@@ -252,20 +252,6 @@ static int sev_guest_init(struct kvm *kvm, struct kvm_sev_cmd *argp)
return ret;
}
-static int sev_bind_asid(struct kvm *kvm, unsigned int handle, int *error)
-{
- struct sev_data_activate activate;
- int asid = sev_get_asid(kvm);
- int ret;
-
- /* activate ASID on the given handle */
- activate.handle = handle;
- activate.asid = asid;
- ret = sev_guest_activate(&activate, error);
-
- return ret;
-}
-
static int __sev_issue_cmd(int fd, int id, void *data, int *error)
{
struct fd f;
@@ -336,11 +322,9 @@ static int sev_launch_start(struct kvm *kvm, struct kvm_sev_cmd *argp)
goto e_free_session;
/* Bind ASID to this guest */
- ret = sev_bind_asid(kvm, start.handle, error);
- if (ret) {
- sev_guest_decommission(start.handle, NULL);
+ ret = sev_guest_bind_asid(sev_get_asid(kvm), start.handle, error);
+ if (ret)
goto e_free_session;
- }
/* return handle to userspace */
params.handle = start.handle;
@@ -1385,7 +1369,8 @@ static int sev_receive_start(struct kvm *kvm, struct kvm_sev_cmd *argp)
goto e_free_session;
/* Bind ASID to this guest */
- ret = sev_bind_asid(kvm, start.handle, error);
+ ret = sev_guest_bind_asid(sev_get_asid(kvm), start.handle, error);
+
if (ret)
goto e_free_session;
@@ -903,6 +903,21 @@ int sev_guest_activate(struct sev_data_activate *data, int *error)
}
EXPORT_SYMBOL_GPL(sev_guest_activate);
+int sev_guest_bind_asid(int asid, unsigned int handle, int *error)
+{
+ struct sev_data_activate activate;
+ int ret;
+
+ /* activate ASID on the given handle */
+ activate.handle = handle;
+ activate.asid = asid;
+ ret = sev_guest_activate(&activate, error);
+ if (ret)
+ sev_guest_decommission(handle, NULL);
+ return ret;
+}
+EXPORT_SYMBOL_GPL(sev_guest_bind_asid);
+
int sev_guest_decommission(unsigned int handle, int *error)
{
struct sev_data_decommission decommission;
@@ -595,6 +595,22 @@ int sev_guest_deactivate(struct sev_data_deactivate *data, int *error);
*/
int sev_guest_activate(struct sev_data_activate *data, int *error);
+/**
+ * sev_guest_bind_asid - bind an ASID with VM and does decommission on failure
+ *
+ * @asid: current ASID of the VM
+ * @handle: handle of the VM to retrieve status
+ * @sev_ret: sev command return code
+ *
+ * Returns:
+ * 0 if the sev successfully processed the command
+ * -%ENODEV if the sev device is not available
+ * -%ENOTSUPP if the sev does not support SEV
+ * -%ETIMEDOUT if the sev command timed out
+ * -%EIO if the sev returned a non-zero return code
+ */
+int sev_guest_bind_asid(int asid, unsigned int handle, int *error);
+
/**
* sev_guest_df_flush - perform SEV DF_FLUSH command
*
@@ -643,6 +659,9 @@ sev_guest_decommission(unsigned int handle, int *error) { return -ENODEV; }
static inline int
sev_guest_activate(struct sev_data_activate *data, int *error) { return -ENODEV; }
+static inline int
+sev_guest_bind_asid(int asid, unsigned int handle, int *error) { return -ENODEV; }
+
static inline int sev_guest_df_flush(int *error) { return -ENODEV; }
static inline int
ccp/sev-dev.c is the software layer in psp that allows KVM to manage SEV/ES/SNP enabled VMs. Since psp API provides only primitive sev command invocation, KVM has to do extra processing that are specific only to psp with KVM level wrapper function. sev_bind_asid is such a KVM function that literally wraps around sev_guest_activate in psp with extra steps like psp data structure creation and error processing: invoking sev_guest_decommission on activation failure. Adding sev_guest_decommission is essentially required on all sev_bin_asid call sites. This is error prone and in fact the upstream code in KVM still have an issue on sev_receive_start where sev_guest_decommission is missing. Since sev_bind_asid code logic is purely psp specific, putting it into psp layer should make it more robust, since KVM code does not have to worry about error handling of asid binding failure. So replace the KVM pointer in sev_bind_asid with primitive arguments: asid and handle; slightly change the name to sev_guest_bind_asid make it consistent with other psp APIs; add the error handling code inside sev_guest_bind_asid and; put it into the sev-dev.c. Cc: Alper Gun <alpergun@google.com> Cc: Borislav Petkov <bp@alien8.de> Cc: Brijesh Singh <brijesh.singh@amd.com> Cc: David Rienjes <rientjes@google.com> Cc: Marc Orr <marcorr@google.com> Cc: John Allen <john.allen@amd.com> Cc: Peter Gonda <pgonda@google.com> Cc: Sean Christopherson <seanjc@google.com> Cc: Tom Lendacky <thomas.lendacky@amd.com> Cc: Vipin Sharma <vipinsh@google.com> Fixes: af43cbbf954b ("KVM: SVM: Add support for KVM_SEV_RECEIVE_START command") Signed-off-by: Mingwei Zhang <mizhang@google.com> --- arch/x86/kvm/svm/sev.c | 23 ++++------------------- drivers/crypto/ccp/sev-dev.c | 15 +++++++++++++++ include/linux/psp-sev.h | 19 +++++++++++++++++++ 3 files changed, 38 insertions(+), 19 deletions(-)