linux-kernel - Re: [PATCH v1 1/4] x86/sev: Remove sev_enable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Wed, 1 Dec 2021 13:32:18 -0600
From:   Tom Lendacky <thomas.lendacky@....com>
To:     Kuppuswamy Sathyanarayanan 
        <sathyanarayanan.kuppuswamy@...ux.intel.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        Dave Hansen <dave.hansen@...ux.intel.com>, x86@...nel.org
Cc:     Andy Lutomirski <luto@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        "H . Peter Anvin" <hpa@...or.com>, Tony Luck <tony.luck@...el.com>,
        Dan Williams <dan.j.williams@...el.com>,
        Andi Kleen <ak@...ux.intel.com>,
        Kirill Shutemov <kirill.shutemov@...ux.intel.com>,
        Kuppuswamy Sathyanarayanan <knsathya@...nel.org>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v1 1/4] x86/sev: Remove sev_enable_key usage in
 outs##bwl()/ins##bwl()

On 11/15/21 6:45 PM, Kuppuswamy Sathyanarayanan wrote:
> String I/O instructions (INS/OUTS) can be used to move blocks of
> data between I/O ports and memory space. But emulation of these
> instructions is not supported in AMD SEV platform. Since these
> instructions are obsolete, hypervisors rarely emulate them. So to
> support the legacy usage, INS/OUTS are unrolled using IN/OUT
> instructions.
> 
> Currently, this is implemented by adding a SEV specific static
> key check in outs##bwl()/ins##bwl() macros. Since TDX VM guests
> also need similar support, the implementation needs to be made
> generic using the cc_platform_has() call.
> 
> In preparation for adding cc_platform_has() based support, as a
> first step remove the sev_enable_key usage and replace it with
> direct reference to "sev_status".

Probably makes sense to just go directly to the cc_platform_has() call 
rather than introduce the usage of sev_status.

So maybe squash patches 1 and 2 into a single patch.

Thanks,
Tom

> 
> Since this patch replaces the static key usage, it might lead to
> some performance gap.
> 
> Suggested-by: Tom Lendacky <thomas.lendacky@....com>
> Reviewed-by: Tony Luck <tony.luck@...el.com>
> Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@...ux.intel.com>
> ---
>   arch/x86/include/asm/io.h | 15 ++++++++-------
>   arch/x86/mm/mem_encrypt.c | 11 +----------
>   2 files changed, 9 insertions(+), 17 deletions(-)
> 
> diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h
> index 5c6a4af0b911..69093a610630 100644
> --- a/arch/x86/include/asm/io.h
> +++ b/arch/x86/include/asm/io.h
> @@ -257,17 +257,18 @@ static inline void slow_down_io(void)
>   #endif
>   
>   #ifdef CONFIG_AMD_MEM_ENCRYPT
> -#include <linux/jump_label.h>
>   
> -extern struct static_key_false sev_enable_key;
> -static inline bool sev_key_active(void)
> +extern u64 sev_status;
> +
> +static inline bool is_sev_enabled(void)
>   {
> -	return static_branch_unlikely(&sev_enable_key);
> +	return ((sev_status & MSR_AMD64_SEV_ENABLED) &&
> +		!(sev_status & MSR_AMD64_SEV_ES_ENABLED));
>   }
>   
>   #else /* !CONFIG_AMD_MEM_ENCRYPT */
>   
> -static inline bool sev_key_active(void) { return false; }
> +static inline bool is_sev_enabled(void) { return false; }
>   
>   #endif /* CONFIG_AMD_MEM_ENCRYPT */
>   
> @@ -301,7 +302,7 @@ static inline unsigned type in##bwl##_p(int port)			\
>   									\
>   static inline void outs##bwl(int port, const void *addr, unsigned long count) \
>   {									\
> -	if (sev_key_active()) {						\
> +	if (is_sev_enabled()) {						\
>   		unsigned type *value = (unsigned type *)addr;		\
>   		while (count) {						\
>   			out##bwl(*value, port);				\
> @@ -317,7 +318,7 @@ static inline void outs##bwl(int port, const void *addr, unsigned long count) \
>   									\
>   static inline void ins##bwl(int port, void *addr, unsigned long count)	\
>   {									\
> -	if (sev_key_active()) {						\
> +	if (is_sev_enabled()) {						\
>   		unsigned type *value = (unsigned type *)addr;		\
>   		while (count) {						\
>   			*value = in##bwl(port);				\
> diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c
> index 35487305d8af..49e5dfc23785 100644
> --- a/arch/x86/mm/mem_encrypt.c
> +++ b/arch/x86/mm/mem_encrypt.c
> @@ -43,8 +43,7 @@ u64 sme_me_mask __section(".data") = 0;
>   u64 sev_status __section(".data") = 0;
>   u64 sev_check_data __section(".data") = 0;
>   EXPORT_SYMBOL(sme_me_mask);
> -DEFINE_STATIC_KEY_FALSE(sev_enable_key);
> -EXPORT_SYMBOL_GPL(sev_enable_key);
> +EXPORT_SYMBOL_GPL(sev_status);
>   
>   /* Buffer used for early in-place encryption by BSP, no locking needed */
>   static char sme_early_buffer[PAGE_SIZE] __initdata __aligned(PAGE_SIZE);
> @@ -499,14 +498,6 @@ void __init mem_encrypt_init(void)
>   	/* Call into SWIOTLB to update the SWIOTLB DMA buffers */
>   	swiotlb_update_mem_attributes();
>   
> -	/*
> -	 * With SEV, we need to unroll the rep string I/O instructions,
> -	 * but SEV-ES supports them through the #VC handler.
> -	 */
> -	if (cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT) &&
> -	    !cc_platform_has(CC_ATTR_GUEST_STATE_ENCRYPT))
> -		static_branch_enable(&sev_enable_key);
> -
>   	print_mem_encrypt_feature_info();
>   }
>   
>