On Mon, 20 Feb 2023 12:38:23 -0600
Michael Roth <michael.roth@xxxxxxx> wrote:
> From: Brijesh Singh <brijesh.singh@xxxxxxx>
>
> The next generation of SEV is called SEV-SNP (Secure Nested Paging).
> SEV-SNP builds upon existing SEV and SEV-ES functionality while adding new
> hardware based security protection. SEV-SNP adds strong memory encryption
> integrity protection to help prevent malicious hypervisor-based attacks
> such as data replay, memory re-mapping, and more, to create an isolated
> execution environment.
>
> The SNP feature is added incrementally, the later patches adds a new module
> parameters that can be used to enabled SEV-SNP in the KVM.
>
> Signed-off-by: Brijesh Singh <brijesh.singh@xxxxxxx>
> Signed-off-by: Ashish Kalra <ashish.kalra@xxxxxxx>
> Signed-off-by: Michael Roth <michael.roth@xxxxxxx>
> ---
> arch/x86/kvm/svm/sev.c | 10 +++++++++-
> arch/x86/kvm/svm/svm.h | 8 ++++++++
> 2 files changed, 17 insertions(+), 1 deletion(-)
>
> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> index 9e9efb42a766..51db01b282eb 100644
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
> @@ -58,6 +58,9 @@ module_param_named(sev_es, sev_es_enabled, bool, 0444);
> #define sev_es_enabled false
> #endif /* CONFIG_KVM_AMD_SEV */
>
> +/* enable/disable SEV-SNP support */
> +static bool sev_snp_enabled;
> +
> #define AP_RESET_HOLD_NONE 0
> #define AP_RESET_HOLD_NAE_EVENT 1
> #define AP_RESET_HOLD_MSR_PROTO 2
> @@ -2306,6 +2309,7 @@ void __init sev_hardware_setup(void)
> {
> #ifdef CONFIG_KVM_AMD_SEV
> unsigned int eax, ebx, ecx, edx, sev_asid_count, sev_es_asid_count;
> + bool sev_snp_supported = false;
> bool sev_es_supported = false;
> bool sev_supported = false;
>
> @@ -2385,12 +2389,16 @@ void __init sev_hardware_setup(void)
> if (misc_cg_set_capacity(MISC_CG_RES_SEV_ES, sev_es_asid_count))
> goto out;
>
> - pr_info("SEV-ES supported: %u ASIDs\n", sev_es_asid_count);
> sev_es_supported = true;
> + sev_snp_supported = sev_snp_enabled && cpu_feature_enabled(X86_FEATURE_SEV_SNP);
> +
> + pr_info("SEV-ES %ssupported: %u ASIDs\n",
> + sev_snp_supported ? "and SEV-SNP " : "", sev_es_asid_count);
>
> out:
> sev_enabled = sev_supported;
> sev_es_enabled = sev_es_supported;
> + sev_snp_enabled = sev_snp_supported;
> #endif
> }
>
> diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h
> index 5efcf036ccad..8eb1b51e92f5 100644
> --- a/arch/x86/kvm/svm/svm.h
> +++ b/arch/x86/kvm/svm/svm.h
> @@ -76,6 +76,7 @@ enum {
> struct kvm_sev_info {
> bool active; /* SEV enabled guest */
> bool es_active; /* SEV-ES enabled guest */
> + bool snp_active; /* SEV-SNP enabled guest */
> unsigned int asid; /* ASID used for this guest */
> unsigned int handle; /* SEV firmware handle */
> int fd; /* SEV device fd */
> @@ -323,6 +324,13 @@ static __always_inline bool sev_es_guest(struct kvm *kvm)
> #endif
> }
>
> +static inline bool sev_snp_guest(struct kvm *kvm)
> +{
> + struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info;
> +
> + return sev_es_guest(kvm) && sev->snp_active;
> +}
> +
Maybe also use __always_inline like sev_es_guest() above?
It seems solved some warnings before:
https://lore.kernel.org/all/20210624095147.880513802@xxxxxxxxxxxxx/
> static inline void vmcb_mark_all_dirty(struct vmcb *vmcb)
> {
> vmcb->control.clean = 0;
