Re: [PATCH v3 0/4] x86: Fix SEV guest regression

[Tom Lendacky]

On 08/29/2018 01:23 PM, Brijesh Singh wrote:
> The following commit
> 
> "
> x86/kvmclock: Remove memblock dependency
> 
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=368a540e0232ad446931f5a4e8a5e06f69f21343
> "
> 
> introduced SEV guest regression.
> 
> The guest physical address holding the wall_clock and hv_clock_boot
> are shared with the hypervisor must be mapped with C=0 when SEV
> is active. To clear the C-bit we use  kernel_physical_mapping_init() to
> split the large pages. The above commit moved the kvmclock initialization
> very early and kernel_physical_mapping_init() fails to allocate memory
> while spliting the large page.
> 
> To solve it, we add a special .data..decrypted section, this section can be
> used to hold the shared variables. Early boot code maps this section with
> C=0. The section is pmd aligned and sized to avoid the need to split the pages.
> Caller can use __decrypted attribute to add the variables in .data..decrypted
> section. 
> 
> Cc: Tom Lendacky <thomas.lendacky@xxxxxxx>
> Cc: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
> Cc: Borislav Petkov <bp@xxxxxxx>
> Cc: Paolo Bonzini <pbonzini@xxxxxxxxxx>
> Cc: Sean Christopherson <sean.j.christopherson@xxxxxxxxx>
> Cc: "Radim KrÄmÃÅ" <rkrcmar@xxxxxxxxxx>
> 

Reviewed-by: Tom Lendacky <thomas.lendacky@xxxxxxx>

> Changes since v2:
>  - commit message and code comment improvements (based on Boris feedback)
>  - move sme_populate_pgd fixes in new patch.
>  - drop stable Cc - will submit to stable after patch is upstreamed.
> 
> Changes since v1:
>  - move the logic to re-arrange mapping in new patch
>  - move the definition of __start_data_* in mem_encrypt.h
>  - map the workarea buffer as encrypted when SEV is enabled
>  - enhance the sme_populate_pgd to update the pte/pmd flags when mapping exist
> 
> Brijesh Singh (4):
>   x86/mm: Restructure sme_encrypt_kernel()
>   x86/mm: fix sme_populate_pgd() to update page flags
>   x86/mm: add .data..decrypted section to hold shared variables
>   x86/kvm: use __decrypted attribute in shared variables
> 
>  arch/x86/include/asm/mem_encrypt.h |   6 +
>  arch/x86/kernel/head64.c           |  11 ++
>  arch/x86/kernel/kvmclock.c         |  30 ++++-
>  arch/x86/kernel/vmlinux.lds.S      |  17 +++
>  arch/x86/mm/mem_encrypt_identity.c | 232 +++++++++++++++++++++++++++----------
>  5 files changed, 229 insertions(+), 67 deletions(-)
>