From mboxrd@z Thu Jan  1 00:00:00 1970
From: Brijesh Singh <brijesh.singh@amd.com>
Subject: Re: [Part1 PATCH v4 16/17] X86/KVM: Unencrypt shared per-cpu
 variables when SEV is active
Date: Tue, 19 Sep 2017 09:00:39 -0500
Message-ID: <b1a8aed8-6f57-18cf-94b6-58b4ec1563de@amd.com>
References: <20170916123418.37807-1-brijesh.singh@amd.com>
 <20170916123418.37807-17-brijesh.singh@amd.com>
 <20170919110611.GN4733@nazgul.tnic>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Cc: brijesh.singh@amd.com, linux-kernel@vger.kernel.org,
        x86@kernel.org, kvm@vger.kernel.org,
        Thomas Gleixner <tglx@linutronix.de>,
        Ingo Molnar <mingo@redhat.com>,
        "H . Peter Anvin" <hpa@zytor.com>,
        Andy Lutomirski <luto@kernel.org>,
        Tom Lendacky <thomas.lendacky@amd.com>,
        Paolo Bonzini <pbonzini@redhat.com>,
        =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= <rkrcmar@redhat.com>
To: Borislav Petkov <bp@suse.de>
Return-path: <linux-kernel-owner@vger.kernel.org>
In-Reply-To: <20170919110611.GN4733@nazgul.tnic>
Content-Language: en-US
Sender: linux-kernel-owner@vger.kernel.org
List-Id: kvm.vger.kernel.org



On 09/19/2017 06:06 AM, Borislav Petkov wrote:
...

>> +	unsigned long pa = slow_virt_to_phys(var);
>> +
>> +	/* decrypt the memory in-place */
>> +	sme_early_decrypt(pa, size);
>> +
>> +	/* clear the C-bit from the page table */
>> +	early_set_memory_decrypted(pa, size);
> 
> So those two do a lot of work like TLB flushing and WBINVD for each
> per-CPU variable and normally I'd say you do this on one go instead of
> variable per variable and thus save yourself the subsequent expensive
> invalidation calls but we do it once only during boot so maybe something
> to think about later, when there's more time and boredom.
> 
> :)


Yes, we can revisit it later to optimize it.

...

> 
> Let it stick out and shorten function name:
> 
> 	for_each_possible_cpu(cpu) {
>                  __set_percpu_decrypted(&per_cpu(apf_reason, cpu),   sizeof(struct kvm_vcpu_pv_apf_data));
>                  __set_percpu_decrypted(&per_cpu(steal_time, cpu),   sizeof(struct kvm_steal_time));
>                  __set_percpu_decrypted(&per_cpu(kvm_apic_eoi, cpu), sizeof(unsigned long));
>          }
> 
> Also, we agreed to call everything that's not encrypted "decrypted" so
> that we have only two different states: encrypted and decrypted and thus
> less confusion.


Will do.