwcDbEvbQXvuQv4PzrD06DHfiAvqqnyPrEwE4tDGqVxXn8RVT2pNcR8fVAYARoOXGh0FalAmr7QS9CBcMHvJQ5ZqmqPW0f2+7waup X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Sat, Dec 30, 2023 at 10:19:29AM -0600, Michael Roth wrote: > From: Brijesh Singh > > Add CPU feature detection for Secure Encrypted Virtualization with > Secure Nested Paging. This feature adds a strong memory integrity > protection to help prevent malicious hypervisor-based attacks like > data replay, memory re-mapping, and more. > > Since enabling the SNP CPU feature imposes a number of additional > requirements on host initialization and handling legacy firmware APIs > for SEV/SEV-ES guests, only introduce the CPU feature bit so that the > relevant handling can be added, but leave it disabled via a > disabled-features mask. > > Once all the necessary changes needed to maintain legacy SEV/SEV-ES > support are introduced in subsequent patches, the SNP feature bit will > be unmasked/enabled. > > Signed-off-by: Brijesh Singh > Signed-off-by: Jarkko Sakkinen > Signed-off-by: Ashish Kalra > Signed-off-by: Michael Roth > --- > arch/x86/include/asm/cpufeatures.h | 1 + > arch/x86/include/asm/disabled-features.h | 4 +++- > arch/x86/kernel/cpu/amd.c | 5 +++-- > tools/arch/x86/include/asm/cpufeatures.h | 1 + > 4 files changed, 8 insertions(+), 3 deletions(-) > > diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h > index 29cb275a219d..9492dcad560d 100644 > --- a/arch/x86/include/asm/cpufeatures.h > +++ b/arch/x86/include/asm/cpufeatures.h > @@ -442,6 +442,7 @@ > #define X86_FEATURE_SEV (19*32+ 1) /* AMD Secure Encrypted Virtualization */ > #define X86_FEATURE_VM_PAGE_FLUSH (19*32+ 2) /* "" VM Page Flush MSR is supported */ > #define X86_FEATURE_SEV_ES (19*32+ 3) /* AMD Secure Encrypted Virtualization - Encrypted State */ > +#define X86_FEATURE_SEV_SNP (19*32+ 4) /* AMD Secure Encrypted Virtualization - Secure Nested Paging */ > #define X86_FEATURE_V_TSC_AUX (19*32+ 9) /* "" Virtual TSC_AUX */ > #define X86_FEATURE_SME_COHERENT (19*32+10) /* "" AMD hardware-enforced cache coherency */ > #define X86_FEATURE_DEBUG_SWAP (19*32+14) /* AMD SEV-ES full debug state swap support */ > diff --git a/arch/x86/include/asm/disabled-features.h b/arch/x86/include/asm/disabled-features.h > index 702d93fdd10e..a864a5b208fa 100644 > --- a/arch/x86/include/asm/disabled-features.h > +++ b/arch/x86/include/asm/disabled-features.h > @@ -117,6 +117,8 @@ > #define DISABLE_IBT (1 << (X86_FEATURE_IBT & 31)) > #endif > > +#define DISABLE_SEV_SNP 0 I think you want this here if SEV_SNP should be initially disabled: diff --git a/arch/x86/include/asm/disabled-features.h b/arch/x86/include/asm/disabled-features.h index a864a5b208fa..5b2fab8ad262 100644 --- a/arch/x86/include/asm/disabled-features.h +++ b/arch/x86/include/asm/disabled-features.h @@ -117,7 +117,7 @@ #define DISABLE_IBT (1 << (X86_FEATURE_IBT & 31)) #endif -#define DISABLE_SEV_SNP 0 +#define DISABLE_SEV_SNP (1 << (X86_FEATURE_SEV_SNP & 31)) /* * Make sure to add features to the correct mask -- Regards/Gruss, Boris. https://people.kernel.org/tglx/notes-about-netiquette