The KVM_SNP_INIT command is used by the hypervisor to initialize the SEV-SNP platform context. In a typical workflow, this command should be the first command issued. When creating SEV-SNP guest, the VMM must use this command instead of the KVM_SEV_INIT or KVM_SEV_ES_INIT. Cc: Thomas Gleixner <tglx@xxxxxxxxxxxxx> Cc: Ingo Molnar <mingo@xxxxxxxxxx> Cc: Borislav Petkov <bp@xxxxxxxxx> Cc: Joerg Roedel <jroedel@xxxxxxx> Cc: "H. Peter Anvin" <hpa@xxxxxxxxx> Cc: Tony Luck <tony.luck@xxxxxxxxx> Cc: Dave Hansen <dave.hansen@xxxxxxxxx> Cc: "Peter Zijlstra (Intel)" <peterz@xxxxxxxxxxxxx> Cc: Paolo Bonzini <pbonzini@xxxxxxxxxx> Cc: Tom Lendacky <thomas.lendacky@xxxxxxx> Cc: David Rientjes <rientjes@xxxxxxxxxx> Cc: Sean Christopherson <seanjc@xxxxxxxxxx> Cc: Vitaly Kuznetsov <vkuznets@xxxxxxxxxx> Cc: Wanpeng Li <wanpengli@xxxxxxxxxxx> Cc: Jim Mattson <jmattson@xxxxxxxxxx> Cc: x86@xxxxxxxxxx Cc: kvm@xxxxxxxxxxxxxxx Signed-off-by: Brijesh Singh <brijesh.singh@xxxxxxx> --- arch/x86/kvm/svm/sev.c | 41 ++++++++++++++++++++++++++++++++++++++-- arch/x86/kvm/svm/svm.c | 5 +++++ arch/x86/kvm/svm/svm.h | 1 + include/uapi/linux/kvm.h | 3 +++ 4 files changed, 48 insertions(+), 2 deletions(-) diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index 4d5be5d2b05c..36042a2b19b3 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -189,7 +189,10 @@ static int sev_guest_init(struct kvm *kvm, struct kvm_sev_cmd *argp) if (asid < 0) return ret; - ret = sev_platform_init(&argp->error); + if (sev->snp_active) + ret = sev_snp_init(&argp->error); + else + ret = sev_platform_init(&argp->error); if (ret) goto e_free; @@ -206,12 +209,19 @@ static int sev_guest_init(struct kvm *kvm, struct kvm_sev_cmd *argp) static int sev_es_guest_init(struct kvm *kvm, struct kvm_sev_cmd *argp) { + int ret; + if (!sev_es) return -ENOTTY; + /* Must be set so that sev_asid_new() allocates ASID from the ES ASID range. */ to_kvm_svm(kvm)->sev_info.es_active = true; - return sev_guest_init(kvm, argp); + ret = sev_guest_init(kvm, argp); + if (ret) + to_kvm_svm(kvm)->sev_info.es_active = false; + + return ret; } static int sev_bind_asid(struct kvm *kvm, unsigned int handle, int *error) @@ -1042,6 +1052,23 @@ static int sev_launch_secret(struct kvm *kvm, struct kvm_sev_cmd *argp) return ret; } +static int sev_snp_guest_init(struct kvm *kvm, struct kvm_sev_cmd *argp) +{ + struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info; + int rc; + + if (!sev_snp) + return -ENOTTY; + + rc = sev_es_guest_init(kvm, argp); + if (rc) + return rc; + + sev->snp_active = true; + + return 0; +} + int svm_mem_enc_op(struct kvm *kvm, void __user *argp) { struct kvm_sev_cmd sev_cmd; @@ -1092,6 +1119,9 @@ int svm_mem_enc_op(struct kvm *kvm, void __user *argp) case KVM_SEV_LAUNCH_SECRET: r = sev_launch_secret(kvm, &sev_cmd); break; + case KVM_SEV_SNP_INIT: + r = sev_snp_guest_init(kvm, &sev_cmd); + break; default: r = -EINVAL; goto out; @@ -1955,6 +1985,13 @@ int sev_es_string_io(struct vcpu_svm *svm, int size, unsigned int port, int in) svm->ghcb_sa, svm->ghcb_sa_len, in); } +void sev_snp_init_vmcb(struct vcpu_svm *svm) +{ + struct vmcb_save_area *save = &svm->vmcb->save; + + save->sev_features |= SVM_SEV_FEATURES_SNP_ACTIVE; +} + void sev_es_init_vmcb(struct vcpu_svm *svm) { struct kvm_vcpu *vcpu = &svm->vcpu; diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index 13df2cbfc361..72fc1bd8737c 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -1281,6 +1281,11 @@ static void init_vmcb(struct vcpu_svm *svm) /* Perform SEV-ES specific VMCB updates */ sev_es_init_vmcb(svm); } + + if (sev_snp_guest(svm->vcpu.kvm)) { + /* Perform SEV-SNP specific VMCB Updates */ + sev_snp_init_vmcb(svm); + } } vmcb_mark_all_dirty(svm->vmcb); diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h index 9e8cd39bd703..9d41735699c6 100644 --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -604,6 +604,7 @@ void sev_es_vcpu_load(struct vcpu_svm *svm, int cpu); void sev_es_vcpu_put(struct vcpu_svm *svm); void sev_vcpu_deliver_sipi_vector(struct kvm_vcpu *vcpu, u8 vector); struct page *snp_safe_alloc_page(struct kvm_vcpu *vcpu); +void sev_snp_init_vmcb(struct vcpu_svm *svm); /* vmenter.S */ diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h index 374c67875cdb..e0e7dd71a863 100644 --- a/include/uapi/linux/kvm.h +++ b/include/uapi/linux/kvm.h @@ -1594,6 +1594,9 @@ enum sev_cmd_id { /* Guest certificates commands */ KVM_SEV_CERT_EXPORT, + /* SNP specific commands */ + KVM_SEV_SNP_INIT, + KVM_SEV_NR_MAX, }; -- 2.17.1