Commit bbe10a5c authored by Paolo Bonzini's avatar Paolo Bonzini
Browse files

Merge branch 'kvm-sev-es-ghcbv2' into HEAD 

While the main additions from GHCB protocol version 1 to version 2
revolve mostly around SEV-SNP support, there are a number of changes
applicable to SEV-ES guests as well. Pluck a handful patches from the
SNP hypervisor patchset for GHCB-related changes that are also applicable
to SEV-ES.  A KVM_SEV_INIT2 field lets userspace can control the maximum
GHCB protocol version advertised to guests and manage compatibility
across kernels/versions.
parents f3650842 4af663c2

Documentation/virt/kvm/x86/amd-memory-encryption.rst

+9 −2
Original line number Diff line number Diff line
@@ -95,13 +95,19 @@ Returns: 0 on success, -negative on error 
        struct kvm_sev_init {

                __u64 vmsa_features;  /* initial value of features field in VMSA */

                __u32 flags;          /* must be 0 */

                __u32 pad[9];

                __u16 ghcb_version;   /* maximum guest GHCB version allowed */

                __u16 pad1;

                __u32 pad2[8];

        };



It is an error if the hypervisor does not support any of the bits that

are set in ``flags`` or ``vmsa_features``.  ``vmsa_features`` must be

0 for SEV virtual machines, as they do not have a VMSA.



``ghcb_version`` must be 0 for SEV virtual machines, as they do not issue GHCB

requests. If ``ghcb_version`` is 0 for any other guest type, then the maximum

allowed guest GHCB protocol will default to version 2.



This command replaces the deprecated KVM_SEV_INIT and KVM_SEV_ES_INIT commands.

The commands did not have any parameters (the ```data``` field was unused) and

only work for the KVM_X86_DEFAULT_VM machine type (0).
@@ -112,7 +118,8 @@ They behave as if: 
  KVM_SEV_ES_INIT



* the ``flags`` and ``vmsa_features`` fields of ``struct kvm_sev_init`` are

  set to zero

  set to zero, and ``ghcb_version`` is set to 0 for KVM_SEV_INIT and 1 for

  KVM_SEV_ES_INIT.



If the ``KVM_X86_SEV_VMSA_FEATURES`` attribute does not exist, the hypervisor only

supports KVM_SEV_INIT and KVM_SEV_ES_INIT.  In that case, note that KVM_SEV_ES_INIT

arch/x86/include/asm/sev-common.h

+6 −2
Original line number Diff line number Diff line
@@ -56,6 +56,8 @@ 
/* AP Reset Hold */

#define GHCB_MSR_AP_RESET_HOLD_REQ		0x006

#define GHCB_MSR_AP_RESET_HOLD_RESP		0x007

#define GHCB_MSR_AP_RESET_HOLD_RESULT_POS	12

#define GHCB_MSR_AP_RESET_HOLD_RESULT_MASK	GENMASK_ULL(51, 0)



/* GHCB GPA Register */

#define GHCB_MSR_REG_GPA_REQ		0x012
@@ -99,6 +101,8 @@ enum psc_op { 
/* GHCB Hypervisor Feature Request/Response */

#define GHCB_MSR_HV_FT_REQ		0x080

#define GHCB_MSR_HV_FT_RESP		0x081

#define GHCB_MSR_HV_FT_POS		12

#define GHCB_MSR_HV_FT_MASK		GENMASK_ULL(51, 0)

#define GHCB_MSR_HV_FT_RESP_VAL(v)			\

	/* GHCBData[63:12] */				\

	(((u64)(v) & GENMASK_ULL(63, 12)) >> 12)

arch/x86/include/uapi/asm/kvm.h

+3 −1
Original line number Diff line number Diff line
@@ -711,7 +711,9 @@ struct kvm_sev_cmd { 
struct kvm_sev_init {

	__u64 vmsa_features;

	__u32 flags;

	__u32 pad[9];

	__u16 ghcb_version;

	__u16 pad1;

	__u32 pad2[8];

};



struct kvm_sev_launch_start {

arch/x86/kvm/svm/sev.c

+100 −11
Original line number Diff line number Diff line
@@ -33,9 +33,12 @@ 
#include "cpuid.h"

#include "trace.h"



#define GHCB_VERSION_MAX	1ULL

#define GHCB_VERSION_MAX	2ULL

#define GHCB_VERSION_DEFAULT	2ULL

#define GHCB_VERSION_MIN	1ULL



#define GHCB_HV_FT_SUPPORTED	GHCB_HV_FT_SNP



/* enable/disable SEV support */

static bool sev_enabled = true;

module_param_named(sev, sev_enabled, bool, 0444);
@@ -49,6 +52,10 @@ static bool sev_es_debug_swap_enabled = true; 
module_param_named(debug_swap, sev_es_debug_swap_enabled, bool, 0444);

static u64 sev_supported_vmsa_features;



#define AP_RESET_HOLD_NONE		0

#define AP_RESET_HOLD_NAE_EVENT		1

#define AP_RESET_HOLD_MSR_PROTO		2



static u8 sev_enc_bit;

static DECLARE_RWSEM(sev_deactivate_lock);

static DEFINE_MUTEX(sev_bitmap_lock);
@@ -262,12 +269,24 @@ static int __sev_guest_init(struct kvm *kvm, struct kvm_sev_cmd *argp, 
	if (data->vmsa_features & ~valid_vmsa_features)

		return -EINVAL;



	if (data->ghcb_version > GHCB_VERSION_MAX || (!es_active && data->ghcb_version))

		return -EINVAL;



	if (unlikely(sev->active))

		return -EINVAL;



	sev->active = true;

	sev->es_active = es_active;

	sev->vmsa_features = data->vmsa_features;

	sev->ghcb_version = data->ghcb_version;



	/*

	 * Currently KVM supports the full range of mandatory features defined

	 * by version 2 of the GHCB protocol, so default to that for SEV-ES

	 * guests created via KVM_SEV_INIT2.

	 */

	if (sev->es_active && !sev->ghcb_version)

		sev->ghcb_version = GHCB_VERSION_DEFAULT;



	ret = sev_asid_new(sev);

	if (ret)
@@ -301,6 +320,7 @@ static int sev_guest_init(struct kvm *kvm, struct kvm_sev_cmd *argp) 
{

	struct kvm_sev_init data = {

		.vmsa_features = 0,

		.ghcb_version = 0,

	};

	unsigned long vm_type;
@@ -308,6 +328,14 @@ static int sev_guest_init(struct kvm *kvm, struct kvm_sev_cmd *argp) 
		return -EINVAL;



	vm_type = (argp->id == KVM_SEV_INIT ? KVM_X86_SEV_VM : KVM_X86_SEV_ES_VM);



	/*

	 * KVM_SEV_ES_INIT has been deprecated by KVM_SEV_INIT2, so it will

	 * continue to only ever support the minimal GHCB protocol version.

	 */

	if (vm_type == KVM_X86_SEV_ES_VM)

		data.ghcb_version = GHCB_VERSION_MIN;



	return __sev_guest_init(kvm, argp, &data, vm_type);

}
@@ -2697,6 +2725,8 @@ static int sev_es_validate_vmgexit(struct vcpu_svm *svm) 
	case SVM_VMGEXIT_AP_HLT_LOOP:

	case SVM_VMGEXIT_AP_JUMP_TABLE:

	case SVM_VMGEXIT_UNSUPPORTED_EVENT:

	case SVM_VMGEXIT_HV_FEATURES:

	case SVM_VMGEXIT_TERM_REQUEST:

		break;

	default:

		reason = GHCB_ERR_INVALID_EVENT;
@@ -2727,6 +2757,9 @@ static int sev_es_validate_vmgexit(struct vcpu_svm *svm) 


void sev_es_unmap_ghcb(struct vcpu_svm *svm)

{

	/* Clear any indication that the vCPU is in a type of AP Reset Hold */

	svm->sev_es.ap_reset_hold_type = AP_RESET_HOLD_NONE;



	if (!svm->sev_es.ghcb)

		return;
@@ -2886,6 +2919,7 @@ static int sev_handle_vmgexit_msr_protocol(struct vcpu_svm *svm) 
{

	struct vmcb_control_area *control = &svm->vmcb->control;

	struct kvm_vcpu *vcpu = &svm->vcpu;

	struct kvm_sev_info *sev = &to_kvm_svm(vcpu->kvm)->sev_info;

	u64 ghcb_info;

	int ret = 1;
@@ -2896,7 +2930,7 @@ static int sev_handle_vmgexit_msr_protocol(struct vcpu_svm *svm) 


	switch (ghcb_info) {

	case GHCB_MSR_SEV_INFO_REQ:

		set_ghcb_msr(svm, GHCB_MSR_SEV_INFO(GHCB_VERSION_MAX,

		set_ghcb_msr(svm, GHCB_MSR_SEV_INFO((__u64)sev->ghcb_version,

						    GHCB_VERSION_MIN,

						    sev_enc_bit));

		break;
@@ -2938,6 +2972,28 @@ static int sev_handle_vmgexit_msr_protocol(struct vcpu_svm *svm) 
				  GHCB_MSR_INFO_POS);

		break;

	}

	case GHCB_MSR_AP_RESET_HOLD_REQ:

		svm->sev_es.ap_reset_hold_type = AP_RESET_HOLD_MSR_PROTO;

		ret = kvm_emulate_ap_reset_hold(&svm->vcpu);



		/*

		 * Preset the result to a non-SIPI return and then only set

		 * the result to non-zero when delivering a SIPI.

		 */

		set_ghcb_msr_bits(svm, 0,

				  GHCB_MSR_AP_RESET_HOLD_RESULT_MASK,

				  GHCB_MSR_AP_RESET_HOLD_RESULT_POS);



		set_ghcb_msr_bits(svm, GHCB_MSR_AP_RESET_HOLD_RESP,

				  GHCB_MSR_INFO_MASK,

				  GHCB_MSR_INFO_POS);

		break;

	case GHCB_MSR_HV_FT_REQ:

		set_ghcb_msr_bits(svm, GHCB_HV_FT_SUPPORTED,

				  GHCB_MSR_HV_FT_MASK, GHCB_MSR_HV_FT_POS);

		set_ghcb_msr_bits(svm, GHCB_MSR_HV_FT_RESP,

				  GHCB_MSR_INFO_MASK, GHCB_MSR_INFO_POS);

		break;

	case GHCB_MSR_TERM_REQ: {

		u64 reason_set, reason_code;
@@ -3037,6 +3093,7 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu) 
		ret = 1;

		break;

	case SVM_VMGEXIT_AP_HLT_LOOP:

		svm->sev_es.ap_reset_hold_type = AP_RESET_HOLD_NAE_EVENT;

		ret = kvm_emulate_ap_reset_hold(vcpu);

		break;

	case SVM_VMGEXIT_AP_JUMP_TABLE: {
@@ -3061,6 +3118,19 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu) 
		ret = 1;

		break;

	}

	case SVM_VMGEXIT_HV_FEATURES:

		ghcb_set_sw_exit_info_2(svm->sev_es.ghcb, GHCB_HV_FT_SUPPORTED);



		ret = 1;

		break;

	case SVM_VMGEXIT_TERM_REQUEST:

		pr_info("SEV-ES guest requested termination: reason %#llx info %#llx\n",

			control->exit_info_1, control->exit_info_2);

		vcpu->run->exit_reason = KVM_EXIT_SYSTEM_EVENT;

		vcpu->run->system_event.type = KVM_SYSTEM_EVENT_SEV_TERM;

		vcpu->run->system_event.ndata = 1;

		vcpu->run->system_event.data[0] = control->ghcb_gpa;

		break;

	case SVM_VMGEXIT_UNSUPPORTED_EVENT:

		vcpu_unimpl(vcpu,

			    "vmgexit: unsupported event - exit_info_1=%#llx, exit_info_2=%#llx\n",
@@ -3221,11 +3291,14 @@ void sev_init_vmcb(struct vcpu_svm *svm) 


void sev_es_vcpu_reset(struct vcpu_svm *svm)

{

	struct kvm_vcpu *vcpu = &svm->vcpu;

	struct kvm_sev_info *sev = &to_kvm_svm(vcpu->kvm)->sev_info;



	/*

	 * Set the GHCB MSR value as per the GHCB specification when emulating

	 * vCPU RESET for an SEV-ES guest.

	 */

	set_ghcb_msr(svm, GHCB_MSR_SEV_INFO(GHCB_VERSION_MAX,

	set_ghcb_msr(svm, GHCB_MSR_SEV_INFO((__u64)sev->ghcb_version,

					    GHCB_VERSION_MIN,

					    sev_enc_bit));

}
@@ -3280,15 +3353,31 @@ void sev_vcpu_deliver_sipi_vector(struct kvm_vcpu *vcpu, u8 vector) 
		return;

	}



	/* Subsequent SIPI */

	switch (svm->sev_es.ap_reset_hold_type) {

	case AP_RESET_HOLD_NAE_EVENT:

		/*

	 * Subsequent SIPI: Return from an AP Reset Hold VMGEXIT, where

	 * the guest will set the CS and RIP. Set SW_EXIT_INFO_2 to a

	 * non-zero value.

		 * Return from an AP Reset Hold VMGEXIT, where the guest will

		 * set the CS and RIP. Set SW_EXIT_INFO_2 to a non-zero value.

		 */

	if (!svm->sev_es.ghcb)

		return;



		ghcb_set_sw_exit_info_2(svm->sev_es.ghcb, 1);

		break;

	case AP_RESET_HOLD_MSR_PROTO:

		/*

		 * Return from an AP Reset Hold VMGEXIT, where the guest will

		 * set the CS and RIP. Set GHCB data field to a non-zero value.

		 */

		set_ghcb_msr_bits(svm, 1,

				  GHCB_MSR_AP_RESET_HOLD_RESULT_MASK,

				  GHCB_MSR_AP_RESET_HOLD_RESULT_POS);



		set_ghcb_msr_bits(svm, GHCB_MSR_AP_RESET_HOLD_RESP,

				  GHCB_MSR_INFO_MASK,

				  GHCB_MSR_INFO_POS);

		break;

	default:

		break;

	}

}



struct page *snp_safe_alloc_page(struct kvm_vcpu *vcpu)

arch/x86/kvm/svm/svm.h

+2 −0
Original line number Diff line number Diff line
@@ -87,6 +87,7 @@ struct kvm_sev_info { 
	struct list_head regions_list;  /* List of registered regions */

	u64 ap_jump_table;	/* SEV-ES AP Jump Table address */

	u64 vmsa_features;

	u16 ghcb_version;	/* Highest guest GHCB protocol version allowed */

	struct kvm *enc_context_owner; /* Owner of copied encryption context */

	struct list_head mirror_vms; /* List of VMs mirroring */

	struct list_head mirror_entry; /* Use as a list entry of mirrors */
@@ -199,6 +200,7 @@ struct vcpu_sev_es_state { 
	u8 valid_bitmap[16];

	struct kvm_host_map ghcb_map;

	bool received_first_sipi;

	unsigned int ap_reset_hold_type;



	/* SEV-ES scratch area support */

	u64 sw_scratch;