| Message ID | 20190710201244.25195-10-brijesh.singh@amd.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Add AMD SEV guest live migration support | expand |
On Wed, Jul 10, 2019 at 08:13:10PM +0000, Singh, Brijesh wrote: > @@ -7767,7 +7808,8 @@ static struct kvm_x86_ops svm_x86_ops __ro_after_init = { > > .need_emulation_on_page_fault = svm_need_emulation_on_page_fault, > > - .page_enc_status_hc = svm_page_enc_status_hc > + .page_enc_status_hc = svm_page_enc_status_hc, > + .get_page_enc_bitmap = svm_get_page_enc_bitmap > }; > > static int __init svm_init(void) > diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c > index 6baf48ec0ed4..59ae49b1b914 100644 > --- a/arch/x86/kvm/x86.c > +++ b/arch/x86/kvm/x86.c > @@ -4927,6 +4927,18 @@ long kvm_arch_vm_ioctl(struct file *filp, > r = kvm_vm_ioctl_hv_eventfd(kvm, &hvevfd); > break; > } > + case KVM_GET_PAGE_ENC_BITMAP: { > + struct kvm_page_enc_bitmap bitmap; > + > + r = -EFAULT; > + if (copy_from_user(&bitmap, argp, sizeof(bitmap))) > + goto out; > + > + r = -ENOTTY; > + if (kvm_x86_ops->get_page_enc_bitmap) > + r = kvm_x86_ops->get_page_enc_bitmap(kvm, &bitmap); I don't know what tree you've done those patches against but against -rc6+, the first argument above needs to be vcpu->kvm: arch/x86/kvm/x86.c: In function ‘kvm_arch_vcpu_ioctl’: arch/x86/kvm/x86.c:4343:41: error: ‘kvm’ undeclared (first use in this function) r = kvm_x86_ops->get_page_enc_bitmap(kvm, &bitmap); ^~~ arch/x86/kvm/x86.c:4343:41: note: each undeclared identifier is reported only once for each function it appears in make[2]: *** [scripts/Makefile.build:280: arch/x86/kvm/x86.o] Error 1 make[2]: *** Waiting for unfinished jobs.... make[1]: *** [scripts/Makefile.build:497: arch/x86/kvm] Error 2 make[1]: *** Waiting for unfinished jobs.... make: *** [Makefile:1083: arch/x86] Error 2 make: *** Waiting for unfinished jobs....
On 8/29/19 11:26 AM, Borislav Petkov wrote: > On Wed, Jul 10, 2019 at 08:13:10PM +0000, Singh, Brijesh wrote: >> @@ -7767,7 +7808,8 @@ static struct kvm_x86_ops svm_x86_ops __ro_after_init = { >> >> .need_emulation_on_page_fault = svm_need_emulation_on_page_fault, >> >> - .page_enc_status_hc = svm_page_enc_status_hc >> + .page_enc_status_hc = svm_page_enc_status_hc, >> + .get_page_enc_bitmap = svm_get_page_enc_bitmap >> }; >> >> static int __init svm_init(void) >> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c >> index 6baf48ec0ed4..59ae49b1b914 100644 >> --- a/arch/x86/kvm/x86.c >> +++ b/arch/x86/kvm/x86.c >> @@ -4927,6 +4927,18 @@ long kvm_arch_vm_ioctl(struct file *filp, >> r = kvm_vm_ioctl_hv_eventfd(kvm, &hvevfd); >> break; >> } >> + case KVM_GET_PAGE_ENC_BITMAP: { >> + struct kvm_page_enc_bitmap bitmap; >> + >> + r = -EFAULT; >> + if (copy_from_user(&bitmap, argp, sizeof(bitmap))) >> + goto out; >> + >> + r = -ENOTTY; >> + if (kvm_x86_ops->get_page_enc_bitmap) >> + r = kvm_x86_ops->get_page_enc_bitmap(kvm, &bitmap); > > I don't know what tree you've done those patches against but against -rc6+, the > first argument above needs to be vcpu->kvm: > > arch/x86/kvm/x86.c: In function ‘kvm_arch_vcpu_ioctl’: > arch/x86/kvm/x86.c:4343:41: error: ‘kvm’ undeclared (first use in this function) > r = kvm_x86_ops->get_page_enc_bitmap(kvm, &bitmap); > ^~~ > arch/x86/kvm/x86.c:4343:41: note: each undeclared identifier is reported only once for each function it appears in > make[2]: *** [scripts/Makefile.build:280: arch/x86/kvm/x86.o] Error 1 > make[2]: *** Waiting for unfinished jobs.... > make[1]: *** [scripts/Makefile.build:497: arch/x86/kvm] Error 2 > make[1]: *** Waiting for unfinished jobs.... > make: *** [Makefile:1083: arch/x86] Error 2 > make: *** Waiting for unfinished jobs.... > The patches were based on KVM tree July 9th commit id: e9a83bd2322035ed9d7dcf35753d3f984d76c6a5 I have been waiting for some feedback before refreshing it. If you want then I can refresh the patch with latest from Linus and send v4. thanks
On Thu, Aug 29, 2019 at 04:41:50PM +0000, Singh, Brijesh wrote: > I have been waiting for some feedback before refreshing it. If you want > then I can refresh the patch with latest from Linus and send v4. That's Paolo's call but we're at -rc6 now and if it were me, I'd take them the next round so that stuff gets tested longer as -rc6 is pretty late in the game. IMO, of course. Thx.
diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt index 383b292966fa..ed61a4d63b10 100644 --- a/Documentation/virtual/kvm/api.txt +++ b/Documentation/virtual/kvm/api.txt @@ -4081,6 +4081,33 @@ KVM_ARM_VCPU_FINALIZE call. See KVM_ARM_VCPU_INIT for details of vcpu features that require finalization using this ioctl. +4.120 KVM_GET_PAGE_ENC_BITMAP (vm ioctl) + +Capability: basic +Architectures: x86 +Type: vm ioctl +Parameters: struct kvm_page_enc_bitmap (in/out) +Returns: 0 on success, -1 on error + +/* for KVM_GET_PAGE_ENC_BITMAP */ +struct kvm_page_enc_bitmap { + __u64 start_gfn; + __u64 num_pages; + union { + void __user *enc_bitmap; /* one bit per page */ + __u64 padding2; + }; +}; + +The encrypted VMs have concept of private and shared pages. The private +page is encrypted with the guest-specific key, while shared page may +be encrypted with the hypervisor key. The KVM_GET_PAGE_ENC_BITMAP can +be used to get the bitmap indicating whether the guest page is private +or shared. The bitmap can be used during the guest migration, if the page +is private then userspace need to use SEV migration commands to transmit +the page. + + 5. The kvm_run structure ------------------------ diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h index b463a81dc176..9df0e2315543 100644 --- a/arch/x86/include/asm/kvm_host.h +++ b/arch/x86/include/asm/kvm_host.h @@ -1201,6 +1201,7 @@ struct kvm_x86_ops { bool (*need_emulation_on_page_fault)(struct kvm_vcpu *vcpu); int (*page_enc_status_hc)(struct kvm *kvm, unsigned long gpa, unsigned long sz, unsigned long mode); + int (*get_page_enc_bitmap)(struct kvm *kvm, struct kvm_page_enc_bitmap *bmap); }; struct kvm_arch_async_pf { diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c index 431718309359..e675fd89bb9a 100644 --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -7425,6 +7425,47 @@ static int svm_page_enc_status_hc(struct kvm *kvm, unsigned long gpa, return ret; } +static int svm_get_page_enc_bitmap(struct kvm *kvm, + struct kvm_page_enc_bitmap *bmap) +{ + struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info; + unsigned long gfn_start, gfn_end; + unsigned long *bitmap; + unsigned long sz, i; + int ret; + + if (!sev_guest(kvm)) + return -ENOTTY; + + gfn_start = bmap->start_gfn; + gfn_end = gfn_start + bmap->num_pages; + + sz = ALIGN(bmap->num_pages, BITS_PER_LONG) / 8; + bitmap = kmalloc(sz, GFP_KERNEL); + if (!bitmap) + return -ENOMEM; + + memset(bitmap, 0xff, sz); /* by default all pages are marked encrypted */ + + mutex_lock(&kvm->lock); + if (sev->page_enc_bmap) { + i = gfn_start; + for_each_clear_bit_from(i, sev->page_enc_bmap, + min(sev->page_enc_bmap_size, gfn_end)) + clear_bit(i - gfn_start, bitmap); + } + mutex_unlock(&kvm->lock); + + ret = -EFAULT; + if (copy_to_user(bmap->enc_bitmap, bitmap, sz)) + goto out; + + ret = 0; +out: + kfree(bitmap); + return ret; +} + static int svm_mem_enc_op(struct kvm *kvm, void __user *argp) { struct kvm_sev_cmd sev_cmd; @@ -7767,7 +7808,8 @@ static struct kvm_x86_ops svm_x86_ops __ro_after_init = { .need_emulation_on_page_fault = svm_need_emulation_on_page_fault, - .page_enc_status_hc = svm_page_enc_status_hc + .page_enc_status_hc = svm_page_enc_status_hc, + .get_page_enc_bitmap = svm_get_page_enc_bitmap }; static int __init svm_init(void) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 6baf48ec0ed4..59ae49b1b914 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -4927,6 +4927,18 @@ long kvm_arch_vm_ioctl(struct file *filp, r = kvm_vm_ioctl_hv_eventfd(kvm, &hvevfd); break; } + case KVM_GET_PAGE_ENC_BITMAP: { + struct kvm_page_enc_bitmap bitmap; + + r = -EFAULT; + if (copy_from_user(&bitmap, argp, sizeof(bitmap))) + goto out; + + r = -ENOTTY; + if (kvm_x86_ops->get_page_enc_bitmap) + r = kvm_x86_ops->get_page_enc_bitmap(kvm, &bitmap); + break; + } default: r = -ENOTTY; } diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h index e31cdb41519f..0d08bcf94ef5 100644 --- a/include/uapi/linux/kvm.h +++ b/include/uapi/linux/kvm.h @@ -492,6 +492,16 @@ struct kvm_dirty_log { }; }; +/* for KVM_GET_PAGE_ENC_BITMAP */ +struct kvm_page_enc_bitmap { + __u64 start_gfn; + __u64 num_pages; + union { + void __user *enc_bitmap; /* one bit per page */ + __u64 padding2; + }; +}; + /* for KVM_CLEAR_DIRTY_LOG */ struct kvm_clear_dirty_log { __u32 slot; @@ -1451,6 +1461,8 @@ struct kvm_enc_region { /* Available with KVM_CAP_ARM_SVE */ #define KVM_ARM_VCPU_FINALIZE _IOW(KVMIO, 0xc2, int) +#define KVM_GET_PAGE_ENC_BITMAP _IOW(KVMIO, 0xc2, struct kvm_page_enc_bitmap) + /* Secure Encrypted Virtualization command */ enum sev_cmd_id { /* Guest initialization commands */
The ioctl can be used to retrieve page encryption bitmap for a given gfn range. Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Ingo Molnar <mingo@redhat.com> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: "Radim Krčmář" <rkrcmar@redhat.com> Cc: Joerg Roedel <joro@8bytes.org> Cc: Borislav Petkov <bp@suse.de> Cc: Tom Lendacky <thomas.lendacky@amd.com> Cc: x86@kernel.org Cc: kvm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Brijesh Singh <brijesh.singh@amd.com> --- Documentation/virtual/kvm/api.txt | 27 +++++++++++++++++++ arch/x86/include/asm/kvm_host.h | 1 + arch/x86/kvm/svm.c | 44 ++++++++++++++++++++++++++++++- arch/x86/kvm/x86.c | 12 +++++++++ include/uapi/linux/kvm.h | 12 +++++++++ 5 files changed, 95 insertions(+), 1 deletion(-)