@@ -189,7 +189,10 @@ static int sev_guest_init(struct kvm *kvm, struct kvm_sev_cmd *argp)
if (asid < 0)
return ret;
- ret = sev_platform_init(&argp->error);
+ if (sev->snp_active)
+ ret = sev_snp_init(&argp->error);
+ else
+ ret = sev_platform_init(&argp->error);
if (ret)
goto e_free;
@@ -206,12 +209,19 @@ static int sev_guest_init(struct kvm *kvm, struct kvm_sev_cmd *argp)
static int sev_es_guest_init(struct kvm *kvm, struct kvm_sev_cmd *argp)
{
+ int ret;
+
if (!sev_es)
return -ENOTTY;
+ /* Must be set so that sev_asid_new() allocates ASID from the ES ASID range. */
to_kvm_svm(kvm)->sev_info.es_active = true;
- return sev_guest_init(kvm, argp);
+ ret = sev_guest_init(kvm, argp);
+ if (ret)
+ to_kvm_svm(kvm)->sev_info.es_active = false;
+
+ return ret;
}
static int sev_bind_asid(struct kvm *kvm, unsigned int handle, int *error)
@@ -1042,6 +1052,23 @@ static int sev_launch_secret(struct kvm *kvm, struct kvm_sev_cmd *argp)
return ret;
}
+static int sev_snp_guest_init(struct kvm *kvm, struct kvm_sev_cmd *argp)
+{
+ struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info;
+ int rc;
+
+ if (!sev_snp)
+ return -ENOTTY;
+
+ rc = sev_es_guest_init(kvm, argp);
+ if (rc)
+ return rc;
+
+ sev->snp_active = true;
+
+ return 0;
+}
+
int svm_mem_enc_op(struct kvm *kvm, void __user *argp)
{
struct kvm_sev_cmd sev_cmd;
@@ -1092,6 +1119,9 @@ int svm_mem_enc_op(struct kvm *kvm, void __user *argp)
case KVM_SEV_LAUNCH_SECRET:
r = sev_launch_secret(kvm, &sev_cmd);
break;
+ case KVM_SEV_SNP_INIT:
+ r = sev_snp_guest_init(kvm, &sev_cmd);
+ break;
default:
r = -EINVAL;
goto out;
@@ -1955,6 +1985,13 @@ int sev_es_string_io(struct vcpu_svm *svm, int size, unsigned int port, int in)
svm->ghcb_sa, svm->ghcb_sa_len, in);
}
+void sev_snp_init_vmcb(struct vcpu_svm *svm)
+{
+ struct vmcb_save_area *save = &svm->vmcb->save;
+
+ save->sev_features |= SVM_SEV_FEATURES_SNP_ACTIVE;
+}
+
void sev_es_init_vmcb(struct vcpu_svm *svm)
{
struct kvm_vcpu *vcpu = &svm->vcpu;
@@ -1281,6 +1281,11 @@ static void init_vmcb(struct vcpu_svm *svm)
/* Perform SEV-ES specific VMCB updates */
sev_es_init_vmcb(svm);
}
+
+ if (sev_snp_guest(svm->vcpu.kvm)) {
+ /* Perform SEV-SNP specific VMCB Updates */
+ sev_snp_init_vmcb(svm);
+ }
}
vmcb_mark_all_dirty(svm->vmcb);
@@ -604,6 +604,7 @@ void sev_es_vcpu_load(struct vcpu_svm *svm, int cpu);
void sev_es_vcpu_put(struct vcpu_svm *svm);
void sev_vcpu_deliver_sipi_vector(struct kvm_vcpu *vcpu, u8 vector);
struct page *snp_safe_alloc_page(struct kvm_vcpu *vcpu);
+void sev_snp_init_vmcb(struct vcpu_svm *svm);
/* vmenter.S */
@@ -1594,6 +1594,9 @@ enum sev_cmd_id {
/* Guest certificates commands */
KVM_SEV_CERT_EXPORT,
+ /* SNP specific commands */
+ KVM_SEV_SNP_INIT,
+
KVM_SEV_NR_MAX,
};
The KVM_SNP_INIT command is used by the hypervisor to initialize the SEV-SNP platform context. In a typical workflow, this command should be the first command issued. When creating SEV-SNP guest, the VMM must use this command instead of the KVM_SEV_INIT or KVM_SEV_ES_INIT. Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Ingo Molnar <mingo@redhat.com> Cc: Borislav Petkov <bp@alien8.de> Cc: Joerg Roedel <jroedel@suse.de> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Tony Luck <tony.luck@intel.com> Cc: Dave Hansen <dave.hansen@intel.com> Cc: "Peter Zijlstra (Intel)" <peterz@infradead.org> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Tom Lendacky <thomas.lendacky@amd.com> Cc: David Rientjes <rientjes@google.com> Cc: Sean Christopherson <seanjc@google.com> Cc: Vitaly Kuznetsov <vkuznets@redhat.com> Cc: Wanpeng Li <wanpengli@tencent.com> Cc: Jim Mattson <jmattson@google.com> Cc: x86@kernel.org Cc: kvm@vger.kernel.org Signed-off-by: Brijesh Singh <brijesh.singh@amd.com> --- arch/x86/kvm/svm/sev.c | 41 ++++++++++++++++++++++++++++++++++++++-- arch/x86/kvm/svm/svm.c | 5 +++++ arch/x86/kvm/svm/svm.h | 1 + include/uapi/linux/kvm.h | 3 +++ 4 files changed, 48 insertions(+), 2 deletions(-)