From patchwork Wed May 1 07:10:45 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Roth X-Patchwork-Id: 794238 Received: from NAM11-BN8-obe.outbound.protection.outlook.com (mail-bn8nam11on2084.outbound.protection.outlook.com [40.107.236.84]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 94C204D9FC; Wed, 1 May 2024 07:47:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.236.84 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714549633; cv=fail; b=nwNFKhLhACR23jDY4r+TIn64U6sOfvZRD9mx2PxwqiMlkBrbMy5xjqVXCqTfhaCh7xyJM/LynpQ01pV24/rRyk+ishrOeht5m9C0HUcwyeP4TiRuKSXNkyK4wKzHRqQbd4pP3f5SifDe+ed95CfKrWm+FpW7lBlw7uFpwmGcRag= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714549633; c=relaxed/simple; bh=uQ7Kx3TwQhw26SgLxowep5X/GtjYEaH5Eg1Jg4fANxI=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=IDUwDfQZ/12UAlM4Zl3lBJ86iJ+El9H55mEEnEMLepYG+4iQBel2pn7nw2RhBNI0BYKA/UF2up9SCzyi8ynQCYg+08h9OWMgFebU3+3yTgInheEJeqXsdvkx1S89ibA6nSoT2eph7b6gV7NZpfJcmIcVhrxg2KkmqJIB81NrFAI= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com; spf=fail smtp.mailfrom=amd.com; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b=wPFqxagW; arc=fail smtp.client-ip=40.107.236.84 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=amd.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b="wPFqxagW" ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=a3cD4kf4eqmNzCu3W33RvisHQPQk/0fanEGLK50E3FaFSobCQrn448mb8poxfPS/W8hgtDQ/9PG8JQGSJU/T0x97e3GmNXb0UskNBWsxQPLVTnyPhr1/Hz2U84uqVAOxZJZx2DV7TxtuItWDL7oN4YFR0A5oA/Xr/Zl7LDmwtU4Ye1VFvWpM5tGU20QMOndFqG+C6jv3TGHAm7HswgNJ3X1LE9A2XM8z7qqEm0MPjs/e/cMVx5uD9vwQn0DN2k+RgRqx4mEHSVHQ3VvZpCeO/5K7PSIYb28g/vwaHIS711W9iZIPJJOszDcCH//Z49g7r4MnCkF9VtAV0BcbQmaiBg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=mUcwiyFHOOyR1TxaHBGwT/R8u08BH+n1ydQXmt0BUDo=; b=DL06191+Xdrx0vGUbBoBseCltQLWtESAd7SjqqV6x9E+UbzrBq4cW+GVrvpZlgsyBjhGe3ON420JIlt3LJHvtqOl0GdLo02aHURIb2homtqqPGM7sVFNz2uqs9ukzZg5uvKlFPITvI3K46y8LGkGcYFL0u2EOB9hCZo6kuRh11P+e5MFZz8DZcHwRHJg7/rsP5bcBg9KD/JqVqSOcAeUWPp5ggv5VKkquK5ivPH5s8l7WuDgFZ+39wBdiZe9eIlHPjJL/1NZR1ZKz95hU2e1EEJVBr5sRihn0+D1vdP/fielbZfyAAUUGlMFSrgeHRsDz0pPwBktbBPO6ORArbJIlA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=vger.kernel.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=mUcwiyFHOOyR1TxaHBGwT/R8u08BH+n1ydQXmt0BUDo=; b=wPFqxagW1qZ4LDbDS+ucv9kFms2IeXeH9TOKytknqQhJJca6q3jpsbsWj/9yQaD6eiZzaeDRFrFAKMDvf08A8L7o/HwZEEnDDnVSVpeqDUJtJf56p6e8rt6PMCTexpKT6TH9+jc29eA+v+G3rbgpTcaRnrdyWzW+ebzG6XDlpBE= Received: from CY5PR22CA0090.namprd22.prod.outlook.com (2603:10b6:930:65::12) by CY5PR12MB6275.namprd12.prod.outlook.com (2603:10b6:930:20::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7519.35; Wed, 1 May 2024 07:47:07 +0000 Received: from CY4PEPF0000EE37.namprd05.prod.outlook.com (2603:10b6:930:65:cafe::b3) by CY5PR22CA0090.outlook.office365.com (2603:10b6:930:65::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7544.27 via Frontend Transport; Wed, 1 May 2024 07:47:06 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; pr=C Received: from SATLEXMB04.amd.com (165.204.84.17) by CY4PEPF0000EE37.mail.protection.outlook.com (10.167.242.43) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.7544.18 via Frontend Transport; Wed, 1 May 2024 07:47:06 +0000 Received: from localhost (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.35; Wed, 1 May 2024 02:47:05 -0500 From: Michael Roth To: CC: , , , , , , , , , , , , , Brijesh Singh Subject: [PATCH 1/4] KVM: SEV: Add support to handle AP reset MSR protocol Date: Wed, 1 May 2024 02:10:45 -0500 Message-ID: <20240501071048.2208265-2-michael.roth@amd.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20240501071048.2208265-1-michael.roth@amd.com> References: <20240501071048.2208265-1-michael.roth@amd.com> Precedence: bulk X-Mailing-List: linux-crypto@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-ClientProxiedBy: SATLEXMB04.amd.com (10.181.40.145) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CY4PEPF0000EE37:EE_|CY5PR12MB6275:EE_ X-MS-Office365-Filtering-Correlation-Id: de3d0678-c094-4ea5-97f1-08dc69b2e614 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230031|376005|36860700004|7416005|82310400014|1800799015; X-Microsoft-Antispam-Message-Info: gTsMrHNuxBjAgsALplTx9Y+g5quhH5/ukFsafYl2/VKu/VgYWgx8jNpvPGUpZKBfQQ+RmFIGT/VhNv8fGvySpZqcQCNZGkbjMM2hvYASWY85Ut8GLdH/rsptzLTgtwE77j6XUJgUc4mEmXaQ382PNOMI+xibkEVh9tOHdZ1UL8CbSjrh9kZtFj+wIzEiz1bBJSzjbGF/qtasj9Ok52VLjlzHXaLUgcRezFlv0zKrYGbIKuIv/DjAJqvguSeBCJcjxpsLfh9r94KUh6I2I2YNncS3I4tpUIVa0eN8OBJXwBGk83sLKp5scs3Z0vGPFOP22S9hMbh8w5znvS15n1DqYOhPmgFPBWOUxr2Tgh2OWuBzTUjHalmZ0Xb3rL6rcHwtj73qF8xDUb1V6hOe/l49yP2aU9VgxVrKJW4uGfnrHF6ngdpNcz0zkcbLix7Ku+g+y0InHHC5rfEtFGWCIsXmDdHv2EiFetf/kEib/JRMQuF5MOK+oiCzleGr3rWvju1Qysh31DYDmf8Poz9ydPWzVPuywCo+DASapf+J8YNd3g7OqNRdJrc/j6lZQB1rDVn/uDDVIq11SAxJSay0jJUsAxISYAzPetbPNL7MQVm7L0nwbh5mrKLuRVS5NWYWZzRelS0Kjz0BjPyXNBCfj+Pk8LUlURxJiWY2pqH67rDcXX5fCwccGkKO6FUpwy2+UEFCnwOvjfTF0t+fCt9LzrAYuk8ax4wG//H04tYwj+OXXgCoJ5thtxWUHdTo5hvx3iI9kDhn5fIxXCtVM760FyZtVhEo6xZhfSNGwKW047Sdz8TNpX/UasyV+ftJ/PLfjzSrwBPSVlp7YHXwtboOUtVBnRwZBYa46f5n43+FFOBU7idGCvmDv02agiUq4vuEs1VUekUjuK0jaLeTk1KTNtIb73pwNJYJ1fdDp1G7wdTEQqBfLD1/+T+a39V7oRIratIjsxxZqrMIvn1NPJ26fNv6V2UwTSTXYEPb8Vcg2CYSwUzLAMp/4u2fVhBY8gAA4ojovKxTBcsKJpm9XyfFrtlExFDXwNZTGRX1YRtF8wkhLa6zHKCL+GfUPWLsVKKoRF0jWRcoHp88SLLAiTTAcZ0ETuACbC96RWNGrhanMdbdE/Vdv6smfnYJFHeHWzmOsXlRlOnVN8OSTZ++3BnHlcOcakElwl2QWjM66jfCAEkD49+jiQJDXqFQrKp/yCThR3o691P4mziX6qMqZn6FOg9Z9/6SE54ssBXTWmS5hErWc1q/KLqKDJePXRqtb6a5WyJf52PKvi6RZ5LOhFfKJxIf05PL8RQiznTKZCyEO2u2bJ7Wh7ZUJmhxLqR6DDXq+16oidUjiNvtr95M1lFdDdyyr4SDVVNUuoH0O1jNj6jr4ZLXPOvTHgWg6nmdyg5CrB3x X-Forefront-Antispam-Report: CIP:165.204.84.17; CTRY:US; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:SATLEXMB04.amd.com; PTR:InfoDomainNonexistent; CAT:NONE; SFS:(13230031)(376005)(36860700004)(7416005)(82310400014)(1800799015); DIR:OUT; SFP:1101; X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 May 2024 07:47:06.3934 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: de3d0678-c094-4ea5-97f1-08dc69b2e614 X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d; Ip=[165.204.84.17]; Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: CY4PEPF0000EE37.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY5PR12MB6275 From: Tom Lendacky Add support for AP Reset Hold being invoked using the GHCB MSR protocol, available in version 2 of the GHCB specification. Signed-off-by: Tom Lendacky Signed-off-by: Brijesh Singh Signed-off-by: Ashish Kalra Signed-off-by: Michael Roth --- arch/x86/include/asm/sev-common.h | 6 ++-- arch/x86/kvm/svm/sev.c | 56 ++++++++++++++++++++++++++----- arch/x86/kvm/svm/svm.h | 1 + 3 files changed, 53 insertions(+), 10 deletions(-) diff --git a/arch/x86/include/asm/sev-common.h b/arch/x86/include/asm/sev-common.h index b463fcbd4b90..01261f7054ad 100644 --- a/arch/x86/include/asm/sev-common.h +++ b/arch/x86/include/asm/sev-common.h @@ -54,8 +54,10 @@ (((unsigned long)fn) << 32)) /* AP Reset Hold */ -#define GHCB_MSR_AP_RESET_HOLD_REQ 0x006 -#define GHCB_MSR_AP_RESET_HOLD_RESP 0x007 +#define GHCB_MSR_AP_RESET_HOLD_REQ 0x006 +#define GHCB_MSR_AP_RESET_HOLD_RESP 0x007 +#define GHCB_MSR_AP_RESET_HOLD_RESULT_POS 12 +#define GHCB_MSR_AP_RESET_HOLD_RESULT_MASK GENMASK_ULL(51, 0) /* GHCB GPA Register */ #define GHCB_MSR_REG_GPA_REQ 0x012 diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index 598d78b4107f..6e31cb408dd8 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -49,6 +49,10 @@ static bool sev_es_debug_swap_enabled = true; module_param_named(debug_swap, sev_es_debug_swap_enabled, bool, 0444); static u64 sev_supported_vmsa_features; +#define AP_RESET_HOLD_NONE 0 +#define AP_RESET_HOLD_NAE_EVENT 1 +#define AP_RESET_HOLD_MSR_PROTO 2 + static u8 sev_enc_bit; static DECLARE_RWSEM(sev_deactivate_lock); static DEFINE_MUTEX(sev_bitmap_lock); @@ -2727,6 +2731,9 @@ static int sev_es_validate_vmgexit(struct vcpu_svm *svm) void sev_es_unmap_ghcb(struct vcpu_svm *svm) { + /* Clear any indication that the vCPU is in a type of AP Reset Hold */ + svm->sev_es.ap_reset_hold_type = AP_RESET_HOLD_NONE; + if (!svm->sev_es.ghcb) return; @@ -2938,6 +2945,22 @@ static int sev_handle_vmgexit_msr_protocol(struct vcpu_svm *svm) GHCB_MSR_INFO_POS); break; } + case GHCB_MSR_AP_RESET_HOLD_REQ: + svm->sev_es.ap_reset_hold_type = AP_RESET_HOLD_MSR_PROTO; + ret = kvm_emulate_ap_reset_hold(&svm->vcpu); + + /* + * Preset the result to a non-SIPI return and then only set + * the result to non-zero when delivering a SIPI. + */ + set_ghcb_msr_bits(svm, 0, + GHCB_MSR_AP_RESET_HOLD_RESULT_MASK, + GHCB_MSR_AP_RESET_HOLD_RESULT_POS); + + set_ghcb_msr_bits(svm, GHCB_MSR_AP_RESET_HOLD_RESP, + GHCB_MSR_INFO_MASK, + GHCB_MSR_INFO_POS); + break; case GHCB_MSR_TERM_REQ: { u64 reason_set, reason_code; @@ -3037,6 +3060,7 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu) ret = 1; break; case SVM_VMGEXIT_AP_HLT_LOOP: + svm->sev_es.ap_reset_hold_type = AP_RESET_HOLD_NAE_EVENT; ret = kvm_emulate_ap_reset_hold(vcpu); break; case SVM_VMGEXIT_AP_JUMP_TABLE: { @@ -3280,15 +3304,31 @@ void sev_vcpu_deliver_sipi_vector(struct kvm_vcpu *vcpu, u8 vector) return; } - /* - * Subsequent SIPI: Return from an AP Reset Hold VMGEXIT, where - * the guest will set the CS and RIP. Set SW_EXIT_INFO_2 to a - * non-zero value. - */ - if (!svm->sev_es.ghcb) - return; + /* Subsequent SIPI */ + switch (svm->sev_es.ap_reset_hold_type) { + case AP_RESET_HOLD_NAE_EVENT: + /* + * Return from an AP Reset Hold VMGEXIT, where the guest will + * set the CS and RIP. Set SW_EXIT_INFO_2 to a non-zero value. + */ + ghcb_set_sw_exit_info_2(svm->sev_es.ghcb, 1); + break; + case AP_RESET_HOLD_MSR_PROTO: + /* + * Return from an AP Reset Hold VMGEXIT, where the guest will + * set the CS and RIP. Set GHCB data field to a non-zero value. + */ + set_ghcb_msr_bits(svm, 1, + GHCB_MSR_AP_RESET_HOLD_RESULT_MASK, + GHCB_MSR_AP_RESET_HOLD_RESULT_POS); - ghcb_set_sw_exit_info_2(svm->sev_es.ghcb, 1); + set_ghcb_msr_bits(svm, GHCB_MSR_AP_RESET_HOLD_RESP, + GHCB_MSR_INFO_MASK, + GHCB_MSR_INFO_POS); + break; + default: + break; + } } struct page *snp_safe_alloc_page(struct kvm_vcpu *vcpu) diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h index 323901782547..6fd0f5862681 100644 --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -199,6 +199,7 @@ struct vcpu_sev_es_state { u8 valid_bitmap[16]; struct kvm_host_map ghcb_map; bool received_first_sipi; + unsigned int ap_reset_hold_type; /* SEV-ES scratch area support */ u64 sw_scratch; From patchwork Wed May 1 07:10:46 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Roth X-Patchwork-Id: 793836 Received: from NAM11-BN8-obe.outbound.protection.outlook.com (mail-bn8nam11on2071.outbound.protection.outlook.com [40.107.236.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7AEB84DA04; Wed, 1 May 2024 07:47:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.236.71 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714549655; cv=fail; b=odJYA6S0HEPnmRf06M9bj4L8B80wIS4u/Brah2IyXmnIGo6iReXSREUIg1WEoKoLXa0fP1sa7njgX/TY1mOTpbJ8iOe9omgiRm9+5VAHdSymRPtf6FDFhSxhLr+ay9mRA5hjavdgMDAuZGnoQs2urTxeNij7iaC4bV1VQ3oimNg= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714549655; c=relaxed/simple; bh=SWNjXMUiQ4nFwytyHo3IEl8gpMql5RSwtJdgbTqfyi4=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=QeT6V+DkDm9LIKLLE/dkZePOum8fisqibSALHcCZfQhmai5Bl3UhbUvTPxJBfe2Hd1LZrQV4mS9sbsP7wBzcV3FJKUBX4afgNx9GKT4+TKXjNTrzHKN/sW/K7dbixkpE10MOciXNur9iBJkLBvuZZbWriPJmUt0il0A/aBWsolU= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com; spf=fail smtp.mailfrom=amd.com; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b=h4UPymRT; arc=fail smtp.client-ip=40.107.236.71 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=amd.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b="h4UPymRT" ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=DMszF3FLlATSC6frTe+TXMCtCDB1s78s3cOvR2/vVBnlItfSFVA2dxSMH27SLAMm8nWyX7NUSZ/vdK8Ok8hfBdJYh6Vs9JZIzl9kZICXA694zOIEwKKjJ3slZTc6UQIi/v83eFySD7OB5bdr/hWTmeh6mvwKm6DBGZxIwOWtNWjy1RvyUrJ/shL9DX5UPjknwy1uSIeVpxY1pcRcx2OzDU9ydP2WMl0B0IQEYezls7bvWvXjuRBRGnetiTe0+84lFU6TUVPJT2eQXE1XQ8WKzbuoGl2yLHilSc7VNBCm4EeRG1Sw8BfBjVZpLTqPHhE81d8Ts6I9vOF9NtefI0Ti3A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=9iPsbHUVqfnQYObn0gY0+/pNGlt+1qkXCH3qvnDFpWw=; b=EIPrSxv//dapJ6UYk+iYGPFZ9ECVvgbLu2I3V0CnYqXtYH6d19MlVh2zsUQAum1TZT1jPKPl1if9xcyYUONxxXQCIFbzjsOfiKdIkJMpoMD8Ow7Vn1fDP77jYuplyH/ZpWGzKWPBbh+kR8CkmUzgUiAbq1DY7RrFOMU892EL26KsXBVBf5WlLO7/oWtc/j/4ecdUfstQFK/ffN2HlEceOG9rIZkwXR0Xb+tH2el7NPA4Vs2kGBZY0LU9nFZmBGSzRLFfZy0VJyLBmK2NWZoDrYOAS4H6+0xocaPTOAD7pMgOnEIpcAjGiRctJM8fiFQ/GIHP5N7xj/WtN3yNmuJpUg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=vger.kernel.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=9iPsbHUVqfnQYObn0gY0+/pNGlt+1qkXCH3qvnDFpWw=; b=h4UPymRTBoVrMvfgdEZxtmFAXdNpf9jyYNioFA8C0rEF8BV/RF9TRnvyxmSPZTcRB96NKZkew3UGw/0hGZAK8PF/8QSXPGsbF249dp1IPE4UBKwdGlRI23xo2RYyB3bDLDeOlkec7hUJUbYShSl3MKUPMj1EiMv6VF+F4wjOyl8= Received: from CY5PR22CA0092.namprd22.prod.outlook.com (2603:10b6:930:65::7) by SN7PR12MB6690.namprd12.prod.outlook.com (2603:10b6:806:272::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7519.34; Wed, 1 May 2024 07:47:30 +0000 Received: from CY4PEPF0000EE37.namprd05.prod.outlook.com (2603:10b6:930:65:cafe::7a) by CY5PR22CA0092.outlook.office365.com (2603:10b6:930:65::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7544.28 via Frontend Transport; Wed, 1 May 2024 07:47:30 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; pr=C Received: from SATLEXMB04.amd.com (165.204.84.17) by CY4PEPF0000EE37.mail.protection.outlook.com (10.167.242.43) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.7544.18 via Frontend Transport; Wed, 1 May 2024 07:47:30 +0000 Received: from localhost (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.35; Wed, 1 May 2024 02:47:29 -0500 From: Michael Roth To: CC: , , , , , , , , , , , , , Brijesh Singh Subject: [PATCH 2/4] KVM: SEV: Add GHCB handling for Hypervisor Feature Support requests Date: Wed, 1 May 2024 02:10:46 -0500 Message-ID: <20240501071048.2208265-3-michael.roth@amd.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20240501071048.2208265-1-michael.roth@amd.com> References: <20240501071048.2208265-1-michael.roth@amd.com> Precedence: bulk X-Mailing-List: linux-crypto@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-ClientProxiedBy: SATLEXMB04.amd.com (10.181.40.145) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CY4PEPF0000EE37:EE_|SN7PR12MB6690:EE_ X-MS-Office365-Filtering-Correlation-Id: ed4c0486-2ae0-40c4-37f8-08dc69b2f442 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230031|1800799015|376005|7416005|82310400014|36860700004; X-Microsoft-Antispam-Message-Info: ZkOUr4mIdgIC8ZCNd/VafdF+FM90bq+xPZGJUZpp8F9Rwc1ykHoWAP4RI9ZmXEn0bbfEZcMWAf7fBzjv83cfsP/OD0tJVy3ys0TG8rcwmqHsBQKbRjgO0bowjIxBrqqiZuRRy+WAnbZMcm1NXAGJTJ2VDDG+mWYmB3onu2co7qTobU6l6qkmY6UxHZra3QxDBUv5Jf+9Pt5vcp0AbyzGAJnYvmmob1OCXSIKRX2QiWq1uENTnQVTYQS5kyQNI1PukgD/we/+j0aM/QLqpFNPFyRc5mFT2xz/ZjdLk12w5r425FIvpd+RnueAfqELdHUv6O7qJPciL5zz2XicOVDtj0EFRnhCusBS7+LniFg8GvRs7M0AoixdDAxOJyL2AVzSOdcvVr0KnI8Ajxfpy83VilYUd+hRFHlCfY8JT2KsD4OjlIlD/LV+xQ/jTHREMFT4T7DCiJw9p7TbTxWxKr0OcqrjyLqxtEa7BslQDLzSP9MVS5TFG2Zwwt19z2C9DL4Bn5VDQKBAXIBwefkcSd/tGK94sOPRINwWdyHUJYovJiEVDGIuonxvd9JHBQGSZ0L1YjwhTZ+wDEI4vl8hQWWAKXnxwVPXgAli99mc41GWFCyPhEElHAI5WVPl/WFI5ON7NhCCwup57y0vJYDYAj2fs0arodEYEx0ybJejpMaUHsAJbyt7XFnkGPDehOV4r0z0dhaGJ6QR242WbqiXtTtqFzWt2KRGMZHboB7YYwYwNgZSRUMkOsMpAroeH+HG4BjracRrqyAgXHK7ABBIg1u9gdL+g5J4wRnf8+4vzphGPUPn1cIK4/lfQ7hVCgOoe7F4eqHfGkilHS02JzeY+31ccNw2qJrwgcWU+AXU7FQOF4FXvG1ht64sd9G3FRg0jm64xRiX1HtrAbIF69EGTNwI80orMiaficGu3236JVILX7G96uYwm759re3OXJwFV338o2l35isYzaITltrB8JX0hO5lAk7pTmKhf4sA2WMxOEz4WJE2AGl7ZIKceJYVAQqxfXjRnvh2POEvpuWCmFONA/S8mSCneyA3rARCqa8FXQ2zzdJzcrjqWrI2qUrGa1t4SqGRaivsDJRbFpbnxgZpQaYzyx4Oof6+7rWbibtQ3pJ9XXvE4A4dnE8pZHyWKqydhWNmWfXVhYo2zmlSUNOax3HIM2z+98zl73R2SboTOOtoZDAwl1fwXp/rFgSktWvmfIXWVbigeE+EsY21O5d/QVTFeHRat1bOK1rhWmfP1Y9qpqhTNrIFRhWwDC5SCviO9sJqLdHD93wP+Vqod1xxr+cptYYPsYIFq36PP71pV8u3txgfAqgmQ1s7wv+6LgKYBtx/FwxhRsEDgndflog4S9fiWFcPzlhlBS/YKbku5IM= X-Forefront-Antispam-Report: CIP:165.204.84.17; CTRY:US; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:SATLEXMB04.amd.com; PTR:InfoDomainNonexistent; CAT:NONE; SFS:(13230031)(1800799015)(376005)(7416005)(82310400014)(36860700004); DIR:OUT; SFP:1101; X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 May 2024 07:47:30.1819 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: ed4c0486-2ae0-40c4-37f8-08dc69b2f442 X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d; Ip=[165.204.84.17]; Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: CY4PEPF0000EE37.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN7PR12MB6690 From: Brijesh Singh Version 2 of the GHCB specification introduced advertisement of features that are supported by the Hypervisor. Now that KVM supports version 2 of the GHCB specification, bump the maximum supported protocol version. Signed-off-by: Brijesh Singh Signed-off-by: Ashish Kalra Signed-off-by: Michael Roth --- arch/x86/include/asm/sev-common.h | 2 ++ arch/x86/kvm/svm/sev.c | 14 ++++++++++++++ 2 files changed, 16 insertions(+) diff --git a/arch/x86/include/asm/sev-common.h b/arch/x86/include/asm/sev-common.h index 01261f7054ad..5a8246dd532f 100644 --- a/arch/x86/include/asm/sev-common.h +++ b/arch/x86/include/asm/sev-common.h @@ -101,6 +101,8 @@ enum psc_op { /* GHCB Hypervisor Feature Request/Response */ #define GHCB_MSR_HV_FT_REQ 0x080 #define GHCB_MSR_HV_FT_RESP 0x081 +#define GHCB_MSR_HV_FT_POS 12 +#define GHCB_MSR_HV_FT_MASK GENMASK_ULL(51, 0) #define GHCB_MSR_HV_FT_RESP_VAL(v) \ /* GHCBData[63:12] */ \ (((u64)(v) & GENMASK_ULL(63, 12)) >> 12) diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index 6e31cb408dd8..37d396636b71 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -36,6 +36,8 @@ #define GHCB_VERSION_MAX 1ULL #define GHCB_VERSION_MIN 1ULL +#define GHCB_HV_FT_SUPPORTED GHCB_HV_FT_SNP + /* enable/disable SEV support */ static bool sev_enabled = true; module_param_named(sev, sev_enabled, bool, 0444); @@ -2701,6 +2703,7 @@ static int sev_es_validate_vmgexit(struct vcpu_svm *svm) case SVM_VMGEXIT_AP_HLT_LOOP: case SVM_VMGEXIT_AP_JUMP_TABLE: case SVM_VMGEXIT_UNSUPPORTED_EVENT: + case SVM_VMGEXIT_HV_FEATURES: break; default: reason = GHCB_ERR_INVALID_EVENT; @@ -2961,6 +2964,12 @@ static int sev_handle_vmgexit_msr_protocol(struct vcpu_svm *svm) GHCB_MSR_INFO_MASK, GHCB_MSR_INFO_POS); break; + case GHCB_MSR_HV_FT_REQ: + set_ghcb_msr_bits(svm, GHCB_HV_FT_SUPPORTED, + GHCB_MSR_HV_FT_MASK, GHCB_MSR_HV_FT_POS); + set_ghcb_msr_bits(svm, GHCB_MSR_HV_FT_RESP, + GHCB_MSR_INFO_MASK, GHCB_MSR_INFO_POS); + break; case GHCB_MSR_TERM_REQ: { u64 reason_set, reason_code; @@ -3085,6 +3094,11 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu) ret = 1; break; } + case SVM_VMGEXIT_HV_FEATURES: + ghcb_set_sw_exit_info_2(svm->sev_es.ghcb, GHCB_HV_FT_SUPPORTED); + + ret = 1; + break; case SVM_VMGEXIT_UNSUPPORTED_EVENT: vcpu_unimpl(vcpu, "vmgexit: unsupported event - exit_info_1=%#llx, exit_info_2=%#llx\n", From patchwork Wed May 1 07:10:47 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Roth X-Patchwork-Id: 794237 Received: from NAM10-MW2-obe.outbound.protection.outlook.com (mail-mw2nam10on2069.outbound.protection.outlook.com [40.107.94.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2B5B94F207; Wed, 1 May 2024 07:47:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.94.69 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714549676; cv=fail; b=UrCQKZ2c9uY0CWPtJbKeB7+vIGA/d5I7IId74yQhXcy3G5bNiJAHJCAY+DthlJMeMviXv3iWJX2L1crdIekn7ENq7vyPd+4w5vpBQNYJzsoLq/gvzpAmbSTtLL2J2wa7J4cQ0McA+ZoUsaW1yjfwclUscL7IWS/XOuLFL3CgsuU= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714549676; c=relaxed/simple; bh=RIf79EgCG75b1hZjOiZoOe6VfRniHFi/Kye+QNJuRsY=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=f6SE5FpvBeSoa7cQdbne2Z+WR5/OuCmmjtK2CTUdSrOHbMPqX+F/AMSCgD34wkZGwioQcQcgBGKgGZB1razrtq1wMFgvgEwrITfRpkF4v+SjzE1w+aGIU1udce57glKcD2+fS0UZ7bYGQ/ja3egZgENZo0x1iuDswgcV0YrQfMI= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com; spf=fail smtp.mailfrom=amd.com; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b=LTQsaA5x; arc=fail smtp.client-ip=40.107.94.69 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=amd.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b="LTQsaA5x" ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=YSwNk2CR9NXOsFPx8u/Z0mj/3NNbNZp1QBhTusQ8+RJ3+Kxj7/cJgZKLPPwrf6fi/mRQTv/6GZX0ONF0NNxx/imnJeEENSijbb1ps5jMET11i55xu2kF6wQsl0Eyi6RhhXzIiXh0pdsek40y9gsAWV7ySG2YmTIxWgVV5w/S8Vx+BsgKHkJQ6+HMYEhF3Kw8enkRq+b0NQvjfeHhB6uQaZHRRVCliPcbsedR94DVRtQ66T0ti4Y5qQAZDacjFv3x+lPvlScfNtKi39PjK1StkzataCPcyREQwHHvtJWk/60CjmyzB2aoEJLZteJBUv9Hm5AvPlCFy9kekD6mAmzmzw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=TzzAZm9oYogXqez2TlMGxs3a+KLmFqZxsyGAqlGIiK8=; b=LS4QhWLnt8MNcM9QbitmRGtURvCZ10aeEIwy34Hcs89+3WAjX37+FwXn8HvPCZzvBAp5xdvUOUHNp+LpuEbu6c2aAHUOqzsD7UwrcCFdVMbiiEG6E1xD7uy6MhRx74wuaSHr3KVpoqsAwdRrMaWq797Som1wWgr13pePjLGca2W1hO1ZuTBbQKpWb1h0JY/6SheLmC9zxODaNZSYPEYAyayVZXnkSmZwsBqh5prxqL13NNLLBEN4He9neCW3VNKMdb2azmC8Xj20vgbmwQjxEWxIfVtNBHTlsaDHwpvbxh2+7KqkYR56Z+Hx4ET8Rc4rqWfNQSl3Sibt8fpSYum9TQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=vger.kernel.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=TzzAZm9oYogXqez2TlMGxs3a+KLmFqZxsyGAqlGIiK8=; b=LTQsaA5xvuzJo3+XLZzUZkLDWNim0Qdnp8VJlQCRbEIIAy/+H8hLWUah00zgxK84E9Bq4kjNG4w0kPEMLZssDwQwdT5/9pbvILGJOUwWgnp2xtjqjCt8COyEFUYkGF51+e/KxNk35FFSub5ZOgStvSWdtGzZ/gNRmJOz/hbV9Kw= Received: from PH7PR17CA0062.namprd17.prod.outlook.com (2603:10b6:510:325::23) by CYYPR12MB8749.namprd12.prod.outlook.com (2603:10b6:930:c6::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7519.36; Wed, 1 May 2024 07:47:51 +0000 Received: from CY4PEPF0000EE34.namprd05.prod.outlook.com (2603:10b6:510:325:cafe::79) by PH7PR17CA0062.outlook.office365.com (2603:10b6:510:325::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7544.25 via Frontend Transport; Wed, 1 May 2024 07:47:51 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; pr=C Received: from SATLEXMB04.amd.com (165.204.84.17) by CY4PEPF0000EE34.mail.protection.outlook.com (10.167.242.40) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.7544.18 via Frontend Transport; Wed, 1 May 2024 07:47:51 +0000 Received: from localhost (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.35; Wed, 1 May 2024 02:47:50 -0500 From: Michael Roth To: CC: , , , , , , , , , , , , Subject: [PATCH 3/4] KVM: SEV: Add GHCB handling for termination requests Date: Wed, 1 May 2024 02:10:47 -0500 Message-ID: <20240501071048.2208265-4-michael.roth@amd.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20240501071048.2208265-1-michael.roth@amd.com> References: <20240501071048.2208265-1-michael.roth@amd.com> Precedence: bulk X-Mailing-List: linux-crypto@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-ClientProxiedBy: SATLEXMB04.amd.com (10.181.40.145) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CY4PEPF0000EE34:EE_|CYYPR12MB8749:EE_ X-MS-Office365-Filtering-Correlation-Id: 537ed26d-c693-4ee8-4a06-08dc69b300cf X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230031|36860700004|82310400014|1800799015|7416005|376005; X-Microsoft-Antispam-Message-Info: hQWUVhX00nM+DYhxT02EUQ4ptNhKwPYJBp96864jywBy31emY60asPL2W5d285MxZD6nFd67+uMYRcSGLvmabno979x/n5xxlCZzQDDe7D2ISL3DAXucacjoLThWfxPrccABObaRFoHy66hUYhtqbHAN6a997XcFJeAOZN1B7l3dtA2lyny5fsNJTuc79E5bj86A6QrwQZaN3FrPkM2nIikScvAa2PLCRPMopqptkkf+ANrtEJoRSnkOp4UEuuMxF7o4dLSNbxaR4ee7htnrufyfsFLQ4ylKHFEV7kRmGfAEsRUJevtfqiJVh8dIA8pJUlHciLkx/bqlstE8OiDQy9HEiu6hAlpQPIvfeko26v3LtjYj9CwBOjXr0aiIMxfcskTFfBiaDGPaRH0zmeLi0FJ/S3uU0LljqA+JD41Lq/DowYg5RmeOT61mEnQhFxvkSpUsWEJitHtus3QicEnaYyzWktxS369o+1LMX3Wwtdys0AYc4NfOUtHUA1TyfZpMx6xj3ZjIk/bU3+VkVqGmYeFFpiY6oJWS8ffj3SWHqz20KJztQQYSG5q+AIOuQx+t0AYyd2zjYRRSSDzV1s/IluroXwHW2KM6XJFS6s26QB8ohqQm4/ZvvqqH8lFEAMPj3gxCnwxA28yvqag0GQ9dIptE8DhyDc7vqSdHSyeUWakdVg8NoEReg4iNaa6nB+7+B6cRFne7bw1Gsqc7NNlmyJefA23EtVBECfcB8uvHOfRshrH5zeooxKm/wd6/aQFWwuhyeUdB2urUn1tXx+0pobjIIDZoIMR+8y0PpfNwqYwkyn8aKNahT65DGmcM5i5AihoOOGf7QdC8brpZ1xIYBYBqT1cjJiK7L0op63ZAfrqxNNVzdHaoVHDYx9tjA5YLZIMLTMuN6t2N32GMNvmUtigE6gFtnf4jJjLblxFd2abP4N1r5IWhj1xqwUBSb2ic3vjTEO5R6HXZ4aOUcFkLsVIx1fXoRmYgv87j/pwg6k6qopJFOf39UD1RcKXavgW4W67VBLkcmeCd8VF7ju0ZfmffMCLAlZdPdx/YZ38Ugw9i3zKEFou0ux19lJXe3f+gCw6hnFWXjZ0nc1xQ+bY6IzgKj3bxSezstj8RmSzLBbp/vw/mtZcEBPbNlgof3UHWxB+h0/hPvt+GUYJlfZQlzRQD492eBlhirgPtPv5192+YXPgLCa72zboo7LoKO1oYan5LTNA5a6wVLB+j7fh+nSQ0NsqPBIgfqLtsz8Z1l9LUm/AtZjoIQ+kJZvdaYn7KNiUlrT8PPjZ32PTxht10lHAmNAysNU49y0je223sNmOrUo7EdwBk8rGeQI6K6ABy4C55LP5GO8rQHP4p6CJqMZsgDii97YmIUNKM6ES9/G0= X-Forefront-Antispam-Report: CIP:165.204.84.17; CTRY:US; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:SATLEXMB04.amd.com; PTR:InfoDomainNonexistent; CAT:NONE; SFS:(13230031)(36860700004)(82310400014)(1800799015)(7416005)(376005); DIR:OUT; SFP:1101; X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 May 2024 07:47:51.2162 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 537ed26d-c693-4ee8-4a06-08dc69b300cf X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d; Ip=[165.204.84.17]; Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: CY4PEPF0000EE34.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: CYYPR12MB8749 GHCB version 2 adds support for a GHCB-based termination request that a guest can issue when it reaches an error state and wishes to inform the hypervisor that it should be terminated. Implement support for that similarly to GHCB MSR-based termination requests that are already available to SEV-ES guests via earlier versions of the GHCB protocol. See 'Termination Request' in the 'Invoking VMGEXIT' section of the GHCB specification for more details. Signed-off-by: Michael Roth --- arch/x86/kvm/svm/sev.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index 37d396636b71..01baa8aa7e12 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -2704,6 +2704,7 @@ static int sev_es_validate_vmgexit(struct vcpu_svm *svm) case SVM_VMGEXIT_AP_JUMP_TABLE: case SVM_VMGEXIT_UNSUPPORTED_EVENT: case SVM_VMGEXIT_HV_FEATURES: + case SVM_VMGEXIT_TERM_REQUEST: break; default: reason = GHCB_ERR_INVALID_EVENT; @@ -3099,6 +3100,14 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu) ret = 1; break; + case SVM_VMGEXIT_TERM_REQUEST: + pr_info("SEV-ES guest requested termination: reason %#llx info %#llx\n", + control->exit_info_1, control->exit_info_2); + vcpu->run->exit_reason = KVM_EXIT_SYSTEM_EVENT; + vcpu->run->system_event.type = KVM_SYSTEM_EVENT_SEV_TERM; + vcpu->run->system_event.ndata = 1; + vcpu->run->system_event.data[0] = control->ghcb_gpa; + break; case SVM_VMGEXIT_UNSUPPORTED_EVENT: vcpu_unimpl(vcpu, "vmgexit: unsupported event - exit_info_1=%#llx, exit_info_2=%#llx\n", From patchwork Wed May 1 07:10:48 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Roth X-Patchwork-Id: 793835 Received: from NAM10-DM6-obe.outbound.protection.outlook.com (mail-dm6nam10on2069.outbound.protection.outlook.com [40.107.93.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1D3C24D9EF; Wed, 1 May 2024 07:48:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.93.69 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714549699; cv=fail; b=fRJ61eghMSGADIaa7lFQasVwo5S4mQMXYDck8ApMy45s7AU+OpE4zOouVh5RdFf2w3mqM3VnY2Xd84c5fzjgS1UDLQ7Xjl27g7/ORdcqZ3jMGVhyr8TIgo2TrgBa77Byl+hYe5+qpk1XZl4sIhA5sCNQLk5YigpYQwuZIngHL3w= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714549699; c=relaxed/simple; bh=ZPTHj1oq/Ts5Tgv+oxOM5kvyjrALP6F9dYvQjGz1Fe8=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=tEaIDxJHZ9XvPmNDvOixf8NMA3oMV8yD3V7XnoCtgTwFL5fsncT2TTOs6ZuuQVxLZt7HuEEYJBV5fsEJ/L4MpwcEGUw3P6+Fn9Y+GVr7nEgWURriw0YRwUKyAKWrim8zMIIOYMa0KkK86U90nzIus2x5/6/wBPf0ZW6eNgheSVQ= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com; spf=fail smtp.mailfrom=amd.com; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b=wem35fG/; arc=fail smtp.client-ip=40.107.93.69 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=amd.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b="wem35fG/" ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=fyYR5InUTA98zfsbk6hjFATbGzr2pJoRAP+9w7Y/ppoimVcOKv7xFVspSbbFswZlkpXF+L9imdRyfrMOQzF9Z6QYXukxJ2i57qWp3Z2CMJqRhByo1Yn3vn32N0liSrI1FvoaGo4uhMKQzCynHcIQBy8Sj7I9xqTXx9K9E+GHrFv85r9PLKkIkBwS/hNh5aOaQJpRcLP6YhUqveL/rsMtQ7zqx7g4GKN4cOaTzgXieI7KSl6f3MviQqxaUACY4QEZpEEEuvomSO2T9nVllX7PH6JdaePZ2HxQ+BFbg4hUDjW0arjQD1tOZpNk576QqJJjyysrca8BtUo0ZgI71cj0UQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=55BsZiyOriOSg+pL30Cck6KPdOkZNWZZJ/n3ehKgAlU=; b=m1AZMJsTlqgviorug54XD2mK10OyE5KPjz8h4/602vy8T4TVFlLO84falg72v/Oj2rhslVxVGQQwlPCHhLv1EmoLUaUP7p4+NHSxufjemnMCdatPfN3Yf/P2ukw3z0CkRGt8sd+Wwn1BizTFXYX+rMwLG7mANGUq9wZqxwo510Jvp8cYJapZ9k9ouHuED0EG6Wsy21QEcCGDnIPpREAcqD+inQRduR8dnuklBN/8ec5hCckkJZJqKa/I/Uciu+dvw4zDo1zoUQYBR2Q1WFXiE8p4bblsYhwWLQGdrstn2Nb1Hz+G3sMouxznLtYAud7YEsEybwArAWc7/nt3mS+mWQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=vger.kernel.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=55BsZiyOriOSg+pL30Cck6KPdOkZNWZZJ/n3ehKgAlU=; b=wem35fG/9nfcXUsfSsv5Tp75mCX/u8hZE+Gp1wdnTKR6pJhy3xI/p0zqyf/coOpBPkvORmzB3aFYrM0aWEMD3NrBdSvO4/XWAaZ2yqM78Q35TdalM9Xk461WJwu92LTJK+KLZq9gDK3Q5LhsPn2v6VntqFN6NMJkt+IOJ28KTqA= Received: from PH8PR22CA0014.namprd22.prod.outlook.com (2603:10b6:510:2d1::29) by SJ0PR12MB8140.namprd12.prod.outlook.com (2603:10b6:a03:4e3::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7544.24; Wed, 1 May 2024 07:48:15 +0000 Received: from CY4PEPF0000EE33.namprd05.prod.outlook.com (2603:10b6:510:2d1:cafe::cb) by PH8PR22CA0014.outlook.office365.com (2603:10b6:510:2d1::29) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7519.36 via Frontend Transport; Wed, 1 May 2024 07:48:15 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; pr=C Received: from SATLEXMB04.amd.com (165.204.84.17) by CY4PEPF0000EE33.mail.protection.outlook.com (10.167.242.39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.7544.18 via Frontend Transport; Wed, 1 May 2024 07:48:15 +0000 Received: from localhost (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.35; Wed, 1 May 2024 02:48:14 -0500 From: Michael Roth To: CC: , , , , , , , , , , , , Subject: [PATCH 4/4] KVM: SEV: Allow per-guest configuration of GHCB protocol version Date: Wed, 1 May 2024 02:10:48 -0500 Message-ID: <20240501071048.2208265-5-michael.roth@amd.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20240501071048.2208265-1-michael.roth@amd.com> References: <20240501071048.2208265-1-michael.roth@amd.com> Precedence: bulk X-Mailing-List: linux-crypto@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-ClientProxiedBy: SATLEXMB04.amd.com (10.181.40.145) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CY4PEPF0000EE33:EE_|SJ0PR12MB8140:EE_ X-MS-Office365-Filtering-Correlation-Id: 023a83b1-0973-441b-3f7b-08dc69b30f0c X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230031|36860700004|82310400014|7416005|1800799015|376005; X-Microsoft-Antispam-Message-Info: pzZ1EN6QItJAEJcltyx1edNlp74kPRg5fEC6R5QlMziJ/lAELVDtDl3bFjPluPQpHVlBVPBWyeb5Lo4jxeJcM+DoDyA1F9dt10O2DkHXWih0jnkQY76IhRcflDCC9F7YHLO9FZmE6EX1O256mCHh0TvzqpefwtUsiejrMXn1RysSUpNjdrpjpXUkWzm8xoXHXPYR/bAFgla1VNxb/nz/c0Cot/EfWEsTfZh3+Ak5vW3NjrF2pPnH4SyNpqNeDdDDbhCrYWIFm2tH2ekKNs5D37VhCJO2TbA8XhR8nmz7qddbqeZcK6L+fFO2hzjTX8q5Y+EIW4v+4OQagIbuEB/SoTdSKH4McYH46WaB7Hn137GlTGX3S46Uj6kaH014ioCan0LLqesJoHxahSAa6xr7CHFkPjIzUG6ps6ogWHvyjh0nX8CqLpwEZWdB/E3oYUBqyFsBge5u7oOQc88CGJ8XT7FWVt+Yms+udb98+2LmMvWqdv9C8P5ndf9kz7hfP2Q0LsTal20eDuczOVfi4FcjDzT7datPSRlAgb+8hwHiHLXuntG7cLc9i9eW5mZ+/LOPF46QWMy0TpRQx7oFVtkcq1QDWeU5fSuxcWRtWaqTZdf1VJgxVnCfRH9pVcw+XLV4o8EBUXwlNbJB+ppnmvqkEo8ZCRMjT7fEVDDj7H5NvXo98Uj4SGsaTx4G7HM5LnuC9abqHwJs0h3q5pSyHnfuP+j+sRARee+JBGdTUluvwUVmvfbEY4lH++mT5oVyhvRYdSeAQPywL+DjoW9hTnWcBcuvhNdU+vAq4ZNCJr2x5wn+m16ZcgYmLF0DI50nQXMTHs7j3BHPY3KCwtyXanXwtSoKfecBMhHjHI7p8NaWR/Vv9BBotOfDJl1vgfPb8ltC7BxLb2MM4uhqt+/nR1uVZTbxNBqEbSK7LPmj6/BpJoLTpU9YwryEVLXaN0LIUrsEqOB6mdOpCYIp1XuWrBNkM6M0tW+fNI2+wqaRTC2bIb60qa5zKKIdifUWdINDAKqVGAd4nqtHK0o57g06X8uQD/fseyucuXxQC7duc/Cur8rxPuSL9n8kaEdSXu2v4ntC0g8Xll1x86VjrTKCcrS8E4ohbigK6i2OZegPongy9O0wN9FyZNebVQp+yFFfvcMp+aalyReDPF3w675pRK+nWuOEnruTq8Wofi+C9h5z1ZbkByEMFiA6HnErD0stnELav51l+l9Zc2UvRNCMZhxmeTSLKoLykdzS+YKguVXuGlQ7J6iGdNmvAULk0ZlvJeB1imgiEbUEWSunNVmBYoBQ4Y6yTV+LAWC5fbEE56WPyEq7LdBTqqvxhTEF1JKJBaY6sgcYZKc0EZSDBUXPIPkFZoAq2Cqx3RJurS+Eu1Mcpg3XFDG8skEhyQOLOHO/BmUw X-Forefront-Antispam-Report: CIP:165.204.84.17; CTRY:US; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:SATLEXMB04.amd.com; PTR:InfoDomainNonexistent; CAT:NONE; SFS:(13230031)(36860700004)(82310400014)(7416005)(1800799015)(376005); DIR:OUT; SFP:1101; X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 May 2024 07:48:15.1213 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 023a83b1-0973-441b-3f7b-08dc69b30f0c X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d; Ip=[165.204.84.17]; Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: CY4PEPF0000EE33.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR12MB8140 The GHCB protocol version may be different from one guest to the next. Add a field to track it for each KVM instance and extend KVM_SEV_INIT2 to allow it to be configured by userspace. Now that all SEV-ES support for GHCB protocol version 2 is in place, go ahead and default to it when creating SEV-ES guests through the new KVM_SEV_INIT2 interface. Keep the older KVM_SEV_ES_INIT interface restricted to GHCB protocol version 1. Suggested-by: Sean Christopherson Signed-off-by: Michael Roth --- .../virt/kvm/x86/amd-memory-encryption.rst | 11 +++++-- arch/x86/include/uapi/asm/kvm.h | 4 ++- arch/x86/kvm/svm/sev.c | 32 +++++++++++++++++-- arch/x86/kvm/svm/svm.h | 1 + 4 files changed, 42 insertions(+), 6 deletions(-) diff --git a/Documentation/virt/kvm/x86/amd-memory-encryption.rst b/Documentation/virt/kvm/x86/amd-memory-encryption.rst index 3381556d596d..9677a0714a39 100644 --- a/Documentation/virt/kvm/x86/amd-memory-encryption.rst +++ b/Documentation/virt/kvm/x86/amd-memory-encryption.rst @@ -95,13 +95,19 @@ Returns: 0 on success, -negative on error struct kvm_sev_init { __u64 vmsa_features; /* initial value of features field in VMSA */ __u32 flags; /* must be 0 */ - __u32 pad[9]; + __u16 ghcb_version; /* maximum guest GHCB version allowed */ + __u16 pad1; + __u32 pad2[8]; }; It is an error if the hypervisor does not support any of the bits that are set in ``flags`` or ``vmsa_features``. ``vmsa_features`` must be 0 for SEV virtual machines, as they do not have a VMSA. +``ghcb_version`` must be 0 for SEV virtual machines, as they do not issue GHCB +requests. If ``ghcb_version`` is 0 for any other guest type, then the maximum +allowed guest GHCB protocol will default to version 2. + This command replaces the deprecated KVM_SEV_INIT and KVM_SEV_ES_INIT commands. The commands did not have any parameters (the ```data``` field was unused) and only work for the KVM_X86_DEFAULT_VM machine type (0). @@ -112,7 +118,8 @@ They behave as if: KVM_SEV_ES_INIT * the ``flags`` and ``vmsa_features`` fields of ``struct kvm_sev_init`` are - set to zero + set to zero, and ``ghcb_version`` is set to 0 for KVM_SEV_INIT and 1 for + KVM_SEV_ES_INIT. If the ``KVM_X86_SEV_VMSA_FEATURES`` attribute does not exist, the hypervisor only supports KVM_SEV_INIT and KVM_SEV_ES_INIT. In that case, note that KVM_SEV_ES_INIT diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kvm.h index 72ad5ace118d..9fae1b73b529 100644 --- a/arch/x86/include/uapi/asm/kvm.h +++ b/arch/x86/include/uapi/asm/kvm.h @@ -711,7 +711,9 @@ struct kvm_sev_cmd { struct kvm_sev_init { __u64 vmsa_features; __u32 flags; - __u32 pad[9]; + __u16 ghcb_version; + __u16 pad1; + __u32 pad2[8]; }; struct kvm_sev_launch_start { diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index 01baa8aa7e12..a4bde1193b92 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -33,7 +33,8 @@ #include "cpuid.h" #include "trace.h" -#define GHCB_VERSION_MAX 1ULL +#define GHCB_VERSION_MAX 2ULL +#define GHCB_VERSION_DEFAULT 2ULL #define GHCB_VERSION_MIN 1ULL #define GHCB_HV_FT_SUPPORTED GHCB_HV_FT_SNP @@ -268,12 +269,24 @@ static int __sev_guest_init(struct kvm *kvm, struct kvm_sev_cmd *argp, if (data->vmsa_features & ~valid_vmsa_features) return -EINVAL; + if (data->ghcb_version > GHCB_VERSION_MAX || (!es_active && data->ghcb_version)) + return -EINVAL; + if (unlikely(sev->active)) return -EINVAL; sev->active = true; sev->es_active = es_active; sev->vmsa_features = data->vmsa_features; + sev->ghcb_version = data->ghcb_version; + + /* + * Currently KVM supports the full range of mandatory features defined + * by version 2 of the GHCB protocol, so default to that for SEV-ES + * guests created via KVM_SEV_INIT2. + */ + if (sev->es_active && !sev->ghcb_version) + sev->ghcb_version = GHCB_VERSION_DEFAULT; ret = sev_asid_new(sev); if (ret) @@ -307,6 +320,7 @@ static int sev_guest_init(struct kvm *kvm, struct kvm_sev_cmd *argp) { struct kvm_sev_init data = { .vmsa_features = 0, + .ghcb_version = 0, }; unsigned long vm_type; @@ -314,6 +328,14 @@ static int sev_guest_init(struct kvm *kvm, struct kvm_sev_cmd *argp) return -EINVAL; vm_type = (argp->id == KVM_SEV_INIT ? KVM_X86_SEV_VM : KVM_X86_SEV_ES_VM); + + /* + * KVM_SEV_ES_INIT has been deprecated by KVM_SEV_INIT2, so it will + * continue to only ever support the minimal GHCB protocol version. + */ + if (vm_type == KVM_X86_SEV_ES_VM) + data.ghcb_version = GHCB_VERSION_MIN; + return __sev_guest_init(kvm, argp, &data, vm_type); } @@ -2897,6 +2919,7 @@ static int sev_handle_vmgexit_msr_protocol(struct vcpu_svm *svm) { struct vmcb_control_area *control = &svm->vmcb->control; struct kvm_vcpu *vcpu = &svm->vcpu; + struct kvm_sev_info *sev = &to_kvm_svm(vcpu->kvm)->sev_info; u64 ghcb_info; int ret = 1; @@ -2907,7 +2930,7 @@ static int sev_handle_vmgexit_msr_protocol(struct vcpu_svm *svm) switch (ghcb_info) { case GHCB_MSR_SEV_INFO_REQ: - set_ghcb_msr(svm, GHCB_MSR_SEV_INFO(GHCB_VERSION_MAX, + set_ghcb_msr(svm, GHCB_MSR_SEV_INFO((__u64)sev->ghcb_version, GHCB_VERSION_MIN, sev_enc_bit)); break; @@ -3268,11 +3291,14 @@ void sev_init_vmcb(struct vcpu_svm *svm) void sev_es_vcpu_reset(struct vcpu_svm *svm) { + struct kvm_vcpu *vcpu = &svm->vcpu; + struct kvm_sev_info *sev = &to_kvm_svm(vcpu->kvm)->sev_info; + /* * Set the GHCB MSR value as per the GHCB specification when emulating * vCPU RESET for an SEV-ES guest. */ - set_ghcb_msr(svm, GHCB_MSR_SEV_INFO(GHCB_VERSION_MAX, + set_ghcb_msr(svm, GHCB_MSR_SEV_INFO((__u64)sev->ghcb_version, GHCB_VERSION_MIN, sev_enc_bit)); } diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h index 6fd0f5862681..9ae0c57c7d20 100644 --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -87,6 +87,7 @@ struct kvm_sev_info { struct list_head regions_list; /* List of registered regions */ u64 ap_jump_table; /* SEV-ES AP Jump Table address */ u64 vmsa_features; + u16 ghcb_version; /* Highest guest GHCB protocol version allowed */ struct kvm *enc_context_owner; /* Owner of copied encryption context */ struct list_head mirror_vms; /* List of VMs mirroring */ struct list_head mirror_entry; /* Use as a list entry of mirrors */