Commit ac5c4802 authored by Paolo Bonzini's avatar Paolo Bonzini
Browse files

KVM: SEV: publish supported VMSA features 



Compute the set of features to be stored in the VMSA when KVM is
initialized; move it from there into kvm_sev_info when SEV is initialized,
and then into the initial VMSA.

The new variable can then be used to return the set of supported features
to userspace, via the KVM_GET_DEVICE_ATTR ioctl.

Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Reviewed-by: default avatarIsaku Yamahata <isaku.yamahata@intel.com>
Message-ID: <20240404121327.3107131-6-pbonzini@redhat.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent 546d714b

Documentation/virt/kvm/x86/amd-memory-encryption.rst

+12 −0
Original line number Diff line number Diff line
@@ -425,6 +425,18 @@ issued by the hypervisor to make the guest ready for execution. 


Returns: 0 on success, -negative on error



Device attribute API

====================



Attributes of the SEV implementation can be retrieved through the

``KVM_HAS_DEVICE_ATTR`` and ``KVM_GET_DEVICE_ATTR`` ioctls on the ``/dev/kvm``

device node, using group ``KVM_X86_GRP_SEV``.



Currently only one attribute is implemented:



* ``KVM_X86_SEV_VMSA_FEATURES``: return the set of all bits that

  are accepted in the ``vmsa_features`` of ``KVM_SEV_INIT2``.



Firmware Management

===================

arch/x86/include/uapi/asm/kvm.h

+7 −2
Original line number Diff line number Diff line
@@ -457,9 +457,14 @@ struct kvm_sync_regs { 


#define KVM_STATE_VMX_PREEMPTION_TIMER_DEADLINE	0x00000001



/* attributes for system fd (group 0) */

/* vendor-independent attributes for system fd (group 0) */

#define KVM_X86_GRP_SYSTEM		0

#  define KVM_X86_XCOMP_GUEST_SUPP	0



/* vendor-specific groups and attributes for system fd */

#define KVM_X86_GRP_SEV			1

#  define KVM_X86_SEV_VMSA_FEATURES	0



struct kvm_vmx_nested_state_data {

	__u8 vmcs12[KVM_STATE_NESTED_VMX_VMCS_SIZE];

	__u8 shadow_vmcs12[KVM_STATE_NESTED_VMX_VMCS_SIZE];

arch/x86/kvm/svm/sev.c

+22 −2
Original line number Diff line number Diff line
@@ -46,6 +46,7 @@ module_param_named(sev_es, sev_es_enabled, bool, 0444); 
/* enable/disable SEV-ES DebugSwap support */

static bool sev_es_debug_swap_enabled = false;

module_param_named(debug_swap, sev_es_debug_swap_enabled, bool, 0444);

static u64 sev_supported_vmsa_features;



static u8 sev_enc_bit;

static DECLARE_RWSEM(sev_deactivate_lock);
@@ -603,8 +604,8 @@ static int sev_es_sync_vmsa(struct vcpu_svm *svm) 
	save->xss  = svm->vcpu.arch.ia32_xss;

	save->dr6  = svm->vcpu.arch.dr6;



	if (sev_es_debug_swap_enabled) {

		save->sev_features |= SVM_SEV_FEAT_DEBUG_SWAP;

	if (sev_supported_vmsa_features) {

		save->sev_features = sev_supported_vmsa_features;

		pr_warn_once("Enabling DebugSwap with KVM_SEV_ES_INIT. "

			     "This will not work starting with Linux 6.10\n");

	}
@@ -1843,6 +1844,21 @@ int sev_vm_move_enc_context_from(struct kvm *kvm, unsigned int source_fd) 
	return ret;

}



int sev_dev_get_attr(u32 group, u64 attr, u64 *val)

{

	if (group != KVM_X86_GRP_SEV)

		return -ENXIO;



	switch (attr) {

	case KVM_X86_SEV_VMSA_FEATURES:

		*val = sev_supported_vmsa_features;

		return 0;



	default:

		return -ENXIO;

	}

}



int sev_mem_enc_ioctl(struct kvm *kvm, void __user *argp)

{

	struct kvm_sev_cmd sev_cmd;
@@ -2275,6 +2291,10 @@ void __init sev_hardware_setup(void) 
	if (!sev_es_enabled || !cpu_feature_enabled(X86_FEATURE_DEBUG_SWAP) ||

	    !cpu_feature_enabled(X86_FEATURE_NO_NESTED_DATA_BP))

		sev_es_debug_swap_enabled = false;



	sev_supported_vmsa_features = 0;

	if (sev_es_debug_swap_enabled)

		sev_supported_vmsa_features |= SVM_SEV_FEAT_DEBUG_SWAP;

}



void sev_hardware_unsetup(void)

arch/x86/kvm/svm/svm.c

+1 −0
Original line number Diff line number Diff line
@@ -5026,6 +5026,7 @@ static struct kvm_x86_ops svm_x86_ops __initdata = { 
#endif



#ifdef CONFIG_KVM_AMD_SEV

	.dev_get_attr = sev_dev_get_attr,

	.mem_enc_ioctl = sev_mem_enc_ioctl,

	.mem_enc_register_region = sev_mem_enc_register_region,

	.mem_enc_unregister_region = sev_mem_enc_unregister_region,

arch/x86/kvm/svm/svm.h

+2 −0
Original line number Diff line number Diff line
@@ -692,6 +692,7 @@ void __init sev_set_cpu_caps(void); 
void __init sev_hardware_setup(void);

void sev_hardware_unsetup(void);

int sev_cpu_init(struct svm_cpu_data *sd);

int sev_dev_get_attr(u32 group, u64 attr, u64 *val);

extern unsigned int max_sev_asid;

#else

static inline struct page *snp_safe_alloc_page(struct kvm_vcpu *vcpu) {
@@ -704,6 +705,7 @@ static inline void __init sev_set_cpu_caps(void) {} 
static inline void __init sev_hardware_setup(void) {}

static inline void sev_hardware_unsetup(void) {}

static inline int sev_cpu_init(struct svm_cpu_data *sd) { return 0; }

static inline int sev_dev_get_attr(u32 group, u64 attr, u64 *val) { return -ENXIO; }

#define max_sev_asid 0

#endif