diff mbox series

[RFC,V2,04/18] x86/hyperv: Decrypt hv vp assist page in sev-snp enlightened guest

Message ID 20221119034633.1728632-5-ltykernel@gmail.com
State New
Headers
Series x86/hyperv/sev: Add AMD sev-snp enlightened guest support on hyperv |

Commit Message

Tianyu Lan Nov. 19, 2022, 3:46 a.m. UTC 
  From: Tianyu Lan <tiala@microsoft.com>

hv vp assist page is shared between sev snp guest and hyperv. Decrypt
the page when use it.

Signed-off-by: Tianyu Lan <tiala@microsoft.com>
---
 arch/x86/hyperv/hv_init.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

Comments

Michael Kelley (LINUX) Dec. 12, 2022, 7:41 p.m. UTC | #1 
From: Tianyu Lan <ltykernel@gmail.com> Sent: Friday, November 18, 2022 7:46 PM
> 
> hv vp assist page is shared between sev snp guest and hyperv. Decrypt
> the page when use it.
> 
> Signed-off-by: Tianyu Lan <tiala@microsoft.com>
> ---
>  arch/x86/hyperv/hv_init.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
> 
> diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c
> index 29774126e931..4600c5941957 100644
> --- a/arch/x86/hyperv/hv_init.c
> +++ b/arch/x86/hyperv/hv_init.c
> @@ -30,6 +30,7 @@
>  #include <clocksource/hyperv_timer.h>
>  #include <linux/highmem.h>
>  #include <linux/swiotlb.h>
> +#include <linux/set_memory.h>
> 
>  int hyperv_init_cpuhp;
>  u64 hv_current_partition_id = ~0ull;
> @@ -112,6 +113,11 @@ static int hv_cpu_init(unsigned int cpu)
>  		}
>  		WARN_ON(!(*hvp));
>  		if (*hvp) {
> +			if (hv_isolation_type_en_snp()) {
> +				WARN_ON_ONCE(set_memory_decrypted((unsigned long)(*hvp), 1) != 0);

The "!= 0" isn't needed.

> +				memset(*hvp, 0, PAGE_SIZE);
> +			}
> +
>  			msr.enable = 1;
>  			wrmsrl(HV_X64_MSR_VP_ASSIST_PAGE, msr.as_uint64);
>  		}
> @@ -228,6 +234,12 @@ static int hv_cpu_die(unsigned int cpu)
> 
>  	if (hv_vp_assist_page && hv_vp_assist_page[cpu]) {
>  		union hv_vp_assist_msr_contents msr = { 0 };
> +
> +		if (hv_isolation_type_en_snp())
> +			WARN_ON_ONCE(set_memory_encrypted(
> +				    (unsigned long)hv_vp_assist_page[cpu],
> +				    1) != 0);
> +

The re-encryption should not be done here (or anywhere else, for
that matter) since the VP assist pages are never freed.   The Hyper-V
synthetic MSR pointing to the page gets cleared, but the memory isn't
freed.  If the CPU should come back online later, the previously allocated
VP assist page is reused.   The decryption in hv_cpu_init() is done only
when a new page is allocated to use as a VP assist page.  So just leave
the page decrypted here, and it will get reused in its decrypted state.

This handling of the VP assist page is admittedly a bit weird.  But
it is needed.  See discussion with Vitaly Kuznetsov here:
https://lore.kernel.org/linux-hyperv/878rkqr7ku.fsf@ovpn-192-136.brq.redhat.com/

Michael

>  		if (hv_root_partition) {
>  			/*
>  			 * For root partition the VP assist page is mapped to
> --
> 2.25.1
Tianyu Lan Dec. 13, 2022, 3:21 p.m. UTC | #2 
On 12/13/2022 3:41 AM, Michael Kelley (LINUX) wrote:
>> @@ -228,6 +234,12 @@ static int hv_cpu_die(unsigned int cpu)
>>
>>   	if (hv_vp_assist_page && hv_vp_assist_page[cpu]) {
>>   		union hv_vp_assist_msr_contents msr = { 0 };
>> +
>> +		if (hv_isolation_type_en_snp())
>> +			WARN_ON_ONCE(set_memory_encrypted(
>> +				    (unsigned long)hv_vp_assist_page[cpu],
>> +				    1) != 0);
>> +
> The re-encryption should not be done here (or anywhere else, for
> that matter) since the VP assist pages are never freed.   The Hyper-V
> synthetic MSR pointing to the page gets cleared, but the memory isn't
> freed.  If the CPU should come back online later, the previously allocated
> VP assist page is reused.   The decryption in hv_cpu_init() is done only
> when a new page is allocated to use as a VP assist page.  So just leave
> the page decrypted here, and it will get reused in its decrypted state.
> 
> This handling of the VP assist page is admittedly a bit weird.  But
> it is needed.  See discussion with Vitaly Kuznetsov here:
> https://lore.kernel.org/linux-hyperv/878rkqr7ku.fsf@ovpn-192-136.brq.redhat.com/
> 
Agree. Good point. Will update in the next version.

Thanks.
diff mbox series

Patch

diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c
index 29774126e931..4600c5941957 100644
--- a/arch/x86/hyperv/hv_init.c
+++ b/arch/x86/hyperv/hv_init.c
@@ -30,6 +30,7 @@ 
 #include <clocksource/hyperv_timer.h>
 #include <linux/highmem.h>
 #include <linux/swiotlb.h>
+#include <linux/set_memory.h>
 
 int hyperv_init_cpuhp;
 u64 hv_current_partition_id = ~0ull;
@@ -112,6 +113,11 @@  static int hv_cpu_init(unsigned int cpu)
 		}
 		WARN_ON(!(*hvp));
 		if (*hvp) {
+			if (hv_isolation_type_en_snp()) {
+				WARN_ON_ONCE(set_memory_decrypted((unsigned long)(*hvp), 1) != 0);
+				memset(*hvp, 0, PAGE_SIZE);
+			}
+
 			msr.enable = 1;
 			wrmsrl(HV_X64_MSR_VP_ASSIST_PAGE, msr.as_uint64);
 		}
@@ -228,6 +234,12 @@  static int hv_cpu_die(unsigned int cpu)
 
 	if (hv_vp_assist_page && hv_vp_assist_page[cpu]) {
 		union hv_vp_assist_msr_contents msr = { 0 };
+
+		if (hv_isolation_type_en_snp())
+			WARN_ON_ONCE(set_memory_encrypted(
+				    (unsigned long)hv_vp_assist_page[cpu],
+				    1) != 0);
+
 		if (hv_root_partition) {
 			/*
 			 * For root partition the VP assist page is mapped to