| Message ID | 148846770159.2349.16863375000963463500.stgit@brijesh-build-machine (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Thu, Mar 02, 2017 at 10:15:01AM -0500, Brijesh Singh wrote: > From: Tom Lendacky <thomas.lendacky@amd.com> > > Modify the SVM cpuid update function to indicate if Secure Encrypted > Virtualization (SEV) is active in the guest by setting the SEV KVM CPU > features bit. SEV is active if Secure Memory Encryption is enabled in > the host and the SEV_ENABLE bit of the VMCB is set. > > Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> > --- > arch/x86/kvm/cpuid.c | 4 +++- > arch/x86/kvm/svm.c | 18 ++++++++++++++++++ > 2 files changed, 21 insertions(+), 1 deletion(-) > > diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c > index 1639de8..e0c40a8 100644 > --- a/arch/x86/kvm/cpuid.c > +++ b/arch/x86/kvm/cpuid.c > @@ -601,7 +601,7 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, > entry->edx = 0; > break; > case 0x80000000: > - entry->eax = min(entry->eax, 0x8000001a); > + entry->eax = min(entry->eax, 0x8000001f); > break; > case 0x80000001: > entry->edx &= kvm_cpuid_8000_0001_edx_x86_features; > @@ -634,6 +634,8 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, > break; > case 0x8000001d: > break; > + case 0x8000001f: > + break; I guess those three case's can be unified: case 0x8000001a: case 0x8000001d: case 0x8000001f: break; ... > + sev_info = kvm_find_cpuid_entry(vcpu, 0x8000001f, 0); > + if (!sev_info) > + return; > + > + if (ca->nested_ctl & SVM_NESTED_CTL_SEV_ENABLE) { > + features->eax |= (1 << KVM_FEATURE_SEV); > + cpuid(0x8000001f, &sev_info->eax, &sev_info->ebx, > + &sev_info->ecx, &sev_info->edx); > + } Right, as already mentioned in the previous mail: can we communicate SEV status to the guest solely through the 0x8000001f leaf? Then we won't need KVM_FEATURE_SEV and this way we'll be hypervisor-agnostic, as Paolo suggested.
diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c index 1639de8..e0c40a8 100644 --- a/arch/x86/kvm/cpuid.c +++ b/arch/x86/kvm/cpuid.c @@ -601,7 +601,7 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, entry->edx = 0; break; case 0x80000000: - entry->eax = min(entry->eax, 0x8000001a); + entry->eax = min(entry->eax, 0x8000001f); break; case 0x80000001: entry->edx &= kvm_cpuid_8000_0001_edx_x86_features; @@ -634,6 +634,8 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, break; case 0x8000001d: break; + case 0x8000001f: + break; /*Add support for Centaur's CPUID instruction*/ case 0xC0000000: /*Just support up to 0xC0000004 now*/ diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c index 75b0645..36d61ff 100644 --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -46,6 +46,7 @@ #include <asm/irq_remapping.h> #include <asm/virtext.h> +#include <asm/mem_encrypt.h> #include "trace.h" #define __ex(x) __kvm_handle_fault_on_reboot(x) @@ -5005,10 +5006,27 @@ static void svm_cpuid_update(struct kvm_vcpu *vcpu) { struct vcpu_svm *svm = to_svm(vcpu); struct kvm_cpuid_entry2 *entry; + struct vmcb_control_area *ca = &svm->vmcb->control; + struct kvm_cpuid_entry2 *features, *sev_info; /* Update nrips enabled cache */ svm->nrips_enabled = !!guest_cpuid_has_nrips(&svm->vcpu); + /* Check for Secure Encrypted Virtualization support */ + features = kvm_find_cpuid_entry(vcpu, KVM_CPUID_FEATURES, 0); + if (!features) + return; + + sev_info = kvm_find_cpuid_entry(vcpu, 0x8000001f, 0); + if (!sev_info) + return; + + if (ca->nested_ctl & SVM_NESTED_CTL_SEV_ENABLE) { + features->eax |= (1 << KVM_FEATURE_SEV); + cpuid(0x8000001f, &sev_info->eax, &sev_info->ebx, + &sev_info->ecx, &sev_info->edx); + } + if (!kvm_vcpu_apicv_active(vcpu)) return;