Re: [RFCv1 2/7] x86/kvm: Introduce KVM memory protection feature
On Fri, Apr 09, 2021 at 04:36:01PM +0300, Kirill A. Shutemov wrote: > The patchset is still in path-finding stage. I'll be more specific once we > settle on how the feature works. This is not why I'm asking: these feature bits are visible to userspace in /proc/cpuinfo and if you don't have a use case to show this to userspace, use the "" in the comment. And if you don't need that feature bit at all (you're only setting it but not querying it) you should not add it at all. Thx. -- Regards/Gruss, Boris. https://people.kernel.org/tglx/notes-about-netiquette
Re: [RFCv1 2/7] x86/kvm: Introduce KVM memory protection feature
On Thu, Apr 08, 2021 at 11:52:35AM +0200, Borislav Petkov wrote: > On Fri, Apr 02, 2021 at 06:26:40PM +0300, Kirill A. Shutemov wrote: > > Provide basic helpers, KVM_FEATURE, CPUID flag and a hypercall. > > > > Host side doesn't provide the feature yet, so it is a dead code for now. > > > > Signed-off-by: Kirill A. Shutemov > > --- > > arch/x86/include/asm/cpufeatures.h | 1 + > > arch/x86/include/asm/kvm_para.h | 5 + > > arch/x86/include/uapi/asm/kvm_para.h | 3 ++- > > arch/x86/kernel/kvm.c| 18 ++ > > include/uapi/linux/kvm_para.h| 3 ++- > > 5 files changed, 28 insertions(+), 2 deletions(-) > > > > diff --git a/arch/x86/include/asm/cpufeatures.h > > b/arch/x86/include/asm/cpufeatures.h > > index 84b887825f12..5b6f23e6edc4 100644 > > --- a/arch/x86/include/asm/cpufeatures.h > > +++ b/arch/x86/include/asm/cpufeatures.h > > @@ -238,6 +238,7 @@ > > #define X86_FEATURE_VMW_VMMCALL( 8*32+19) /* "" VMware prefers > > VMMCALL hypercall instruction */ > > #define X86_FEATURE_SEV_ES ( 8*32+20) /* AMD Secure Encrypted > > Virtualization - Encrypted State */ > > #define X86_FEATURE_VM_PAGE_FLUSH ( 8*32+21) /* "" VM Page Flush MSR is > > supported */ > > +#define X86_FEATURE_KVM_MEM_PROTECTED ( 8*32+22) /* KVM memory > > protection extenstion */ > > ^^ > What's that feature bit for? The patchset is still in path-finding stage. I'll be more specific once we settle on how the feature works. > Also, use a spellchecker pls: "extenstion". Ouch. Thanks. -- Kirill A. Shutemov
Re: [RFCv1 2/7] x86/kvm: Introduce KVM memory protection feature
On Fri, Apr 02, 2021 at 06:26:40PM +0300, Kirill A. Shutemov wrote: > Provide basic helpers, KVM_FEATURE, CPUID flag and a hypercall. > > Host side doesn't provide the feature yet, so it is a dead code for now. > > Signed-off-by: Kirill A. Shutemov > --- > arch/x86/include/asm/cpufeatures.h | 1 + > arch/x86/include/asm/kvm_para.h | 5 + > arch/x86/include/uapi/asm/kvm_para.h | 3 ++- > arch/x86/kernel/kvm.c| 18 ++ > include/uapi/linux/kvm_para.h| 3 ++- > 5 files changed, 28 insertions(+), 2 deletions(-) > > diff --git a/arch/x86/include/asm/cpufeatures.h > b/arch/x86/include/asm/cpufeatures.h > index 84b887825f12..5b6f23e6edc4 100644 > --- a/arch/x86/include/asm/cpufeatures.h > +++ b/arch/x86/include/asm/cpufeatures.h > @@ -238,6 +238,7 @@ > #define X86_FEATURE_VMW_VMMCALL ( 8*32+19) /* "" VMware prefers > VMMCALL hypercall instruction */ > #define X86_FEATURE_SEV_ES ( 8*32+20) /* AMD Secure Encrypted > Virtualization - Encrypted State */ > #define X86_FEATURE_VM_PAGE_FLUSH( 8*32+21) /* "" VM Page Flush MSR is > supported */ > +#define X86_FEATURE_KVM_MEM_PROTECTED( 8*32+22) /* KVM memory > protection extenstion */ ^^ What's that feature bit for? Also, use a spellchecker pls: "extenstion". -- Regards/Gruss, Boris. https://people.kernel.org/tglx/notes-about-netiquette
[RFCv1 2/7] x86/kvm: Introduce KVM memory protection feature
Provide basic helpers, KVM_FEATURE, CPUID flag and a hypercall.
Host side doesn't provide the feature yet, so it is a dead code for now.
Signed-off-by: Kirill A. Shutemov
---
arch/x86/include/asm/cpufeatures.h | 1 +
arch/x86/include/asm/kvm_para.h | 5 +
arch/x86/include/uapi/asm/kvm_para.h | 3 ++-
arch/x86/kernel/kvm.c| 18 ++
include/uapi/linux/kvm_para.h| 3 ++-
5 files changed, 28 insertions(+), 2 deletions(-)
diff --git a/arch/x86/include/asm/cpufeatures.h
b/arch/x86/include/asm/cpufeatures.h
index 84b887825f12..5b6f23e6edc4 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -238,6 +238,7 @@
#define X86_FEATURE_VMW_VMMCALL( 8*32+19) /* "" VMware prefers
VMMCALL hypercall instruction */
#define X86_FEATURE_SEV_ES ( 8*32+20) /* AMD Secure Encrypted
Virtualization - Encrypted State */
#define X86_FEATURE_VM_PAGE_FLUSH ( 8*32+21) /* "" VM Page Flush MSR is
supported */
+#define X86_FEATURE_KVM_MEM_PROTECTED ( 8*32+22) /* KVM memory protection
extenstion */
/* Intel-defined CPU features, CPUID level 0x0007:0 (EBX), word 9 */
#define X86_FEATURE_FSGSBASE ( 9*32+ 0) /* RDFSBASE, WRFSBASE,
RDGSBASE, WRGSBASE instructions*/
diff --git a/arch/x86/include/asm/kvm_para.h b/arch/x86/include/asm/kvm_para.h
index 338119852512..74aea18f3130 100644
--- a/arch/x86/include/asm/kvm_para.h
+++ b/arch/x86/include/asm/kvm_para.h
@@ -11,11 +11,16 @@ extern void kvmclock_init(void);
#ifdef CONFIG_KVM_GUEST
bool kvm_check_and_clear_guest_paused(void);
+bool kvm_mem_protected(void);
#else
static inline bool kvm_check_and_clear_guest_paused(void)
{
return false;
}
+static inline bool kvm_mem_protected(void)
+{
+ return false;
+}
#endif /* CONFIG_KVM_GUEST */
#define KVM_HYPERCALL \
diff --git a/arch/x86/include/uapi/asm/kvm_para.h
b/arch/x86/include/uapi/asm/kvm_para.h
index 950afebfba88..8d32c41861c9 100644
--- a/arch/x86/include/uapi/asm/kvm_para.h
+++ b/arch/x86/include/uapi/asm/kvm_para.h
@@ -28,11 +28,12 @@
#define KVM_FEATURE_PV_UNHALT 7
#define KVM_FEATURE_PV_TLB_FLUSH 9
#define KVM_FEATURE_ASYNC_PF_VMEXIT10
-#define KVM_FEATURE_PV_SEND_IPI11
+#define KVM_FEATURE_PV_SEND_IPI11
#define KVM_FEATURE_POLL_CONTROL 12
#define KVM_FEATURE_PV_SCHED_YIELD 13
#define KVM_FEATURE_ASYNC_PF_INT 14
#define KVM_FEATURE_MSI_EXT_DEST_ID15
+#define KVM_FEATURE_MEM_PROTECTED 16
#define KVM_HINTS_REALTIME 0
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index 5e78e01ca3b4..e6989e1b74eb 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -39,6 +39,13 @@
#include
#include
+static bool mem_protected;
+
+bool kvm_mem_protected(void)
+{
+ return mem_protected;
+}
+
DEFINE_STATIC_KEY_FALSE(kvm_async_pf_enabled);
static int kvmapf = 1;
@@ -749,6 +756,17 @@ static void __init kvm_init_platform(void)
{
kvmclock_init();
x86_platform.apic_post_init = kvm_apic_init;
+
+ if (kvm_para_has_feature(KVM_FEATURE_MEM_PROTECTED)) {
+ if (kvm_hypercall0(KVM_HC_ENABLE_MEM_PROTECTED)) {
+ pr_err("Failed to enable KVM memory protection\n");
+ return;
+ }
+
+ pr_info("KVM memory protection enabled\n");
+ mem_protected = true;
+ setup_force_cpu_cap(X86_FEATURE_KVM_MEM_PROTECTED);
+ }
}
#if defined(CONFIG_AMD_MEM_ENCRYPT)
diff --git a/include/uapi/linux/kvm_para.h b/include/uapi/linux/kvm_para.h
index 8b86609849b9..1a216f32e572 100644
--- a/include/uapi/linux/kvm_para.h
+++ b/include/uapi/linux/kvm_para.h
@@ -27,8 +27,9 @@
#define KVM_HC_MIPS_EXIT_VM7
#define KVM_HC_MIPS_CONSOLE_OUTPUT 8
#define KVM_HC_CLOCK_PAIRING 9
-#define KVM_HC_SEND_IPI10
+#define KVM_HC_SEND_IPI10
#define KVM_HC_SCHED_YIELD 11
+#define KVM_HC_ENABLE_MEM_PROTECTED12
/*
* hypercalls use architecture specific
--
2.26.3
