* [PATCH v2 0/2] nosnp sev command line support @ 2024-09-03 0:35 Pavan Kumar Paluri 2024-09-03 0:35 ` [PATCH v2 1/2] x86, KVM:SVM: Move sev specific parsing into arch/x86/virt/svm Pavan Kumar Paluri 2024-09-03 0:35 ` [PATCH v2 2/2] x86 KVM:SVM: Provide "nosnp" boot option for sev kernel command line Pavan Kumar Paluri 0 siblings, 2 replies; 5+ messages in thread From: Pavan Kumar Paluri @ 2024-09-03 0:35 UTC (permalink / raw) To: linux-kernel Cc: linux-doc, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Dave Hansen, Eric Van Tassell, Tom Lendacky, Ashish Kalra, Michael Roth, H . Peter Anvin, Peter Zijlstra, Pavan Kumar Paluri Provide "nosnp" boot option via "sev=nosnp" kernel command line to prevent SEV-SNP[1] capable host kernel from enabling SEV-SNP and initializing Reverse Map Table (RMP) [1]. On providing sev=nosnp via kernel command line: cat /sys/module/kvm_amd/parameters/sev_snp should be "N". This patchset is based on tip/master. Reference: [1] https://www.amd.com/content/dam/amd/en/documents/processor-tech-docs/programmer-references/24593.pdf Changelog: v1->v2: * Pick R-b from Tom. * Include only those headers that provide the necessary definitions (Boris) * Provide appropriate references to SEV, SNP and RMP (Matthew) --- Pavan Kumar Paluri (2): x86, KVM:SVM: Move sev specific parsing into arch/x86/virt/svm x86 KVM:SVM: Provide "nosnp" boot option for sev kernel command line .../arch/x86/x86_64/boot-options.rst | 3 ++ arch/x86/coco/sev/core.c | 44 ------------------- arch/x86/include/asm/sev-common.h | 30 +++++++++++++ arch/x86/virt/svm/Makefile | 1 + arch/x86/virt/svm/cmdline.c | 39 ++++++++++++++++ 5 files changed, 73 insertions(+), 44 deletions(-) create mode 100644 arch/x86/virt/svm/cmdline.c base-commit: a85536e1bce722cb184abbac98068217874bdd6e -- 2.34.1 ^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH v2 1/2] x86, KVM:SVM: Move sev specific parsing into arch/x86/virt/svm 2024-09-03 0:35 [PATCH v2 0/2] nosnp sev command line support Pavan Kumar Paluri @ 2024-09-03 0:35 ` Pavan Kumar Paluri 2024-09-03 8:44 ` kernel test robot 2024-09-03 0:35 ` [PATCH v2 2/2] x86 KVM:SVM: Provide "nosnp" boot option for sev kernel command line Pavan Kumar Paluri 1 sibling, 1 reply; 5+ messages in thread From: Pavan Kumar Paluri @ 2024-09-03 0:35 UTC (permalink / raw) To: linux-kernel Cc: linux-doc, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Dave Hansen, Eric Van Tassell, Tom Lendacky, Ashish Kalra, Michael Roth, H . Peter Anvin, Peter Zijlstra, Pavan Kumar Paluri Move SEV specific kernel command line option parsing support from arch/x86/coco/sev/core.c to arch/x86/virt/svm/cmdline.c so that both host and guest related SEV command line options can be supported. No functional changes intended. Signed-off-by: Pavan Kumar Paluri <papaluri@amd.com> Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com> --- arch/x86/coco/sev/core.c | 44 ------------------------------- arch/x86/include/asm/sev-common.h | 30 +++++++++++++++++++++ arch/x86/virt/svm/Makefile | 1 + arch/x86/virt/svm/cmdline.c | 32 ++++++++++++++++++++++ 4 files changed, 63 insertions(+), 44 deletions(-) create mode 100644 arch/x86/virt/svm/cmdline.c diff --git a/arch/x86/coco/sev/core.c b/arch/x86/coco/sev/core.c index de1df0cb45da..ff19e805e7a1 100644 --- a/arch/x86/coco/sev/core.c +++ b/arch/x86/coco/sev/core.c @@ -141,33 +141,6 @@ static DEFINE_PER_CPU(struct sev_es_save_area *, sev_vmsa); static DEFINE_PER_CPU(struct svsm_ca *, svsm_caa); static DEFINE_PER_CPU(u64, svsm_caa_pa); -struct sev_config { - __u64 debug : 1, - - /* - * Indicates when the per-CPU GHCB has been created and registered - * and thus can be used by the BSP instead of the early boot GHCB. - * - * For APs, the per-CPU GHCB is created before they are started - * and registered upon startup, so this flag can be used globally - * for the BSP and APs. - */ - ghcbs_initialized : 1, - - /* - * Indicates when the per-CPU SVSM CA is to be used instead of the - * boot SVSM CA. - * - * For APs, the per-CPU SVSM CA is created as part of the AP - * bringup, so this flag can be used globally for the BSP and APs. - */ - use_cas : 1, - - __reserved : 61; -}; - -static struct sev_config sev_cfg __read_mostly; - static __always_inline bool on_vc_stack(struct pt_regs *regs) { unsigned long sp = regs->sp; @@ -2374,23 +2347,6 @@ static int __init report_snp_info(void) } arch_initcall(report_snp_info); -static int __init init_sev_config(char *str) -{ - char *s; - - while ((s = strsep(&str, ","))) { - if (!strcmp(s, "debug")) { - sev_cfg.debug = true; - continue; - } - - pr_info("SEV command-line option '%s' was not recognized\n", s); - } - - return 1; -} -__setup("sev=", init_sev_config); - static void update_attest_input(struct svsm_call *call, struct svsm_attest_call *input) { /* If (new) lengths have been returned, propagate them up */ diff --git a/arch/x86/include/asm/sev-common.h b/arch/x86/include/asm/sev-common.h index 98726c2b04f8..d3e7f97e2a4a 100644 --- a/arch/x86/include/asm/sev-common.h +++ b/arch/x86/include/asm/sev-common.h @@ -8,6 +8,9 @@ #ifndef __ASM_X86_SEV_COMMON_H #define __ASM_X86_SEV_COMMON_H +#include <asm/cache.h> +#include <asm/pgtable_types.h> + #define GHCB_MSR_INFO_POS 0 #define GHCB_DATA_LOW 12 #define GHCB_MSR_INFO_MASK (BIT_ULL(GHCB_DATA_LOW) - 1) @@ -220,4 +223,31 @@ struct snp_psc_desc { #define GHCB_ERR_INVALID_INPUT 5 #define GHCB_ERR_INVALID_EVENT 6 +struct sev_config { + __u64 debug : 1, + + /* + * Indicates when the per-CPU GHCB has been created and registered + * and thus can be used by the BSP instead of the early boot GHCB. + * + * For APs, the per-CPU GHCB is created before they are started + * and registered upon startup, so this flag can be used globally + * for the BSP and APs. + */ + ghcbs_initialized : 1, + + /* + * Indicates when the per-CPU SVSM CA is to be used instead of the + * boot SVSM CA. + * + * For APs, the per-CPU SVSM CA is created as part of the AP + * bringup, so this flag can be used globally for the BSP and APs. + */ + use_cas : 1, + + __reserved : 61; +}; + +extern struct sev_config sev_cfg __read_mostly; + #endif diff --git a/arch/x86/virt/svm/Makefile b/arch/x86/virt/svm/Makefile index ef2a31bdcc70..eca6d71355fa 100644 --- a/arch/x86/virt/svm/Makefile +++ b/arch/x86/virt/svm/Makefile @@ -1,3 +1,4 @@ # SPDX-License-Identifier: GPL-2.0 obj-$(CONFIG_KVM_AMD_SEV) += sev.o +obj-$(CONFIG_CPU_SUP_AMD) += cmdline.o diff --git a/arch/x86/virt/svm/cmdline.c b/arch/x86/virt/svm/cmdline.c new file mode 100644 index 000000000000..4fe34e831d8f --- /dev/null +++ b/arch/x86/virt/svm/cmdline.c @@ -0,0 +1,32 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * AMD SVM-SEV command line parsing support + * + * Copyright (C) 2023 - 2024 Advanced Micro Devices, Inc. + * + * Author: Michael Roth <michael.roth@amd.com> + */ + +#include <linux/string.h> +#include <linux/printk.h> + +#include <asm/sev.h> + +struct sev_config sev_cfg; + +static int __init init_sev_config(char *str) +{ + char *s; + + while ((s = strsep(&str, ","))) { + if (!strcmp(s, "debug")) { + sev_cfg.debug = true; + continue; + } + + pr_info("SEV command-line option '%s' was not recognized\n", s); + } + + return 1; +} +__setup("sev=", init_sev_config); -- 2.34.1 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH v2 1/2] x86, KVM:SVM: Move sev specific parsing into arch/x86/virt/svm 2024-09-03 0:35 ` [PATCH v2 1/2] x86, KVM:SVM: Move sev specific parsing into arch/x86/virt/svm Pavan Kumar Paluri @ 2024-09-03 8:44 ` kernel test robot 2024-09-03 20:38 ` Paluri, PavanKumar 0 siblings, 1 reply; 5+ messages in thread From: kernel test robot @ 2024-09-03 8:44 UTC (permalink / raw) To: Pavan Kumar Paluri, linux-kernel Cc: oe-kbuild-all, linux-doc, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Dave Hansen, Eric Van Tassell, Tom Lendacky, Ashish Kalra, Michael Roth, H . Peter Anvin, Pavan Kumar Paluri Hi Pavan, kernel test robot noticed the following build warnings: [auto build test WARNING on a85536e1bce722cb184abbac98068217874bdd6e] url: https://github.com/intel-lab-lkp/linux/commits/Pavan-Kumar-Paluri/x86-KVM-SVM-Move-sev-specific-parsing-into-arch-x86-virt-svm/20240903-083803 base: a85536e1bce722cb184abbac98068217874bdd6e patch link: https://lore.kernel.org/r/20240903003511.1530454-2-papaluri%40amd.com patch subject: [PATCH v2 1/2] x86, KVM:SVM: Move sev specific parsing into arch/x86/virt/svm config: i386-buildonly-randconfig-001-20240903 (https://download.01.org/0day-ci/archive/20240903/202409031656.SS8NsjIN-lkp@intel.com/config) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240903/202409031656.SS8NsjIN-lkp@intel.com/reproduce) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp@intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409031656.SS8NsjIN-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from arch/x86/include/asm/sev.h:16, from arch/x86/virt/svm/cmdline.c:13: >> arch/x86/include/asm/coco.h:28:18: warning: 'cc_mask' defined but not used [-Wunused-const-variable=] 28 | static const u64 cc_mask = 0; | ^~~~~~~ vim +/cc_mask +28 arch/x86/include/asm/coco.h 1c811d403afd73 Ard Biesheuvel 2024-02-03 22 b577f542f93cbb Kirill A. Shutemov 2022-02-22 23 u64 cc_mkenc(u64 val); b577f542f93cbb Kirill A. Shutemov 2022-02-22 24 u64 cc_mkdec(u64 val); 99485c4c026f02 Jason A. Donenfeld 2024-03-26 25 void cc_random_init(void); b577f542f93cbb Kirill A. Shutemov 2022-02-22 26 #else e4596477100706 Nathan Chancellor 2024-02-02 27 #define cc_vendor (CC_VENDOR_NONE) a0a8d15a798be4 Kirill A. Shutemov 2024-04-24 @28 static const u64 cc_mask = 0; e4596477100706 Nathan Chancellor 2024-02-02 29 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v2 1/2] x86, KVM:SVM: Move sev specific parsing into arch/x86/virt/svm 2024-09-03 8:44 ` kernel test robot @ 2024-09-03 20:38 ` Paluri, PavanKumar 0 siblings, 0 replies; 5+ messages in thread From: Paluri, PavanKumar @ 2024-09-03 20:38 UTC (permalink / raw) To: linux-kernel Cc: oe-kbuild-all, linux-doc, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Dave Hansen, Eric Van Tassell, Tom Lendacky, Ashish Kalra, Michael Roth, H . Peter Anvin On 9/3/2024 3:44 AM, kernel test robot wrote: > Hi Pavan, > > kernel test robot noticed the following build warnings: > > [auto build test WARNING on a85536e1bce722cb184abbac98068217874bdd6e] > > url: https://github.com/intel-lab-lkp/linux/commits/Pavan-Kumar-Paluri/x86-KVM-SVM-Move-sev-specific-parsing-into-arch-x86-virt-svm/20240903-083803 > base: a85536e1bce722cb184abbac98068217874bdd6e > patch link: https://lore.kernel.org/r/20240903003511.1530454-2-papaluri%40amd.com > patch subject: [PATCH v2 1/2] x86, KVM:SVM: Move sev specific parsing into arch/x86/virt/svm > config: i386-buildonly-randconfig-001-20240903 (https://download.01.org/0day-ci/archive/20240903/202409031656.SS8NsjIN-lkp@intel.com/config) > compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 > reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240903/202409031656.SS8NsjIN-lkp@intel.com/reproduce) > > If you fix the issue in a separate patch/commit (i.e. not just a new version of > the same patch/commit), kindly add following tags > | Reported-by: kernel test robot <lkp@intel.com> > | Closes: https://lore.kernel.org/oe-kbuild-all/202409031656.SS8NsjIN-lkp@intel.com/ > > All warnings (new ones prefixed by >>): > > In file included from arch/x86/include/asm/sev.h:16, > from arch/x86/virt/svm/cmdline.c:13: >>> arch/x86/include/asm/coco.h:28:18: warning: 'cc_mask' defined but not used [-Wunused-const-variable=] > 28 | static const u64 cc_mask = 0; > | ^~~~~~~ > > > vim +/cc_mask +28 arch/x86/include/asm/coco.h > > 1c811d403afd73 Ard Biesheuvel 2024-02-03 22 > b577f542f93cbb Kirill A. Shutemov 2022-02-22 23 u64 cc_mkenc(u64 val); > b577f542f93cbb Kirill A. Shutemov 2022-02-22 24 u64 cc_mkdec(u64 val); > 99485c4c026f02 Jason A. Donenfeld 2024-03-26 25 void cc_random_init(void); > b577f542f93cbb Kirill A. Shutemov 2022-02-22 26 #else > e4596477100706 Nathan Chancellor 2024-02-02 27 #define cc_vendor (CC_VENDOR_NONE) > a0a8d15a798be4 Kirill A. Shutemov 2024-04-24 @28 static const u64 cc_mask = 0; > e4596477100706 Nathan Chancellor 2024-02-02 29 > The following diff resolves the build warning reported by kernel test robot. diff --git a/arch/x86/virt/svm/cmdline.c b/arch/x86/virt/svm/cmdline.c index 43039ec67606..9b900e950b4b 100644 --- a/arch/x86/virt/svm/cmdline.c +++ b/arch/x86/virt/svm/cmdline.c @@ -11,7 +11,7 @@ #include <linux/printk.h> #include <asm/cpufeature.h> -#include <asm/sev.h> +#include <asm/sev-common.h> struct sev_config sev_cfg; I will apply this fix to the patch and send a v3. Thanks, Pavan ^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH v2 2/2] x86 KVM:SVM: Provide "nosnp" boot option for sev kernel command line 2024-09-03 0:35 [PATCH v2 0/2] nosnp sev command line support Pavan Kumar Paluri 2024-09-03 0:35 ` [PATCH v2 1/2] x86, KVM:SVM: Move sev specific parsing into arch/x86/virt/svm Pavan Kumar Paluri @ 2024-09-03 0:35 ` Pavan Kumar Paluri 1 sibling, 0 replies; 5+ messages in thread From: Pavan Kumar Paluri @ 2024-09-03 0:35 UTC (permalink / raw) To: linux-kernel Cc: linux-doc, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Dave Hansen, Eric Van Tassell, Tom Lendacky, Ashish Kalra, Michael Roth, H . Peter Anvin, Peter Zijlstra, Pavan Kumar Paluri Provide a "nosnp" kernel command line option to prevent enabling of the RMP and SEV-SNP features in the host/hypervisor. Not initializing the RMP removes system overhead associated with RMP checks. Co-developed-by: Eric Van Tassell <Eric.VanTassell@amd.com> Signed-off-by: Eric Van Tassell <Eric.VanTassell@amd.com> Signed-off-by: Pavan Kumar Paluri <papaluri@amd.com> Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com> --- Documentation/arch/x86/x86_64/boot-options.rst | 3 +++ arch/x86/virt/svm/cmdline.c | 7 +++++++ 2 files changed, 10 insertions(+) diff --git a/Documentation/arch/x86/x86_64/boot-options.rst b/Documentation/arch/x86/x86_64/boot-options.rst index 137432d34109..3d4e9a7dccf2 100644 --- a/Documentation/arch/x86/x86_64/boot-options.rst +++ b/Documentation/arch/x86/x86_64/boot-options.rst @@ -317,3 +317,6 @@ The available options are: debug Enable debug messages. + + nosnp + Do not enable SEV-SNP (applies to host/hypervisor only). diff --git a/arch/x86/virt/svm/cmdline.c b/arch/x86/virt/svm/cmdline.c index 4fe34e831d8f..43039ec67606 100644 --- a/arch/x86/virt/svm/cmdline.c +++ b/arch/x86/virt/svm/cmdline.c @@ -10,6 +10,7 @@ #include <linux/string.h> #include <linux/printk.h> +#include <asm/cpufeature.h> #include <asm/sev.h> struct sev_config sev_cfg; @@ -24,6 +25,12 @@ static int __init init_sev_config(char *str) continue; } + if (!strcmp(s, "nosnp")) { + setup_clear_cpu_cap(X86_FEATURE_SEV_SNP); + cc_platform_clear(CC_ATTR_HOST_SEV_SNP); + continue; + } + pr_info("SEV command-line option '%s' was not recognized\n", s); } -- 2.34.1 ^ permalink raw reply related [flat|nested] 5+ messages in thread
end of thread, other threads:[~2024-09-03 20:38 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2024-09-03 0:35 [PATCH v2 0/2] nosnp sev command line support Pavan Kumar Paluri 2024-09-03 0:35 ` [PATCH v2 1/2] x86, KVM:SVM: Move sev specific parsing into arch/x86/virt/svm Pavan Kumar Paluri 2024-09-03 8:44 ` kernel test robot 2024-09-03 20:38 ` Paluri, PavanKumar 2024-09-03 0:35 ` [PATCH v2 2/2] x86 KVM:SVM: Provide "nosnp" boot option for sev kernel command line Pavan Kumar Paluri
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).