| Message ID | 20221119034633.1728632-5-ltykernel@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | x86/hyperv/sev: Add AMD sev-snp enlightened guest support on hyperv | expand |
From: Tianyu Lan <ltykernel@gmail.com> Sent: Friday, November 18, 2022 7:46 PM > > hv vp assist page is shared between sev snp guest and hyperv. Decrypt > the page when use it. > > Signed-off-by: Tianyu Lan <tiala@microsoft.com> > --- > arch/x86/hyperv/hv_init.c | 12 ++++++++++++ > 1 file changed, 12 insertions(+) > > diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c > index 29774126e931..4600c5941957 100644 > --- a/arch/x86/hyperv/hv_init.c > +++ b/arch/x86/hyperv/hv_init.c > @@ -30,6 +30,7 @@ > #include <clocksource/hyperv_timer.h> > #include <linux/highmem.h> > #include <linux/swiotlb.h> > +#include <linux/set_memory.h> > > int hyperv_init_cpuhp; > u64 hv_current_partition_id = ~0ull; > @@ -112,6 +113,11 @@ static int hv_cpu_init(unsigned int cpu) > } > WARN_ON(!(*hvp)); > if (*hvp) { > + if (hv_isolation_type_en_snp()) { > + WARN_ON_ONCE(set_memory_decrypted((unsigned long)(*hvp), 1) != 0); The "!= 0" isn't needed. > + memset(*hvp, 0, PAGE_SIZE); > + } > + > msr.enable = 1; > wrmsrl(HV_X64_MSR_VP_ASSIST_PAGE, msr.as_uint64); > } > @@ -228,6 +234,12 @@ static int hv_cpu_die(unsigned int cpu) > > if (hv_vp_assist_page && hv_vp_assist_page[cpu]) { > union hv_vp_assist_msr_contents msr = { 0 }; > + > + if (hv_isolation_type_en_snp()) > + WARN_ON_ONCE(set_memory_encrypted( > + (unsigned long)hv_vp_assist_page[cpu], > + 1) != 0); > + The re-encryption should not be done here (or anywhere else, for that matter) since the VP assist pages are never freed. The Hyper-V synthetic MSR pointing to the page gets cleared, but the memory isn't freed. If the CPU should come back online later, the previously allocated VP assist page is reused. The decryption in hv_cpu_init() is done only when a new page is allocated to use as a VP assist page. So just leave the page decrypted here, and it will get reused in its decrypted state. This handling of the VP assist page is admittedly a bit weird. But it is needed. See discussion with Vitaly Kuznetsov here: https://lore.kernel.org/linux-hyperv/878rkqr7ku.fsf@ovpn-192-136.brq.redhat.com/ Michael > if (hv_root_partition) { > /* > * For root partition the VP assist page is mapped to > -- > 2.25.1
On 12/13/2022 3:41 AM, Michael Kelley (LINUX) wrote: >> @@ -228,6 +234,12 @@ static int hv_cpu_die(unsigned int cpu) >> >> if (hv_vp_assist_page && hv_vp_assist_page[cpu]) { >> union hv_vp_assist_msr_contents msr = { 0 }; >> + >> + if (hv_isolation_type_en_snp()) >> + WARN_ON_ONCE(set_memory_encrypted( >> + (unsigned long)hv_vp_assist_page[cpu], >> + 1) != 0); >> + > The re-encryption should not be done here (or anywhere else, for > that matter) since the VP assist pages are never freed. The Hyper-V > synthetic MSR pointing to the page gets cleared, but the memory isn't > freed. If the CPU should come back online later, the previously allocated > VP assist page is reused. The decryption in hv_cpu_init() is done only > when a new page is allocated to use as a VP assist page. So just leave > the page decrypted here, and it will get reused in its decrypted state. > > This handling of the VP assist page is admittedly a bit weird. But > it is needed. See discussion with Vitaly Kuznetsov here: > https://lore.kernel.org/linux-hyperv/878rkqr7ku.fsf@ovpn-192-136.brq.redhat.com/ > Agree. Good point. Will update in the next version. Thanks.
diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c index 29774126e931..4600c5941957 100644 --- a/arch/x86/hyperv/hv_init.c +++ b/arch/x86/hyperv/hv_init.c @@ -30,6 +30,7 @@ #include <clocksource/hyperv_timer.h> #include <linux/highmem.h> #include <linux/swiotlb.h> +#include <linux/set_memory.h> int hyperv_init_cpuhp; u64 hv_current_partition_id = ~0ull; @@ -112,6 +113,11 @@ static int hv_cpu_init(unsigned int cpu) } WARN_ON(!(*hvp)); if (*hvp) { + if (hv_isolation_type_en_snp()) { + WARN_ON_ONCE(set_memory_decrypted((unsigned long)(*hvp), 1) != 0); + memset(*hvp, 0, PAGE_SIZE); + } + msr.enable = 1; wrmsrl(HV_X64_MSR_VP_ASSIST_PAGE, msr.as_uint64); } @@ -228,6 +234,12 @@ static int hv_cpu_die(unsigned int cpu) if (hv_vp_assist_page && hv_vp_assist_page[cpu]) { union hv_vp_assist_msr_contents msr = { 0 }; + + if (hv_isolation_type_en_snp()) + WARN_ON_ONCE(set_memory_encrypted( + (unsigned long)hv_vp_assist_page[cpu], + 1) != 0); + if (hv_root_partition) { /* * For root partition the VP assist page is mapped to