[v2,3/3] KVM: SVM: Add support for MPK feature on AMD

Commit Message

Babu Moger May 8, 2020, 9:10 p.m. UTC

The Memory Protection Key (MPK) feature provides a way for applications
to impose page-based data access protections (read/write, read-only or
no access), without requiring modification of page tables and subsequent
TLB invalidations when the application changes protection domains.

This feature is already available in Intel platforms. Now enable the
feature on AMD platforms.

AMD documentation for MPK feature is available at "AMD64 Architecture
Programmer’s Manual Volume 2: System Programming, Pub. 24593 Rev. 3.34,
Section 5.6.6 Memory Protection Keys (MPK) Bit". Documentation can be
obtained at the link below.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=206537
Signed-off-by: Babu Moger <[e-mail]>
---
 arch/x86/kvm/svm/svm.c |    4 ++++
 1 file changed, 4 insertions(+)

Comments

Sean Christopherson May 8, 2020, 9:55 p.m. UTC | #1

On Fri, May 08, 2020 at 04:10:03PM -0500, Babu Moger wrote:
> The Memory Protection Key (MPK) feature provides a way for applications
> to impose page-based data access protections (read/write, read-only or
> no access), without requiring modification of page tables and subsequent
> TLB invalidations when the application changes protection domains.
> 
> This feature is already available in Intel platforms. Now enable the
> feature on AMD platforms.
> 
> AMD documentation for MPK feature is available at "AMD64 Architecture
> Programmer’s Manual Volume 2: System Programming, Pub. 24593 Rev. 3.34,
> Section 5.6.6 Memory Protection Keys (MPK) Bit". Documentation can be
> obtained at the link below.
> 
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=206537
> Signed-off-by: Babu Moger <[e-mail]>
> ---
>  arch/x86/kvm/svm/svm.c |    4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> index 2f379bacbb26..37fb41ad9149 100644
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
> @@ -818,6 +818,10 @@ static __init void svm_set_cpu_caps(void)
>  	if (boot_cpu_has(X86_FEATURE_LS_CFG_SSBD) ||
>  	    boot_cpu_has(X86_FEATURE_AMD_SSBD))
>  		kvm_cpu_cap_set(X86_FEATURE_VIRT_SSBD);
> +
> +	/* PKU is not yet implemented for shadow paging. */
> +	if (npt_enabled && boot_cpu_has(X86_FEATURE_OSPKE))
> +		kvm_cpu_cap_check_and_set(X86_FEATURE_PKU);

This can actually be done in common code as well since both VMX and SVM
call kvm_set_cpu_caps() after kvm_configure_mmu(), i.e. key off of
tdp_enabled.

>  }
>  
>  static __init int svm_hardware_setup(void)
>

Babu Moger May 8, 2020, 10:02 p.m. UTC | #2

On 5/8/20 4:55 PM, Sean Christopherson wrote:
> On Fri, May 08, 2020 at 04:10:03PM -0500, Babu Moger wrote:
>> The Memory Protection Key (MPK) feature provides a way for applications
>> to impose page-based data access protections (read/write, read-only or
>> no access), without requiring modification of page tables and subsequent
>> TLB invalidations when the application changes protection domains.
>>
>> This feature is already available in Intel platforms. Now enable the
>> feature on AMD platforms.
>>
>> AMD documentation for MPK feature is available at "AMD64 Architecture
>> Programmer’s Manual Volume 2: System Programming, Pub. 24593 Rev. 3.34,
>> Section 5.6.6 Memory Protection Keys (MPK) Bit". Documentation can be
>> obtained at the link below.
>>
>> Link: https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.kernel.org%2Fshow_bug.cgi%3Fid%3D206537&data=02%7C01%7Cbabu.moger%40amd.com%7Ceca826ce565e450edc0b08d7f39a95f1%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637245717572330988&sdata=IaZXO8LLyXMqP0pZBYKzkXY4cInzpjBbSyzcnIcj%2BoA%3D&reserved=0
>> Signed-off-by: Babu Moger <[e-mail]>
>> ---
>>  arch/x86/kvm/svm/svm.c |    4 ++++
>>  1 file changed, 4 insertions(+)
>>
>> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
>> index 2f379bacbb26..37fb41ad9149 100644
>> --- a/arch/x86/kvm/svm/svm.c
>> +++ b/arch/x86/kvm/svm/svm.c
>> @@ -818,6 +818,10 @@ static __init void svm_set_cpu_caps(void)
>>  	if (boot_cpu_has(X86_FEATURE_LS_CFG_SSBD) ||
>>  	    boot_cpu_has(X86_FEATURE_AMD_SSBD))
>>  		kvm_cpu_cap_set(X86_FEATURE_VIRT_SSBD);
>> +
>> +	/* PKU is not yet implemented for shadow paging. */
>> +	if (npt_enabled && boot_cpu_has(X86_FEATURE_OSPKE))
>> +		kvm_cpu_cap_check_and_set(X86_FEATURE_PKU);
> 
> This can actually be done in common code as well since both VMX and SVM
> call kvm_set_cpu_caps() after kvm_configure_mmu(), i.e. key off of
> tdp_enabled.

Ok. Sure. Will change it in next revision. Thanks.
> 
>>  }
>>  
>>  static __init int svm_hardware_setup(void)
>>

Patch

diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 2f379bacbb26..37fb41ad9149 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -818,6 +818,10 @@  static __init void svm_set_cpu_caps(void)
 	if (boot_cpu_has(X86_FEATURE_LS_CFG_SSBD) ||
 	    boot_cpu_has(X86_FEATURE_AMD_SSBD))
 		kvm_cpu_cap_set(X86_FEATURE_VIRT_SSBD);
+
+	/* PKU is not yet implemented for shadow paging. */
+	if (npt_enabled && boot_cpu_has(X86_FEATURE_OSPKE))
+		kvm_cpu_cap_check_and_set(X86_FEATURE_PKU);
 }
 
 static __init int svm_hardware_setup(void)