From patchwork Thu Dec 10 17:09:36 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tom Lendacky X-Patchwork-Id: 11965859 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 541C8C4361B for ; Thu, 10 Dec 2020 18:06:05 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 15F3B23DE3 for ; Thu, 10 Dec 2020 18:06:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2404081AbgLJSFc (ORCPT ); Thu, 10 Dec 2020 13:05:32 -0500 Received: from mail-bn8nam11on2087.outbound.protection.outlook.com ([40.107.236.87]:25696 "EHLO NAM11-BN8-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S2392578AbgLJRL4 (ORCPT ); Thu, 10 Dec 2020 12:11:56 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=UDjxLR1VOiZEkpRvd1LHcGGmxP0nTXOD1EVs1URsU340VSm+HiCLLxJebMn2Mk87n/HI8CBkGOU+pe+ydAvrFfMaWtvkRPYIR4bLERo5uMUaY8qWnVq/yi/qOjiAr8IA1zVPMJoJ+DkP+dmq/tx88SHCJMRUsQvcurpZIBHDK5DtqP4FQEqxJu44Myt4aLp9ScANqzMwG3gHw0FTOoRfVuQK1rN1rGPiuH6CKa8sp88rG18lvRfReB8bnZxhEepRUR+eN3F3di0jBLl/dIdu0GR+Yha9XMZ0IpIau8CxpjBV8ucy84fZeJMDBY5omLFYYgEQeGDAT6ehpK9XtP4Img== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=jIDSQVwBhceTkXrKGCJrfTL5U9e5STc9iqm9UuU3694=; b=Dybb8heY7SWuCik5fBpouj4CIBIxjihECg5Lgq4xktDwTOdRW+3kw5u40YCZUMB2Vy/hoJwY62Jx0J/+wP0oiUXWvj1+2gld+Zttu+8fxpG1kqQqQzAnJTQBdTqpHgSXtZjCa6hkj+K/yY9crkAthmMQxdBEMf19yqbc9c1wnlz7ZitdfPHO2zkyu5z0ZDWa0YRgNOigpeE+t8o6Ae5bitE/jgDreiszDUVkYhS49llSJCOpC41dcH2v7GawYpzvUHjGb5j6NCWS/qhEh3I0QLfKZj9029jZm7bLG3Ymplx0rU85vAviS1BnvQ2U8/Ujygo0hwggkbHepzYx/49e9A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amdcloud.onmicrosoft.com; s=selector2-amdcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=jIDSQVwBhceTkXrKGCJrfTL5U9e5STc9iqm9UuU3694=; b=RaPL/SkflB8LRrlDUl58Y7ylkGyIR/lXEK5m17/ZVaruES2QrHiLzqsALxxfPopOgG/fLe7bRZ9ZRuQeq8Lofn3htDKwQScpIXLQBSEYZ19pikf2uLgruVqxQmSV2RiSLuEl3s1Y9s5ZnGSM9iEzZ2h6m58J7DBkr2ymU+zrDbA= Authentication-Results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=amd.com; Received: from CY4PR12MB1352.namprd12.prod.outlook.com (2603:10b6:903:3a::13) by CY4PR1201MB0168.namprd12.prod.outlook.com (2603:10b6:910:1d::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3632.22; Thu, 10 Dec 2020 17:10:26 +0000 Received: from CY4PR12MB1352.namprd12.prod.outlook.com ([fe80::a10a:295e:908d:550d]) by CY4PR12MB1352.namprd12.prod.outlook.com ([fe80::a10a:295e:908d:550d%8]) with mapi id 15.20.3632.021; Thu, 10 Dec 2020 17:10:26 +0000 From: Tom Lendacky To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, x86@kernel.org Cc: Paolo Bonzini , Jim Mattson , Joerg Roedel , Sean Christopherson , Vitaly Kuznetsov , Wanpeng Li , Borislav Petkov , Ingo Molnar , Thomas Gleixner , Brijesh Singh Subject: [PATCH v5 01/34] x86/cpu: Add VM page flush MSR availablility as a CPUID feature Date: Thu, 10 Dec 2020 11:09:36 -0600 Message-Id: X-Mailer: git-send-email 2.28.0 In-Reply-To: References: X-Originating-IP: [165.204.77.1] X-ClientProxiedBy: CH2PR10CA0030.namprd10.prod.outlook.com (2603:10b6:610:4c::40) To CY4PR12MB1352.namprd12.prod.outlook.com (2603:10b6:903:3a::13) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from tlendack-t1.amd.com (165.204.77.1) by CH2PR10CA0030.namprd10.prod.outlook.com (2603:10b6:610:4c::40) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3654.12 via Frontend Transport; Thu, 10 Dec 2020 17:10:25 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: f4a4e8cf-7de9-4e2a-d163-08d89d2e7cf2 X-MS-TrafficTypeDiagnostic: CY4PR1201MB0168: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:7219; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: CaDYmh9pJ0oZgX31lFTZu8qWQdjbaCNAh2lkDRwGoAca2tWQExcM63apcxoSFqJreu2rM+b06YYJsk1wxKOf1VgQ4UJtgWezKuBCUn0pPH9kg4G66CNfrEhRyRiDP+hMyDBdVRzINm+o41VjGt8fuLtAbRp322bhTR4dMLps+AA1MICM+pKCCzcVvuKmt++CdX9WhHl4gyElizH3I5aSyIpYA46bmi+b/SgsNiZjpq/oQK795TUmmIkNnJPt977N43fDn/wrIpKBTCXTTY4gp18qyhUh356FxjUr6sc6ohIv1PYv1xaOXAHFzdIG/2jH782PEW/P3wI4YY1W0IL1YyUbxDrfSQZ0xtyD/QFQrurHz5FyKuCumoy+EQcMvBNQ X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CY4PR12MB1352.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(366004)(136003)(346002)(376002)(36756003)(8676002)(6486002)(4326008)(66476007)(86362001)(7416002)(66946007)(7696005)(54906003)(6666004)(26005)(16526019)(34490700003)(66556008)(8936002)(186003)(2906002)(2616005)(52116002)(956004)(508600001)(5660300002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData: GrAyUDUVg9k3mbUZeUV2moygcE761cqfgC4vppU9BoFbMAatF2142WL1mYKRvL45hsQoFC711neDQhSJ5VR9sxyVG3mpIRyKoP3JI+a0PTiWDOB7e+L6rLuT+CQU14Q/U4IE+jEe41CEG+lO1Ppva1j1PKdlO+A7GOA/HcDwrdEcmWMbabxTZuzeju2PJ71EAQpQk0nZEHRsWqc5QsJWovovwstI2+gB/nRSBySmG6MLafSieXw2JOI4zzAM1RKoLr06kOBJXFTQZeKd1xy8FfBSTrxUbgVuDIPo/4wpIOZG0+ZNN23JOLXUhYCb1a8T0yLZHNUKtgAx54n93GigC/0sVQO01aLh73+dzX8n97x53bS8LGLJDvnkK/sU6UXANJlgAwkDL2s7SmxT1B5kmPGC7nYml/LEtidgL7blSMzgeUqZY5FQ5EwNesP7Z+ubN9k4HfzOdJ2cnHqVVXj5Ll/2kbrJxNXTCcKy1dkD2l18m5mR0GG3HGAy+4Rdcnf8u2wqD07iZl9zwJXsqs3/hDg6ka69bA0RW22KXPMcZ6jjXzrIaIAT85vdtW7mBHP4XMzNOtEoQEfrTYGF5K/dmeml1kfk8GaHv/CmtZeLq7xAU/EWpwFb23L4mL3cdfok2EOP+FTE01nYgrkQiWjHq7zYP6eS/849G4EKoDocs9Qo+jUslUIHh6podqENPUNV9BScL8+29ydatXuIXQeAcnDOdE7nbFInzTquZNXbJSfiwSazghjBOdKCCDv6M36j1tPWbQxogN3o2dCoS99CaYqlTCXczdCZ0fY4swuKZneSwWIr8SpzD7ewKoBWIOcNIADIqkQgomhod9E0Ev5ngsqd78UbDwiMTqd6g+TxzsHPSrMMA1A3KXDHlI+hIwXDkIdhYjZ0ds2vjvdEqGva4t3u3G9rSd/IzBsSNdVDkNFy//6/+rtyEoS6KcZi71hoeAaPDba5edLffTUfg9pshakOLZfU6ia+qoV+TkPR6nCTWRPJ3u4a8yzROK1FMMHF X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-AuthSource: CY4PR12MB1352.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Dec 2020 17:10:26.2710 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-Network-Message-Id: f4a4e8cf-7de9-4e2a-d163-08d89d2e7cf2 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: mDMUBBZZ78kOxEeZuFTWRGknlJaLjRFIBDPEq8WGUCZwt0qMLCpTqxW7l75lljS9oD2se4MjcDi/xYkkKlUXVw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR1201MB0168 Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org From: Tom Lendacky On systems that do not have hardware enforced cache coherency between encrypted and unencrypted mappings of the same physical page, the hypervisor can use the VM page flush MSR (0xc001011e) to flush the cache contents of an SEV guest page. When a small number of pages are being flushed, this can be used in place of issuing a WBINVD across all CPUs. CPUID 0x8000001f_eax[2] is used to determine if the VM page flush MSR is available. Add a CPUID feature to indicate it is supported and define the MSR. Signed-off-by: Tom Lendacky --- arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/msr-index.h | 1 + arch/x86/kernel/cpu/scattered.c | 1 + 3 files changed, 3 insertions(+) diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h index dad350d42ecf..54df367b3180 100644 --- a/arch/x86/include/asm/cpufeatures.h +++ b/arch/x86/include/asm/cpufeatures.h @@ -237,6 +237,7 @@ #define X86_FEATURE_VMCALL ( 8*32+18) /* "" Hypervisor supports the VMCALL instruction */ #define X86_FEATURE_VMW_VMMCALL ( 8*32+19) /* "" VMware prefers VMMCALL hypercall instruction */ #define X86_FEATURE_SEV_ES ( 8*32+20) /* AMD Secure Encrypted Virtualization - Encrypted State */ +#define X86_FEATURE_VM_PAGE_FLUSH ( 8*32+21) /* "" VM Page Flush MSR is supported */ /* Intel-defined CPU features, CPUID level 0x00000007:0 (EBX), word 9 */ #define X86_FEATURE_FSGSBASE ( 9*32+ 0) /* RDFSBASE, WRFSBASE, RDGSBASE, WRGSBASE instructions*/ diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h index 972a34d93505..abfc9b0fbd8d 100644 --- a/arch/x86/include/asm/msr-index.h +++ b/arch/x86/include/asm/msr-index.h @@ -470,6 +470,7 @@ #define MSR_AMD64_ICIBSEXTDCTL 0xc001103c #define MSR_AMD64_IBSOPDATA4 0xc001103d #define MSR_AMD64_IBS_REG_COUNT_MAX 8 /* includes MSR_AMD64_IBSBRTARGET */ +#define MSR_AMD64_VM_PAGE_FLUSH 0xc001011e #define MSR_AMD64_SEV_ES_GHCB 0xc0010130 #define MSR_AMD64_SEV 0xc0010131 #define MSR_AMD64_SEV_ENABLED_BIT 0 diff --git a/arch/x86/kernel/cpu/scattered.c b/arch/x86/kernel/cpu/scattered.c index 866c9a9bcdee..236924930bf0 100644 --- a/arch/x86/kernel/cpu/scattered.c +++ b/arch/x86/kernel/cpu/scattered.c @@ -44,6 +44,7 @@ static const struct cpuid_bit cpuid_bits[] = { { X86_FEATURE_SEV, CPUID_EAX, 1, 0x8000001f, 0 }, { X86_FEATURE_SEV_ES, CPUID_EAX, 3, 0x8000001f, 0 }, { X86_FEATURE_SME_COHERENT, CPUID_EAX, 10, 0x8000001f, 0 }, + { X86_FEATURE_VM_PAGE_FLUSH, CPUID_EAX, 2, 0x8000001f, 0 }, { 0, 0, 0, 0, 0 } }; From patchwork Thu Dec 10 17:09:37 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tom Lendacky X-Patchwork-Id: 11965857 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0A979C0018C for ; Thu, 10 Dec 2020 18:05:35 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C488723E1D for ; Thu, 10 Dec 2020 18:05:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2404042AbgLJRL4 (ORCPT ); Thu, 10 Dec 2020 12:11:56 -0500 Received: from mail-dm6nam11on2069.outbound.protection.outlook.com ([40.107.223.69]:37494 "EHLO NAM11-DM6-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1732949AbgLJRLi (ORCPT ); Thu, 10 Dec 2020 12:11:38 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=F1lxS4fnFFXRYvaQ3qAZEN1oTaUIKb6iD0y0i5mvRs36IIO1rZyMpAolB0MF8SWxkqJg6Vkz7xMHgWKnB4WOk0UNTFlj07pOx0j+tJMHzYUoY+qtKGnyw3PTNpIOWu/0vwlgIKxd5uYP7OC0xP4QEkI1trxy349prP7Vf/18iNN1p8HcscYqgJF0K1+FolgsU2cQWhegzJxIU3IvDPdQHSOf1xgBIqqu8BLvc2XlsUbgk05Fdwv/LmSYP+WjvuBzhJGQUVAWq5TCilZOZcJEo4MrcaQh3jQbqvv5ybIe6u8jIkff4fggtcDB4VoG1lqAU0w2I7JmUNZ90XS73ihjqg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=dezrM75SgkRzYWh4Ln72KARkco3Iwy+sJTmsje+sres=; b=DfUB43eIxKC90F3ExxbR7nxTs4NgYtvu3y+KcoRB+nsreqf87wlrXsu2k6mM73C9wxH9M8JEzageEJZ+xGQFRuMeSity3CB4LF3CMEkaGdKmsDGWz6JMs5c0aG5WSryQ9App1qU9K/mDjAfqzKaG06RdHSgr9mLOQDfk+Qp9Rg11cqPApRzgReVGcB3jA4u/Q05ptc3k8iaHcBuJ+5WZU7b9pyxqKY5KqB6M/MxfU9wRYnv9ffIG7rU2RvBlBaZe/8cffAMWVgjide3Mi68w4BFoT+Y8zWmpjz8vkeAV9bZ+4VlYr87Yrj8fGZQGkAG8ojWXkEb1ii/HolLJAmyYKg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amdcloud.onmicrosoft.com; s=selector2-amdcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=dezrM75SgkRzYWh4Ln72KARkco3Iwy+sJTmsje+sres=; b=inaRtfln6rXCo3SoW6DDLe7pOM2MQFQxVvN7AhxYJVCJ8VdfNcpFJgJwnp3b8C4/3gPmltHSFSGiVWSohHV1pq768Fgszu5x9wrTIHoJNDd01CQnO2wWrAj4gxFQZ1xaA606nPKpKFcqKUCFnOsuboTSmYWx4QwDVPfNZKNrM3s= Authentication-Results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=amd.com; Received: from CY4PR12MB1352.namprd12.prod.outlook.com (2603:10b6:903:3a::13) by CY4PR1201MB0168.namprd12.prod.outlook.com (2603:10b6:910:1d::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3632.22; Thu, 10 Dec 2020 17:10:35 +0000 Received: from CY4PR12MB1352.namprd12.prod.outlook.com ([fe80::a10a:295e:908d:550d]) by CY4PR12MB1352.namprd12.prod.outlook.com ([fe80::a10a:295e:908d:550d%8]) with mapi id 15.20.3632.021; Thu, 10 Dec 2020 17:10:35 +0000 From: Tom Lendacky To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, x86@kernel.org Cc: Paolo Bonzini , Jim Mattson , Joerg Roedel , Sean Christopherson , Vitaly Kuznetsov , Wanpeng Li , Borislav Petkov , Ingo Molnar , Thomas Gleixner , Brijesh Singh Subject: [PATCH v5 02/34] KVM: SVM: Remove the call to sev_platform_status() during setup Date: Thu, 10 Dec 2020 11:09:37 -0600 Message-Id: <618380488358b56af558f2682203786f09a49483.1607620209.git.thomas.lendacky@amd.com> X-Mailer: git-send-email 2.28.0 In-Reply-To: References: X-Originating-IP: [165.204.77.1] X-ClientProxiedBy: CH2PR10CA0003.namprd10.prod.outlook.com (2603:10b6:610:4c::13) To CY4PR12MB1352.namprd12.prod.outlook.com (2603:10b6:903:3a::13) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from tlendack-t1.amd.com (165.204.77.1) by CH2PR10CA0003.namprd10.prod.outlook.com (2603:10b6:610:4c::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3654.12 via Frontend Transport; Thu, 10 Dec 2020 17:10:34 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: 38015709-2c41-41d3-edb7-08d89d2e8278 X-MS-TrafficTypeDiagnostic: CY4PR1201MB0168: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:7691; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: j6g4Cg4COSe8P7F6quS4eoCB38tfikB2hyL5UnalcufnrzPU4rdQTc1QsDt2y7+7fNBq29aVAtCd3hpLq3j+AKgQYtWsSfcEJN7CNS6tiz23Z7iG4oOMSUFHlJwYuCXa2BaFJoX7ioJWqxLMZw4y9pDZknhuF4tRVUFKuSy1wpnsO5SqAig1iNmTr8ahC8MbWo4BBN25Xr43WOzgIOZiuE4dQml1jv83VLOnHuh7b09r53R6xRoz7XJQaELvo3ZtNGJZMLOR34wFop/ClhdomQLS6WLY3/odfaDlRywYKD5hfMZcHjTJYnfNdEOE5sdbIlmQWzIa9vuw3L3DJZE9PFQ/gzSR5XHEjXrc43wniVaDRvxbfKQQ3XW0v9oV9Yd7 X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CY4PR12MB1352.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(366004)(136003)(346002)(376002)(36756003)(8676002)(6486002)(4326008)(66476007)(86362001)(7416002)(66946007)(7696005)(54906003)(26005)(16526019)(34490700003)(66556008)(8936002)(83380400001)(186003)(2906002)(2616005)(52116002)(956004)(508600001)(5660300002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData: ldW8wXA0jddFUvfHEAYA1eg/qrTPBC9d1urgdv/nXv+hhufzbs7cx+Mm3eijDrQGZrP2TTcdj5fmDHxtfVdbXD9zleHYdHKFRc7J+BnZ6f/8dUqyEQ4zZOLxtwq1u22u0dwSDLMTbgkoTcUCawOvnUUhvryjg9jxJq4E4MgOtfCoBzS+DvDmrO/BPs/tbTfeJuNqRnCv9zb1TdPcOHB7FSLwJPwhqVtgOwKX1i29sr5sV5hlYN8BFdnWnPqohZUgFCSLyBhmyZFjlMkW4EaTnqnpskmfCVg2/DSZSCku72yQr4LcXG04lbIbUJppfft43GDnMWlTrSqPtmMRd+bOFVVfAA8oqBRE0X2v4KN4Jjz3j4cFrhofZD+akwPzujeIfJ4wF3NXpgU6usyaIG/y61VpO6jsxq8PKHXRhDCmHH4YSXqFIhZR+FMr5kvhVcCvcouH0Rv6OKENrMiQM1hxLE6os9H5+uDaE5IoUAAmnLqtzYlbxMHHLBAZQsRtNotJFQGUZUKq/I/jmV99/xl4t28BMsBKCwf8AxZbyMKjAKfmxf4DOm/AJTgH4I+DC+1cSh3UTMmswo/o46lCcwIADtzppEsaD4xEsbYImgrDSxYvMTOMDP0HS0+Fihx4vyN4Fe21Qbc4XXAT40/o6qZtMafPDqXeSCVoz8LTWvBGVVtrSsd5prMkNE/6ruT2HPiJfMcH8qVK/lzb7YlVZ/DGJCvPL9DvEGltMRpqJB4S3egYP5Ljtwv0JnoE1PhIkf8ZZIWJ2GDB+6ORP1O1L6v80KbTiByH/Eo4MegKl6P8VoRPh30HzPnveEL0219bZkFERpW1AXJfWP6bYhHewzNyfJSjVMEnM3je4fBNCRiGLATq5rpuuUWYfkZpeKYMFFTHPQk3es5doXRQBzEXxoi3F4IOVJzcMi2KfXWGzkkdhuJxtqnqcQ8fx/ac+F9VGeTHGyWjNmYnRjs5MDveixcfhlX2qxsnk4XD5mcSjCZWo+ou2NgLuiu3G1Lj83WRuIn7 X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-AuthSource: CY4PR12MB1352.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Dec 2020 17:10:35.5155 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-Network-Message-Id: 38015709-2c41-41d3-edb7-08d89d2e8278 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: fiN53wUMgaaO47Guol08md8M+FH8BV2oZteS3vlb/1B/7dqjr/oXSUXbFJ18lZbHMdK0Q+iW8oZzylFXuDy5Tw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR1201MB0168 Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org From: Tom Lendacky When both KVM support and the CCP driver are built into the kernel instead of as modules, KVM initialization can happen before CCP initialization. As a result, sev_platform_status() will return a failure when it is called from sev_hardware_setup(), when this isn't really an error condition. Since sev_platform_status() doesn't need to be called at this time anyway, remove the invocation from sev_hardware_setup(). Signed-off-by: Tom Lendacky --- arch/x86/kvm/svm/sev.c | 22 +--------------------- 1 file changed, 1 insertion(+), 21 deletions(-) diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index c0b14106258a..a4ba5476bf42 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -1127,9 +1127,6 @@ void sev_vm_destroy(struct kvm *kvm) int __init sev_hardware_setup(void) { - struct sev_user_data_status *status; - int rc; - /* Maximum number of encrypted guests supported simultaneously */ max_sev_asid = cpuid_ecx(0x8000001F); @@ -1148,26 +1145,9 @@ int __init sev_hardware_setup(void) if (!sev_reclaim_asid_bitmap) return 1; - status = kmalloc(sizeof(*status), GFP_KERNEL); - if (!status) - return 1; - - /* - * Check SEV platform status. - * - * PLATFORM_STATUS can be called in any state, if we failed to query - * the PLATFORM status then either PSP firmware does not support SEV - * feature or SEV firmware is dead. - */ - rc = sev_platform_status(status, NULL); - if (rc) - goto err; - pr_info("SEV supported\n"); -err: - kfree(status); - return rc; + return 0; } void sev_hardware_teardown(void) From patchwork Thu Dec 10 17:09:38 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tom Lendacky X-Patchwork-Id: 11965855 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9F6B1C4361B for ; Thu, 10 Dec 2020 18:05:34 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 5D4D523DE3 for ; Thu, 10 Dec 2020 18:05:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2392597AbgLJSEx (ORCPT ); Thu, 10 Dec 2020 13:04:53 -0500 Received: from mail-dm6nam11on2069.outbound.protection.outlook.com ([40.107.223.69]:37494 "EHLO NAM11-DM6-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S2404048AbgLJRMB (ORCPT ); Thu, 10 Dec 2020 12:12:01 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=BT8LldbC+4I+yQHnIABI/uLMMI4lweU/cYZhETrVppxgb0BKVEJ3/s7JeJkAB61i2kQB+ZQtsRCKtSXUDsQgfl9te8jQtMZxERqAolAveq9z+LUIcSOR68GJjSvwoFbFw0wHBEeBNXmTFGPVtrPRN0+YS2xk0FN1Q6Q3804mpG4wWEoF/Pd3TB44tCXwIK1S1HcmAPArR2sOFFPlZzGzw7pr3wiOhguIPJAR91VYjMJ22QmcwZ4XYi8BkQS7Luz54qW0Cy8Vl/h0C/fjHeyk53k4HqxYfCzKjBVGjhHRna205RV0TFyjlej4uODF0vl0XoZhrjx6Ux2Y2dcMl3grkg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=pEu7KmoSe2wsLRyaIXnIQhWobneKjtSr6mvX8Tyf+V4=; b=LZWdnPnR2Yz3HmmoAMGOe593Ds+8fjM0WjPQ6mmbBXrkVoHoX6sFRJnbM4hNKOi01GXUnFiCSCuJZZ6NSGBjJm7L3dUY9IUQyrueu4aSPNtTU30cpU2M9XJi5ukZz6awuykF2mgS2+xJUMuBkU0TOTZKT1kSquywLEDfcFt+QZgR0j5vPCDIR98zS6Z37IqLoT/WMMLvBlxmLZLko6+dJBeDkfE1iI91+VKzu6O5qwyXEyumms6wTyK1ZOJ28HrhrDY7GLci2qftiRpAjw6VZVl52uN5gw9+Yw81CIP9/W/fIbKlb+MQ9pwJi4B21TbOrs6qaDvbVVjxKb1qDjCaUA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amdcloud.onmicrosoft.com; s=selector2-amdcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=pEu7KmoSe2wsLRyaIXnIQhWobneKjtSr6mvX8Tyf+V4=; b=CmET4wmK9sZ+h1oR7u1pSyk5qllIuPZyjY3eMlnrnkytE7bsqBhgUDcSeim5s3wI7NIcE/6nclzIJ8HiMGCTCfd3lMrpwgi4FT8aFsUF9jMRQUUzptEe52M6xK5272oTsN2LCijYuWfxgB1gjuNQ9AR7nntaZoefSPip/HcAENU= Authentication-Results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=amd.com; Received: from CY4PR12MB1352.namprd12.prod.outlook.com (2603:10b6:903:3a::13) by CY4PR1201MB0168.namprd12.prod.outlook.com (2603:10b6:910:1d::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3632.22; Thu, 10 Dec 2020 17:10:44 +0000 Received: from CY4PR12MB1352.namprd12.prod.outlook.com ([fe80::a10a:295e:908d:550d]) by CY4PR12MB1352.namprd12.prod.outlook.com ([fe80::a10a:295e:908d:550d%8]) with mapi id 15.20.3632.021; Thu, 10 Dec 2020 17:10:44 +0000 From: Tom Lendacky To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, x86@kernel.org Cc: Paolo Bonzini , Jim Mattson , Joerg Roedel , Sean Christopherson , Vitaly Kuznetsov , Wanpeng Li , Borislav Petkov , Ingo Molnar , Thomas Gleixner , Brijesh Singh Subject: [PATCH v5 03/34] KVM: SVM: Add support for SEV-ES capability in KVM Date: Thu, 10 Dec 2020 11:09:38 -0600 Message-Id: X-Mailer: git-send-email 2.28.0 In-Reply-To: References: X-Originating-IP: [165.204.77.1] X-ClientProxiedBy: CH2PR10CA0025.namprd10.prod.outlook.com (2603:10b6:610:4c::35) To CY4PR12MB1352.namprd12.prod.outlook.com (2603:10b6:903:3a::13) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from tlendack-t1.amd.com (165.204.77.1) by CH2PR10CA0025.namprd10.prod.outlook.com (2603:10b6:610:4c::35) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3654.12 via Frontend Transport; Thu, 10 Dec 2020 17:10:43 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: a727b69a-4f2a-424d-266b-08d89d2e87cf X-MS-TrafficTypeDiagnostic: CY4PR1201MB0168: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:2958; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: BNDfnag89SoNoBvy6T8JL00Odj1UWe8Zu3//F8oIbfwbze7yEiSQITtknz/Ed64OIq21g+icn1XlO09cjJAveeWhH8cpDormOL2wUpU5W2JFQ1dpZtS5xhIijtsr1u2amMohcUPzgWaciyWjvi2AT/n7zHV0Zu+tssfle2fMl03EPuRddtdvoyoVBsrDSRdAFSOkzn3YikeBYIHKWPWp8LFVI3TdE8y1TPl7e1Kc9UxSV9YSn4RNgYNdHQpMh21DOUZXFzDYbI6AbX86VmijV6+6ZXx3aHJd2qRt1cPOU5e0hWEoXV1NR7hkpITOajqtjq+a8Ey8wfNabcEzkVRQDxWGAS4TiDqLcGKqe+Ri2qTCMvjgQmGToqpWw83xYF8e X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CY4PR12MB1352.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(366004)(136003)(346002)(376002)(36756003)(8676002)(6486002)(4326008)(66476007)(86362001)(7416002)(66946007)(7696005)(54906003)(6666004)(26005)(16526019)(34490700003)(66556008)(8936002)(83380400001)(186003)(2906002)(2616005)(52116002)(956004)(508600001)(5660300002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData: 74X2YJNOXhnOyqPQXoTvivpnnEN5pUoUG4VDVRgIfs6GUY7GDdV/EXmpdIxN/3+IY3wyvfSJ4ugBaFfB+CDcJDDOmm4b+8id5nQgl+7az28RuibRJ+CUfeLdDrgrumKTXyzbMN7MyiiWPeFDTVghmLvEF+7yGo3LijlCMeSv2kqFzAfatQ0QaVlLcd+Pr0meeZOXycs+kcggjJL3RBWZjz0kjqOAOzsOTcZwneUoDxsoAQhXvEuudnptJynq3HRyImAP8PfKSAiYZ7Z1NyfDb6mEKMgv5WIB44fGfzZVSiKpZx3TG8idgRWCfJunC7OqZpiDd5FVDa05SQWu+L93J2LBagXoDl4WL/b152BRSQRkd7XrR83NmVkown5847KYpu4RCc0MLv57SzS92rIvS4bp7pMpm6GRncpp6DFTT7fFcRQnWDRSvZhG3XX3vt2AoOVuhfPQk4nfrWxU4JPzy5FpLttvK9ShN3LkIK3BXrjn1fyCtXpZwaABqZL/+245i7FbLgEarXJKzyZSsRdTk796FX46erLDsfCsVocUfxTGYCEVD81L9Z++F4i4dzO4QH0hmj4OHW0eqrAuZalWb9ac9b9GkD2Kiwx4ukFZBXLzkaF1cxSXJOHCUKcYKDxA9OKyyBcpHMg3yJsJTuCRnt3SHl+3oPlD/WY9hKKQsREqvvM89X2BafriPkS0V1ASnOhC9JAP7EUhi64tbdFN8/NZHtRLiqEXPNUqHRLL4XV8tWzzwRTm91DsajnZijyXZkOeFuViJP9aSYg7qEGJhYSNd9txjg4nDWobXREBHgPZgEhbg2VFtIlDw3MRr+dEKcqgG4ZHoMcCy2jiHpzavAzyyxCiNhY9ppjyQoC+Ii6DQoiDB0AkfpkhT5bOW670FZiOw3WSckfqdIf+zsq+WxgdhJ4u0agPLDEtTVmNKUUlFrdwGbKFh3oaXOgQGhO1m4+wcInnZKAHAPLtrqvLmtOVA5MY2/MBZdN3kB16Snhc3VyPLUGfRVkcHlWiav4o X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-AuthSource: CY4PR12MB1352.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Dec 2020 17:10:44.4861 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-Network-Message-Id: a727b69a-4f2a-424d-266b-08d89d2e87cf X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: Seu6TO/oRRl9MQAiZqSzcjh3MZ5mfpIe+yLTuHFbxaG+SyrZ005J9Lieo2niP2NH41CpJIab4HxJiruYomDP1w== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR1201MB0168 Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org From: Tom Lendacky Add support to KVM for determining if a system is capable of supporting SEV-ES as well as determining if a guest is an SEV-ES guest. Signed-off-by: Tom Lendacky --- arch/x86/kvm/Kconfig | 3 ++- arch/x86/kvm/svm/sev.c | 47 ++++++++++++++++++++++++++++++++++-------- arch/x86/kvm/svm/svm.c | 20 +++++++++--------- arch/x86/kvm/svm/svm.h | 17 ++++++++++++++- 4 files changed, 66 insertions(+), 21 deletions(-) diff --git a/arch/x86/kvm/Kconfig b/arch/x86/kvm/Kconfig index f92dfd8ef10d..7ac592664c52 100644 --- a/arch/x86/kvm/Kconfig +++ b/arch/x86/kvm/Kconfig @@ -100,7 +100,8 @@ config KVM_AMD_SEV depends on KVM_AMD && X86_64 depends on CRYPTO_DEV_SP_PSP && !(KVM_AMD=y && CRYPTO_DEV_CCP_DD=m) help - Provides support for launching Encrypted VMs on AMD processors. + Provides support for launching Encrypted VMs (SEV) and Encrypted VMs + with Encrypted State (SEV-ES) on AMD processors. config KVM_MMU_AUDIT bool "Audit KVM MMU" diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index a4ba5476bf42..9bf5e9dadff5 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -932,7 +932,7 @@ int svm_mem_enc_op(struct kvm *kvm, void __user *argp) struct kvm_sev_cmd sev_cmd; int r; - if (!svm_sev_enabled()) + if (!svm_sev_enabled() || !sev) return -ENOTTY; if (!argp) @@ -1125,29 +1125,58 @@ void sev_vm_destroy(struct kvm *kvm) sev_asid_free(sev->asid); } -int __init sev_hardware_setup(void) +void __init sev_hardware_setup(void) { + unsigned int eax, ebx, ecx, edx; + bool sev_es_supported = false; + bool sev_supported = false; + + /* Does the CPU support SEV? */ + if (!boot_cpu_has(X86_FEATURE_SEV)) + goto out; + + /* Retrieve SEV CPUID information */ + cpuid(0x8000001f, &eax, &ebx, &ecx, &edx); + /* Maximum number of encrypted guests supported simultaneously */ - max_sev_asid = cpuid_ecx(0x8000001F); + max_sev_asid = ecx; if (!svm_sev_enabled()) - return 1; + goto out; /* Minimum ASID value that should be used for SEV guest */ - min_sev_asid = cpuid_edx(0x8000001F); + min_sev_asid = edx; /* Initialize SEV ASID bitmaps */ sev_asid_bitmap = bitmap_zalloc(max_sev_asid, GFP_KERNEL); if (!sev_asid_bitmap) - return 1; + goto out; sev_reclaim_asid_bitmap = bitmap_zalloc(max_sev_asid, GFP_KERNEL); if (!sev_reclaim_asid_bitmap) - return 1; + goto out; - pr_info("SEV supported\n"); + pr_info("SEV supported: %u ASIDs\n", max_sev_asid - min_sev_asid + 1); + sev_supported = true; - return 0; + /* SEV-ES support requested? */ + if (!sev_es) + goto out; + + /* Does the CPU support SEV-ES? */ + if (!boot_cpu_has(X86_FEATURE_SEV_ES)) + goto out; + + /* Has the system been allocated ASIDs for SEV-ES? */ + if (min_sev_asid == 1) + goto out; + + pr_info("SEV-ES supported: %u ASIDs\n", min_sev_asid - 1); + sev_es_supported = true; + +out: + sev = sev_supported; + sev_es = sev_es_supported; } void sev_hardware_teardown(void) diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index 6dc337b9c231..a1ea30c98629 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -187,9 +187,13 @@ static int vgif = true; module_param(vgif, int, 0444); /* enable/disable SEV support */ -static int sev = IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT); +int sev = IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT); module_param(sev, int, 0444); +/* enable/disable SEV-ES support */ +int sev_es = IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT); +module_param(sev_es, int, 0444); + static bool __read_mostly dump_invalid_vmcb = 0; module_param(dump_invalid_vmcb, bool, 0644); @@ -959,15 +963,11 @@ static __init int svm_hardware_setup(void) kvm_enable_efer_bits(EFER_SVME | EFER_LMSLE); } - if (sev) { - if (boot_cpu_has(X86_FEATURE_SEV) && - IS_ENABLED(CONFIG_KVM_AMD_SEV)) { - r = sev_hardware_setup(); - if (r) - sev = false; - } else { - sev = false; - } + if (IS_ENABLED(CONFIG_KVM_AMD_SEV) && sev) { + sev_hardware_setup(); + } else { + sev = false; + sev_es = false; } svm_adjust_mmio_mask(); diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h index fdff76eb6ceb..56d950df82e5 100644 --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -61,6 +61,7 @@ enum { struct kvm_sev_info { bool active; /* SEV enabled guest */ + bool es_active; /* SEV-ES enabled guest */ unsigned int asid; /* ASID used for this guest */ unsigned int handle; /* SEV firmware handle */ int fd; /* SEV device fd */ @@ -352,6 +353,9 @@ static inline bool gif_set(struct vcpu_svm *svm) #define MSR_CR3_LONG_MBZ_MASK 0xfff0000000000000U #define MSR_INVALID 0xffffffffU +extern int sev; +extern int sev_es; + u32 svm_msrpm_offset(u32 msr); u32 *svm_vcpu_alloc_msrpm(void); void svm_vcpu_init_msrpm(struct kvm_vcpu *vcpu, u32 *msrpm); @@ -484,6 +488,17 @@ static inline bool sev_guest(struct kvm *kvm) #endif } +static inline bool sev_es_guest(struct kvm *kvm) +{ +#ifdef CONFIG_KVM_AMD_SEV + struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info; + + return sev_guest(kvm) && sev->es_active; +#else + return false; +#endif +} + static inline bool svm_sev_enabled(void) { return IS_ENABLED(CONFIG_KVM_AMD_SEV) ? max_sev_asid : 0; @@ -496,7 +511,7 @@ int svm_register_enc_region(struct kvm *kvm, int svm_unregister_enc_region(struct kvm *kvm, struct kvm_enc_region *range); void pre_sev_run(struct vcpu_svm *svm, int cpu); -int __init sev_hardware_setup(void); +void __init sev_hardware_setup(void); void sev_hardware_teardown(void); #endif From patchwork Thu Dec 10 17:09:39 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tom Lendacky X-Patchwork-Id: 11965851 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E1311C4361B for ; Thu, 10 Dec 2020 18:04:48 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7BB1C23C44 for ; Thu, 10 Dec 2020 18:04:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2392027AbgLJSCv (ORCPT ); Thu, 10 Dec 2020 13:02:51 -0500 Received: from mail-dm6nam11on2069.outbound.protection.outlook.com ([40.107.223.69]:37494 "EHLO NAM11-DM6-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S2392599AbgLJRM1 (ORCPT ); Thu, 10 Dec 2020 12:12:27 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=kIpI1OYG2EtQO21gosN8vVeGrdG3/t5ZEI3V5+5PdLMzYvkIl0tCrI1NF2+Ajd5UGgjONG4PpUtzVEpLjvxERNHYLlA9m2kzkHS8rgY6fQvIvUuj+EOGqs4Q9CN6Cxs5wASTCThpbxHQVCEYVKXQwC7t6bqYsAFFwPTAQg0+qcEk2jieaWpKxTXxCfHupEmvOfx87oI7TqdkQRBQT29XcmKw6J6qursE75s4RFQe/Jsl0LTxUo6BgrXxKnPRGTGbLvKDLD0b1sJOoUdvFJMZiUuEGkqTaJks8Djp+iGiTNgDbvDOEsdl3XY0ODtI0vw98pG6Ko7abswEUoeyjdVdCA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=gB2y2HvF8jpTgK1wvNB19tkYSym+XgJS9kDwh7ZQ4PI=; b=FH12PZMUG2VPWqkJqTYBDFlZfmraX/jMgZ1/4M/YhQCb+U8qPatIfxcV7l+CxEHZ1HvPjEieuRw5e0r2ttTR5lnoNd4nOThHCRmO/t0Q3IMZWELM2s9SK1hbvu55TTdk1FLy/Xf2U1/3Zqe4QQWVf24EQ1+ZUlwAmAn3yrhAur9lrN8Bqt0QkPT0lK+TBA16vtiaBwlOyDMXIjeTJTuHd3d+Z69Nf7KA/tq0qV9ocswiLMlrSdSJQAgqs0xbm8beJQ5PWfXJh8i8cUA8sv+7V6UZTHWT1xlJj4eQLJ/4dSGSU+N88vR6Pum0o7yXifJNblq+9o1ihTsfLeFp5dIxMA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amdcloud.onmicrosoft.com; s=selector2-amdcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=gB2y2HvF8jpTgK1wvNB19tkYSym+XgJS9kDwh7ZQ4PI=; b=f2fhhALmykCP7fMbSAyFxfxRQ/4E5cPQKpeLjYYDL9p98ULVFCYf2EfmDoexxiowVDIdnlOj96ztT3CSZzOWdjiqyob3+gT+HYGja/0nuoSIIC/RaF7lBp/gpepcYy9klz97yK/ZXogpRgQ8LXUp4+TBTwn9zgNJsvqruYl5yvc= Authentication-Results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=amd.com; Received: from CY4PR12MB1352.namprd12.prod.outlook.com (2603:10b6:903:3a::13) by CY4PR1201MB0168.namprd12.prod.outlook.com (2603:10b6:910:1d::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3632.22; Thu, 10 Dec 2020 17:10:53 +0000 Received: from CY4PR12MB1352.namprd12.prod.outlook.com ([fe80::a10a:295e:908d:550d]) by CY4PR12MB1352.namprd12.prod.outlook.com ([fe80::a10a:295e:908d:550d%8]) with mapi id 15.20.3632.021; Thu, 10 Dec 2020 17:10:53 +0000 From: Tom Lendacky To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, x86@kernel.org Cc: Paolo Bonzini , Jim Mattson , Joerg Roedel , Sean Christopherson , Vitaly Kuznetsov , Wanpeng Li , Borislav Petkov , Ingo Molnar , Thomas Gleixner , Brijesh Singh Subject: [PATCH v5 04/34] KVM: SVM: Add GHCB accessor functions for retrieving fields Date: Thu, 10 Dec 2020 11:09:39 -0600 Message-Id: <664172c53a5fb4959914e1a45d88e805649af0ad.1607620209.git.thomas.lendacky@amd.com> X-Mailer: git-send-email 2.28.0 In-Reply-To: References: X-Originating-IP: [165.204.77.1] X-ClientProxiedBy: CH2PR10CA0015.namprd10.prod.outlook.com (2603:10b6:610:4c::25) To CY4PR12MB1352.namprd12.prod.outlook.com (2603:10b6:903:3a::13) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from tlendack-t1.amd.com (165.204.77.1) by CH2PR10CA0015.namprd10.prod.outlook.com (2603:10b6:610:4c::25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3654.12 via Frontend Transport; Thu, 10 Dec 2020 17:10:51 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: ef07ad33-fe3a-48f5-46ff-08d89d2e8cfb X-MS-TrafficTypeDiagnostic: CY4PR1201MB0168: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:4941; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: aHP+LP3JXHB0bI7oY8gKLQtXkwRPPpWfHylIvAekvERarTeBhLQbyvHWOiOsG0x1Aq7okq+mmx6a4CBwE9nRMCiCW13FLfNe1Yt+xYAS0N2mOhk6xYqNhcL8iCwrk6t1Fnz97LNoBIDDRGzk12nzbsSvas9EmpD9z8CM4cY9qA8GKxjPRngmDhp8nv22EvRZtkUxIItWur+ElOKidCW/XCPBDetrf2EMw5fSOsHthEtR/XFyf4fLprQmrhYMr7GRejbmFxV4+QvwL7C8hHnCxV+5tNxgqDd8/Oqmgl/7sxBD3lAwfTAXcz2lPXTPSbYSNrnPgnM4byh0qLM0z4/LpGMO8Mecky8lR6Xn3jSkSDA/5KNrIS4bzbsqZwXk9z7h X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CY4PR12MB1352.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(366004)(136003)(346002)(376002)(36756003)(8676002)(6486002)(4326008)(66476007)(86362001)(7416002)(66946007)(7696005)(54906003)(6666004)(26005)(16526019)(34490700003)(66556008)(8936002)(83380400001)(186003)(2906002)(2616005)(52116002)(956004)(508600001)(5660300002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData: H17cp8XOIn4Vr+BrB2eTlcWt3FDSfs36QP4PVZgZ5yDQkQ83ZwNrfBkNngn2UJyddZ5Be82r/d5JpAXJHkgBfm2O7dxpftp7O6QEEFYVI+NWK9RuKKwBsi7MOhGyMsREO/mGbccZnbYjCruAzpG60S4sPUObXeQ0gYTb3d7kom2VEy1CoK9nTxMFBcsWtKVqsn2/pLLXlpGmbEGr59gfKkibLvvM6++iQTmVDDrnNw834g2+0odRIK1a8aR8C6rh9CRijON1o6qBvRWEicPPVceHS7BP0lwhd2p9v7PLDkLqIEoLhz9Fm91csvD8/ZjvwUIk55OD5XyEk7xCUGVOYHqwcdTo+kl76feanP8cn5mK/ZGMBSH5gNMO8v5ktkSiLhTajx+iEI5rrXecrXbSZMs/xBa6NvX2b1zzsnLfMWKh0342gdBevHK/XN2Z06AKbq4SQH7EmNBFjWbOaTX9tREzp8OmxGVHelYoNiOljjmOon5tkH+/rxANwFzOsTT9pdSaryq6eqYzA1s2biqrtP6W1HfWT0N3YTbG2gOg55vkCqq69Li8GBDPzu7RUekZWU2ECr2K0mxiRYWr9XlSkPQZChcYcOqbRL/GE5dYfxfGst0Aunun9bABcFxaq8kbQxCbmED4UT3yEidN7OiyYlzSzl54PfvPQn2T3doWV2B98aHCUIAT/1Joh6znh9znowBDsBK6q84TEFGwS4aJxHGWyTOCMYk2Ma/EG7ztwM7uzVffV8cXKlX2KwNE8d0WHOeaLRrgriSPLoASUpeJmg1XeqlNFmMrFGfkCPmooXuAw6JVbYx+7PUGPpVjP2qnbT+SYy8FPqHT2Uqmu+KTRvP8XSm8FEYRPV3fxuVwAkKUdfP3RTmVlxlV4s+rVpbJiNSxWBr8EYsUzhlPLZMR8Gb6Grs2lXyGEHazrHfZCNv8JvvzaJZJF2WmA+jm7R1fQoxT0E5kD62Y3/5FBAPzADO7uNu1iuKaQhPxVzZPioanQ9QLNBw0I/XDt1/aj0C2 X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-AuthSource: CY4PR12MB1352.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Dec 2020 17:10:53.0970 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-Network-Message-Id: ef07ad33-fe3a-48f5-46ff-08d89d2e8cfb X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 4aSj3HicD42QEvf+07FdPcc062dKJZNz+OXZ8SDPNTxxhwYSHanbLKds/AOdWxkrA5TjRrgAV9LzAgJSt7TlXA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR1201MB0168 Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org From: Tom Lendacky Update the GHCB accessor functions to add functions for retrieve GHCB fields by name. Update existing code to use the new accessor functions. Signed-off-by: Tom Lendacky --- arch/x86/include/asm/svm.h | 10 ++++++++++ arch/x86/kernel/cpu/vmware.c | 12 ++++++------ 2 files changed, 16 insertions(+), 6 deletions(-) diff --git a/arch/x86/include/asm/svm.h b/arch/x86/include/asm/svm.h index 71d630bb5e08..1edf24f51b53 100644 --- a/arch/x86/include/asm/svm.h +++ b/arch/x86/include/asm/svm.h @@ -379,6 +379,16 @@ struct vmcb { (unsigned long *)&ghcb->save.valid_bitmap); \ } \ \ + static inline u64 ghcb_get_##field(struct ghcb *ghcb) \ + { \ + return ghcb->save.field; \ + } \ + \ + static inline u64 ghcb_get_##field##_if_valid(struct ghcb *ghcb) \ + { \ + return ghcb_##field##_is_valid(ghcb) ? ghcb->save.field : 0; \ + } \ + \ static inline void ghcb_set_##field(struct ghcb *ghcb, u64 value) \ { \ __set_bit(GHCB_BITMAP_IDX(field), \ diff --git a/arch/x86/kernel/cpu/vmware.c b/arch/x86/kernel/cpu/vmware.c index 924571fe5864..c6ede3b3d302 100644 --- a/arch/x86/kernel/cpu/vmware.c +++ b/arch/x86/kernel/cpu/vmware.c @@ -501,12 +501,12 @@ static bool vmware_sev_es_hcall_finish(struct ghcb *ghcb, struct pt_regs *regs) ghcb_rbp_is_valid(ghcb))) return false; - regs->bx = ghcb->save.rbx; - regs->cx = ghcb->save.rcx; - regs->dx = ghcb->save.rdx; - regs->si = ghcb->save.rsi; - regs->di = ghcb->save.rdi; - regs->bp = ghcb->save.rbp; + regs->bx = ghcb_get_rbx(ghcb); + regs->cx = ghcb_get_rcx(ghcb); + regs->dx = ghcb_get_rdx(ghcb); + regs->si = ghcb_get_rsi(ghcb); + regs->di = ghcb_get_rdi(ghcb); + regs->bp = ghcb_get_rbp(ghcb); return true; } From patchwork Thu Dec 10 17:09:40 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tom Lendacky X-Patchwork-Id: 11965853 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 90A3FC433FE for ; Thu, 10 Dec 2020 18:04:52 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3806023C44 for ; Thu, 10 Dec 2020 18:04:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2392586AbgLJRME (ORCPT ); Thu, 10 Dec 2020 12:12:04 -0500 Received: from mail-bn8nam11on2055.outbound.protection.outlook.com ([40.107.236.55]:12128 "EHLO NAM11-BN8-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S2404045AbgLJRL7 (ORCPT ); Thu, 10 Dec 2020 12:11:59 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=LEqTtt/aKGMQrqtgtdFWZ5e6m/zAFpv0fLyl9j2wei797ZUOuqIFV5a+8Y7mOsQQwptUz+9t+lMYys0JsRJeZRkUYpjDYOMfK41b5XMP4z3XSATfrZVL3Woy9UGq1X4SbQzA+lTvki1PM4z6ox1GaRNFBuiIsVnPCow4UZtO5X9FdiuDfoxt8ShdlNMzKyy9bW3B98D4XYUCYvFUsmnsfcZpZmc9LOLl8EJdyUGvfkPraa617i4ZkZFlBH8+pjMOCvc5xFfRCulCPiVCN7jJJSeCRXJbfUTgABIPTILmqgEKlkD1sNpUfCA36zN4NnP8yKwhx3EWV138k9xKkbfpkA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=PEtoMDOqwoFYvsVfCzs23UbXbVu8BlXHQGB1s/VyK/A=; b=lwPYgyfvXxzbdB/Pym3kaUZj1cLd0Lvv4KajVPzYzr1kfAXAgXSrB2VQs2BFAFyD6hBxOWbQvaIrJxBBuhxcCNtJzatbjHMinBg9m+lcGy+hPWcRBFy+wC5981ibCOKgRt+H5FQIG/8gfue+lMBsoaJpK93dEIY5tA4t/WkpFopsLHJ2M/Yb3/ynHCgGQkNp6lC2gjEMCsHl24pCKfE9jilfs1Wn9+ojLrMKWPH5zQnKqog55eXxV77qY9P9dGJ2pxMD4XD3GGqUHAmHznk0HTlK9ZJhUyJGO/cnoRwnf3FmThp3Szp4v72Nyj4fj2jL9byBehOv0DWYMM/fJaNlwQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amdcloud.onmicrosoft.com; s=selector2-amdcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=PEtoMDOqwoFYvsVfCzs23UbXbVu8BlXHQGB1s/VyK/A=; b=rpE89F520pnRwzfpEjGaDfex+BrInNqY0UptzW2vjNyy9e2xd9/OXuGoyQQdhXEfr5mQzms1TpUneMU+azIN96hQjj8kE1IkWr/GU3qK9FJjxykecN53r309fHnBmN9NGwbyfWrBacqKMvjW46t7ENSRmtQT1iKpYzpcW+z/dK0= Authentication-Results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=amd.com; Received: from CY4PR12MB1352.namprd12.prod.outlook.com (2603:10b6:903:3a::13) by CY4PR1201MB0149.namprd12.prod.outlook.com (2603:10b6:910:1c::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3654.12; Thu, 10 Dec 2020 17:11:02 +0000 Received: from CY4PR12MB1352.namprd12.prod.outlook.com ([fe80::a10a:295e:908d:550d]) by CY4PR12MB1352.namprd12.prod.outlook.com ([fe80::a10a:295e:908d:550d%8]) with mapi id 15.20.3632.021; Thu, 10 Dec 2020 17:11:02 +0000 From: Tom Lendacky To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, x86@kernel.org Cc: Paolo Bonzini , Jim Mattson , Joerg Roedel , Sean Christopherson , Vitaly Kuznetsov , Wanpeng Li , Borislav Petkov , Ingo Molnar , Thomas Gleixner , Brijesh Singh , kernel test robot Subject: [PATCH v5 05/34] KVM: SVM: Add support for the SEV-ES VMSA Date: Thu, 10 Dec 2020 11:09:40 -0600 Message-Id: X-Mailer: git-send-email 2.28.0 In-Reply-To: References: X-Originating-IP: [165.204.77.1] X-ClientProxiedBy: CH2PR10CA0005.namprd10.prod.outlook.com (2603:10b6:610:4c::15) To CY4PR12MB1352.namprd12.prod.outlook.com (2603:10b6:903:3a::13) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from tlendack-t1.amd.com (165.204.77.1) by CH2PR10CA0005.namprd10.prod.outlook.com (2603:10b6:610:4c::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3654.12 via Frontend Transport; Thu, 10 Dec 2020 17:11:00 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: 2f337d77-b50b-4dd1-3207-08d89d2e9248 X-MS-TrafficTypeDiagnostic: CY4PR1201MB0149: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:8882; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: YszIKkF1XMFN7Xbmd5KeJwpETzawnQPV4KleW7apWMyFZbaLv7OG0NJfzytX5kgjczPtWydyTGV3skCL/HOEaLsappRxaJoyoRSQawx716kF8gJAwE5mr7vZdLja3tW2M52+VoAUzhUN6vx4Ua2XzrJNn296RUIlOHdwgjxIsIM9TTKa3M+/781ejDgpg8ej5f9xSWYY7+Z5eNHWyF3o3W6UURkdSFSEtQ/zYHMsmO8PFCmaMM6QNeiJfVlnNxbu+kTZarwaQUhjOCjkylFHKbiGEy5esqdimkrun0KixQuCuok+tDWhR57lKjm0ElF/Yl5L8HpavT+JsstT82dxm12REI85rF25AcQ6f8WjXaqXP7ZW+DIwKWiRWp0DoZ0J X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CY4PR12MB1352.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(136003)(346002)(376002)(366004)(2906002)(5660300002)(6666004)(26005)(52116002)(186003)(83380400001)(16526019)(54906003)(6486002)(956004)(2616005)(8936002)(7696005)(508600001)(66946007)(66476007)(36756003)(8676002)(86362001)(34490700003)(4326008)(7416002)(66556008);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData: P2rTGfTqrpBmtiSc7FQ440T3exNgbCVCal9VkifnB6uzEet2lt4gZ716V273+/nhFMtG4jTjyqZrDFMBl9zm9ZMQ27vU/LSum6OMWTxfDR0qhztv3ysKQpivED8ugGqu5zuHVJwY9zOQksQ5DhHGWpRth8NqD2zLZzdOGDxsuL22qD7qSUQiTnGgjxA56GWLSX0F+8zjB01cplTHzk/y4HUSX1w/J8xcKJFmgIiglBhY2qNnu8wOqq76gad2h4nys20sffqV1oh+uuOUaf5OzKUCmk3UgwmeIaUw4FX0LSmGhvoWkzp9VBbJnfnCX5cNQrHIwWA279kiyaRFFe6x+j+BuyfRapkBCnBPdF4ZPU5dAbEioCojAzfF6dLk7azkpA6F7xJ2gRdrCpUT0/o8tpBc7euMAgCWqy1F1aLngwZfwZHWwmsbCa4FBEQ+7ASE6DkUPItod2tuUks/fYk3/axq7h0Dl2aA+5YWZhS3MwsnnhlnPlLMGFjcjX27klcQxxp6H3jwDXmzlRiq/DtZz7kR56oc4hhFJ7f2wUPWv4NxvNE+VqaRShfl2MAqg3jJgQLFsnYF7mNxe1UFtWn/MC0/Qp0/u5aaFfBC/Y9hB7URtmw/yvjieeoS2Bp9FSeHjkRI8hIZ5tWWEs1Qx89ujqZycmGAh0TzwjknQqqgAaNV8yQaSLqm18gUZWyh6+7CRHsZdsvj04Jh6Rnool0fUOGpv6078ZkFU+L7kqLRiQd/SUQEivjsgIGhbaMr4D5tcaohWpwvnItNxPh+2IVeWxvD5p838nKHbeVXiMwdjVvcJoEcjArONdO4mAdHsizx9Qg4+wsjNFlEUmfpRpgmRXE5aXkYIybm9IFy8zFGg6ZARFwUE0JHbUR/BOGuBYxpTagIm+lylAJZitxXW9tEJEH3SIN+v4azKyEzNkRLwrqWtReuvkY2IQFZJCLBbaJCCWdj+pjw4fsJtLuWCPzRIWqb2vHZGfbl2o4Nzh8onlX/tx3WrQ4s0titKM3eGqb6 X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-AuthSource: CY4PR12MB1352.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Dec 2020 17:11:02.0057 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-Network-Message-Id: 2f337d77-b50b-4dd1-3207-08d89d2e9248 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: Ci4B11NVpSv52yxG4nvzw/xH1Ap5Fd+1l6iQP9QQGdPX02F+nTQ+kbkhyBV7I5En4AfptLGKY2HhOw31WGAwZg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR1201MB0149 Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org From: Tom Lendacky Allocate a page during vCPU creation to be used as the encrypted VM save area (VMSA) for the SEV-ES guest. Provide a flag in the kvm_vcpu_arch structure that indicates whether the guest state is protected. When freeing a VMSA page that has been encrypted, the cache contents must be flushed using the MSR_AMD64_VM_PAGE_FLUSH before freeing the page. [ i386 build warnings ] Reported-by: kernel test robot Signed-off-by: Tom Lendacky --- arch/x86/include/asm/kvm_host.h | 3 ++ arch/x86/kvm/svm/sev.c | 67 +++++++++++++++++++++++++++++++++ arch/x86/kvm/svm/svm.c | 24 +++++++++++- arch/x86/kvm/svm/svm.h | 5 +++ 4 files changed, 97 insertions(+), 2 deletions(-) diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h index f002cdb13a0b..8cf6b0493d49 100644 --- a/arch/x86/include/asm/kvm_host.h +++ b/arch/x86/include/asm/kvm_host.h @@ -805,6 +805,9 @@ struct kvm_vcpu_arch { */ bool enforce; } pv_cpuid; + + /* Protected Guests */ + bool guest_state_protected; }; struct kvm_lpage_info { diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index 9bf5e9dadff5..fb4a411f7550 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -14,6 +14,7 @@ #include #include #include +#include #include "x86.h" #include "svm.h" @@ -1190,6 +1191,72 @@ void sev_hardware_teardown(void) sev_flush_asids(); } +/* + * Pages used by hardware to hold guest encrypted state must be flushed before + * returning them to the system. + */ +static void sev_flush_guest_memory(struct vcpu_svm *svm, void *va, + unsigned long len) +{ + /* + * If hardware enforced cache coherency for encrypted mappings of the + * same physical page is supported, nothing to do. + */ + if (boot_cpu_has(X86_FEATURE_SME_COHERENT)) + return; + + /* + * If the VM Page Flush MSR is supported, use it to flush the page + * (using the page virtual address and the guest ASID). + */ + if (boot_cpu_has(X86_FEATURE_VM_PAGE_FLUSH)) { + struct kvm_sev_info *sev; + unsigned long va_start; + u64 start, stop; + + /* Align start and stop to page boundaries. */ + va_start = (unsigned long)va; + start = (u64)va_start & PAGE_MASK; + stop = PAGE_ALIGN((u64)va_start + len); + + if (start < stop) { + sev = &to_kvm_svm(svm->vcpu.kvm)->sev_info; + + while (start < stop) { + wrmsrl(MSR_AMD64_VM_PAGE_FLUSH, + start | sev->asid); + + start += PAGE_SIZE; + } + + return; + } + + WARN(1, "Address overflow, using WBINVD\n"); + } + + /* + * Hardware should always have one of the above features, + * but if not, use WBINVD and issue a warning. + */ + WARN_ONCE(1, "Using WBINVD to flush guest memory\n"); + wbinvd_on_all_cpus(); +} + +void sev_free_vcpu(struct kvm_vcpu *vcpu) +{ + struct vcpu_svm *svm; + + if (!sev_es_guest(vcpu->kvm)) + return; + + svm = to_svm(vcpu); + + if (vcpu->arch.guest_state_protected) + sev_flush_guest_memory(svm, svm->vmsa, PAGE_SIZE); + __free_page(virt_to_page(svm->vmsa)); +} + void pre_sev_run(struct vcpu_svm *svm, int cpu) { struct svm_cpu_data *sd = per_cpu(svm_data, cpu); diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index a1ea30c98629..cd4c9884e5a8 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -1289,6 +1289,7 @@ static int svm_create_vcpu(struct kvm_vcpu *vcpu) { struct vcpu_svm *svm; struct page *vmcb_page; + struct page *vmsa_page = NULL; int err; BUILD_BUG_ON(offsetof(struct vcpu_svm, vcpu) != 0); @@ -1299,9 +1300,19 @@ static int svm_create_vcpu(struct kvm_vcpu *vcpu) if (!vmcb_page) goto out; + if (sev_es_guest(svm->vcpu.kvm)) { + /* + * SEV-ES guests require a separate VMSA page used to contain + * the encrypted register state of the guest. + */ + vmsa_page = alloc_page(GFP_KERNEL_ACCOUNT | __GFP_ZERO); + if (!vmsa_page) + goto error_free_vmcb_page; + } + err = avic_init_vcpu(svm); if (err) - goto error_free_vmcb_page; + goto error_free_vmsa_page; /* We initialize this flag to true to make sure that the is_running * bit would be set the first time the vcpu is loaded. @@ -1311,12 +1322,16 @@ static int svm_create_vcpu(struct kvm_vcpu *vcpu) svm->msrpm = svm_vcpu_alloc_msrpm(); if (!svm->msrpm) - goto error_free_vmcb_page; + goto error_free_vmsa_page; svm_vcpu_init_msrpm(vcpu, svm->msrpm); svm->vmcb = page_address(vmcb_page); svm->vmcb_pa = __sme_set(page_to_pfn(vmcb_page) << PAGE_SHIFT); + + if (vmsa_page) + svm->vmsa = page_address(vmsa_page); + svm->asid_generation = 0; init_vmcb(svm); @@ -1325,6 +1340,9 @@ static int svm_create_vcpu(struct kvm_vcpu *vcpu) return 0; +error_free_vmsa_page: + if (vmsa_page) + __free_page(vmsa_page); error_free_vmcb_page: __free_page(vmcb_page); out: @@ -1352,6 +1370,8 @@ static void svm_free_vcpu(struct kvm_vcpu *vcpu) svm_free_nested(svm); + sev_free_vcpu(vcpu); + __free_page(pfn_to_page(__sme_clr(svm->vmcb_pa) >> PAGE_SHIFT)); __free_pages(virt_to_page(svm->msrpm), MSRPM_ALLOC_ORDER); } diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h index 56d950df82e5..80a359f3cf20 100644 --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -168,6 +168,10 @@ struct vcpu_svm { DECLARE_BITMAP(read, MAX_DIRECT_ACCESS_MSRS); DECLARE_BITMAP(write, MAX_DIRECT_ACCESS_MSRS); } shadow_msr_intercept; + + /* SEV-ES support */ + struct vmcb_save_area *vmsa; + struct ghcb *ghcb; }; struct svm_cpu_data { @@ -513,5 +517,6 @@ int svm_unregister_enc_region(struct kvm *kvm, void pre_sev_run(struct vcpu_svm *svm, int cpu); void __init sev_hardware_setup(void); void sev_hardware_teardown(void); +void sev_free_vcpu(struct kvm_vcpu *vcpu); #endif From patchwork Thu Dec 10 17:09:41 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tom Lendacky X-Patchwork-Id: 11965847 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6815AC4361B for ; Thu, 10 Dec 2020 18:02:44 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3217823D57 for ; Thu, 10 Dec 2020 18:02:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2404076AbgLJRMq (ORCPT ); Thu, 10 Dec 2020 12:12:46 -0500 Received: from mail-bn8nam11on2059.outbound.protection.outlook.com ([40.107.236.59]:9021 "EHLO NAM11-BN8-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S2404067AbgLJRMj (ORCPT ); Thu, 10 Dec 2020 12:12:39 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=k8kr7HOR0GEFKJIYFeUnp7AUyYCgmMt8HufJRNU4/g8myLn3SDbWPEV+aiZ5Uth4fDhBpw1Umjsn764uFJeZKzfAqK5bL9qHRLQVfbrtPSyx8MnWjd27neFCiGMzTzfhVAC4AocyoxTLUe88vSz7Ye/hjqRHliO0Gz1PE6/uSSQJDoPtD+AvEAtpCNRe4L0UeN0EoeiLxj2qBBUdwh+In9o0baKA6fY6nBjloVy2MeAOoffk3mI8m3Zv6RZOu9Jy5P29XaT61XUJBpxu5POiI93ZMsA2Ki26oPkwdZvmW9FrtAYFV0j9K+nU4nXgI3Iule/9AbMzB83GTo7teM7LCw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rNpGrI8E+zoQzAPMKkV6Q6EDhfv6bqXT4aefVvOLq8Y=; b=lC1RiTWLg07pi+cWXk3XxHGU26IzZOxTJd8wGCh0ALFoHoFaDhR0Vl50PGH+65QKcXXtHNd933w6nao1mMKjBERhEWhBcvCXGPxYc+PocQSiqMqjtuu9Dl7tZGZOIRUwYuOfDaWIjvIZ5beamZqI9FqR4Y/qek6kTLZXnD+pXkCiHtzYJ++s3XwZQKMTRYQP2/bdvzAkYkulDsqe75a9ZGRPDHE0GkqNQ/jPjHzMwjBZaAklUUgkairSrQclRZ2TZ/DuDeU3dwYQZyY64vxnOG7SX8wRB+ZXZOO0G1DLngHXx/T2CBKrhauc4ILb7epV+OZQzCwZvH2Ffthc0Cd/ZA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amdcloud.onmicrosoft.com; s=selector2-amdcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rNpGrI8E+zoQzAPMKkV6Q6EDhfv6bqXT4aefVvOLq8Y=; b=oG5nN/l/m9hpmXfNzWu+AG4Tpm7/zXCVGILQnXfoezzivZ/mYYAMJ0gUvwAgXjVKKMuLTnXL2ptXwxYNfJOEpPPeq6QUn123ixJn9/vZRVHF6wfKlOhcM2raU006PORDk5/Bbzgn47BMai1duBr2BOfHAzXdjNrs4m/pbkSzVeY= Authentication-Results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=amd.com; Received: from CY4PR12MB1352.namprd12.prod.outlook.com (2603:10b6:903:3a::13) by CY4PR1201MB0149.namprd12.prod.outlook.com (2603:10b6:910:1c::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3654.12; Thu, 10 Dec 2020 17:11:11 +0000 Received: from CY4PR12MB1352.namprd12.prod.outlook.com ([fe80::a10a:295e:908d:550d]) by CY4PR12MB1352.namprd12.prod.outlook.com ([fe80::a10a:295e:908d:550d%8]) with mapi id 15.20.3632.021; Thu, 10 Dec 2020 17:11:11 +0000 From: Tom Lendacky To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, x86@kernel.org Cc: Paolo Bonzini , Jim Mattson , Joerg Roedel , Sean Christopherson , Vitaly Kuznetsov , Wanpeng Li , Borislav Petkov , Ingo Molnar , Thomas Gleixner , Brijesh Singh Subject: [PATCH v5 06/34] KVM: x86: Mark GPRs dirty when written Date: Thu, 10 Dec 2020 11:09:41 -0600 Message-Id: <7ca2a1cdb61456f2fe9c64193e34d601e395c133.1607620209.git.thomas.lendacky@amd.com> X-Mailer: git-send-email 2.28.0 In-Reply-To: References: X-Originating-IP: [165.204.77.1] X-ClientProxiedBy: CH2PR10CA0027.namprd10.prod.outlook.com (2603:10b6:610:4c::37) To CY4PR12MB1352.namprd12.prod.outlook.com (2603:10b6:903:3a::13) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from tlendack-t1.amd.com (165.204.77.1) by CH2PR10CA0027.namprd10.prod.outlook.com (2603:10b6:610:4c::37) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3654.12 via Frontend Transport; Thu, 10 Dec 2020 17:11:09 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: c7499dcb-f2dc-4b9c-17ce-08d89d2e97a9 X-MS-TrafficTypeDiagnostic: CY4PR1201MB0149: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:3173; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: QVZXdyBclx/patpUSftfXXtfQ0SJqZG/FcYV3CkiGrfA9R9x65b3b73GGsIyP6aCVAXGDg8VS/MvByHflvbgE1KAJu1cEFS8ctalQoHhOuLnI7F6Lni1olJ41XXcqmiygmGUDMIzSUdZtgWtDT317gxjaOZkNDFtURM6HXDuIC+bRFojR7MePcwngpNqyj4DlBt2uoSCVJ/ND0UyQAn9u452eK7ddcPIiSLeX9FVZrvMvCkrbNV8JRjacovUJXL8K8f5lOEAU3U0Qi37gaaWI2/LSvViJlvP45L5o1g4eL6i6R0mSNbU2QwD4U7jYPHfIHu838qW7FYoyN9LFAeXpwJdEHq3wSwznGpOqKsfBQRtMR11sdlTLqKC7frLtQvr24S9fPj9LLeSDqeyFBnDGg== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CY4PR12MB1352.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(136003)(346002)(376002)(366004)(2906002)(5660300002)(6666004)(26005)(52116002)(186003)(83380400001)(16526019)(54906003)(6486002)(956004)(2616005)(8936002)(7696005)(508600001)(66946007)(66476007)(36756003)(8676002)(86362001)(34490700003)(4326008)(7416002)(66556008)(14143004);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData: p12KSEZymiKGpklUtAZRnBhILFkOEBhJsRBUcr/nh+bm8y+y5333fpmuFdWi/M0knM88+Fdcug/XRQtcTpB2n58/pozSL2fTjh6ODpgsOB7e6fdTtmP0eGm5x0R25QOi2+ZWEVkuWt4wPbntClEEQ9X4bJdghMMt1IxNvcJWfj/lKmdeRtjRJvrE7EEuZdT0FEjiAUIbSPSn9L0aINsPyCQDwub+JjarN+gwYL6CLOqfEHHDJQvH8M/axgfCZjZxRZtE1TbKeTmzD1+Q88mus0c0sO1fDCwYiqgJI7oUtAovKilntZCoPemwPHxBVLsToFCmT+xE2/5Gj/HYK2SUUbCK5M9csp16rUlNtQ+XlIcSxxgCwNX+QlA3DNSRwgvf9Q/YljuJ6OYXmiay4UdYvotmpoJ2QAWD5olGMvpx/5eu08V4LfiZWtH0bxyVVrhObVjFwmDzN7dnOlI9mEqvUceFi6eOrztoqdlY2ULTZvuRzyzzpzuC2t9NCsKKM0EhNtf5aODq8U6BKEZ1MuFzmj3tRtePcShR1uqNy/97Aarxs0QSoCsMP5s15vEliaGD0EJ06k6s83K0FPYYYmrNKTc8EOpfvnS+OAMbXLdSPC9BeFl4etSRzsgCgnLAql9V8CihoKXEiZTu1M42/eCpvjM8213V6t1hopveJinWkagGgHfCQLUxN6eQs+IjkqupidaEIYuwoJWow/9d53paWS9q+PBY2GTPyT2lYCCkClaitGEMlEPP4t0wK0jZwjfMNU7FF4EsYABxIzeSzCgYtXUUcekC+1AMx2stLUvl1yWVIraNykS64eODADfZawuV5c710eZVv5ckwWlixCGSzA/CQlznXV5whv6H90xZBucfCPBr6S2JVxJdKWJt/hEN4OM+8Wy8l1Bp21sMmLpaTLXIP/caCJI85wei9jsFMcr9j2peG3ZKYlgxz/mcKzit/GkKz/UbpOR8pCwiNjUfbNDTikwUUqXQ5hoqahUZbFiyIq8lBvFm47ii1HHbDwle X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-AuthSource: CY4PR12MB1352.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Dec 2020 17:11:11.0453 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-Network-Message-Id: c7499dcb-f2dc-4b9c-17ce-08d89d2e97a9 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: HAxP/xSxuwLGn24+IsN4JSFX/oVnwLYp0QRRZuTihYk3lmB3tRig445BJKfMLm5PZdrDPMWZhSofwByCiZSwcQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR1201MB0149 Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org From: Tom Lendacky When performing VMGEXIT processing for an SEV-ES guest, register values will be synced between KVM and the GHCB. Prepare for detecting when a GPR has been updated (marked dirty) in order to determine whether to sync the register to the GHCB. Signed-off-by: Tom Lendacky --- arch/x86/kvm/kvm_cache_regs.h | 51 ++++++++++++++++++----------------- 1 file changed, 26 insertions(+), 25 deletions(-) diff --git a/arch/x86/kvm/kvm_cache_regs.h b/arch/x86/kvm/kvm_cache_regs.h index a889563ad02d..f15bc16de07c 100644 --- a/arch/x86/kvm/kvm_cache_regs.h +++ b/arch/x86/kvm/kvm_cache_regs.h @@ -9,6 +9,31 @@ (X86_CR4_PVI | X86_CR4_DE | X86_CR4_PCE | X86_CR4_OSFXSR \ | X86_CR4_OSXMMEXCPT | X86_CR4_PGE | X86_CR4_TSD | X86_CR4_FSGSBASE) +static inline bool kvm_register_is_available(struct kvm_vcpu *vcpu, + enum kvm_reg reg) +{ + return test_bit(reg, (unsigned long *)&vcpu->arch.regs_avail); +} + +static inline bool kvm_register_is_dirty(struct kvm_vcpu *vcpu, + enum kvm_reg reg) +{ + return test_bit(reg, (unsigned long *)&vcpu->arch.regs_dirty); +} + +static inline void kvm_register_mark_available(struct kvm_vcpu *vcpu, + enum kvm_reg reg) +{ + __set_bit(reg, (unsigned long *)&vcpu->arch.regs_avail); +} + +static inline void kvm_register_mark_dirty(struct kvm_vcpu *vcpu, + enum kvm_reg reg) +{ + __set_bit(reg, (unsigned long *)&vcpu->arch.regs_avail); + __set_bit(reg, (unsigned long *)&vcpu->arch.regs_dirty); +} + #define BUILD_KVM_GPR_ACCESSORS(lname, uname) \ static __always_inline unsigned long kvm_##lname##_read(struct kvm_vcpu *vcpu)\ { \ @@ -18,6 +43,7 @@ static __always_inline void kvm_##lname##_write(struct kvm_vcpu *vcpu, \ unsigned long val) \ { \ vcpu->arch.regs[VCPU_REGS_##uname] = val; \ + kvm_register_mark_dirty(vcpu, VCPU_REGS_##uname); \ } BUILD_KVM_GPR_ACCESSORS(rax, RAX) BUILD_KVM_GPR_ACCESSORS(rbx, RBX) @@ -37,31 +63,6 @@ BUILD_KVM_GPR_ACCESSORS(r14, R14) BUILD_KVM_GPR_ACCESSORS(r15, R15) #endif -static inline bool kvm_register_is_available(struct kvm_vcpu *vcpu, - enum kvm_reg reg) -{ - return test_bit(reg, (unsigned long *)&vcpu->arch.regs_avail); -} - -static inline bool kvm_register_is_dirty(struct kvm_vcpu *vcpu, - enum kvm_reg reg) -{ - return test_bit(reg, (unsigned long *)&vcpu->arch.regs_dirty); -} - -static inline void kvm_register_mark_available(struct kvm_vcpu *vcpu, - enum kvm_reg reg) -{ - __set_bit(reg, (unsigned long *)&vcpu->arch.regs_avail); -} - -static inline void kvm_register_mark_dirty(struct kvm_vcpu *vcpu, - enum kvm_reg reg) -{ - __set_bit(reg, (unsigned long *)&vcpu->arch.regs_avail); - __set_bit(reg, (unsigned long *)&vcpu->arch.regs_dirty); -} - static inline unsigned long kvm_register_read(struct kvm_vcpu *vcpu, int reg) { if (WARN_ON_ONCE((unsigned int)reg >= NR_VCPU_REGS)) From patchwork Thu Dec 10 17:09:42 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tom Lendacky X-Patchwork-Id: 11965849 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F28ACC433FE for ; Thu, 10 Dec 2020 18:02:51 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id B2A2B23D57 for ; Thu, 10 Dec 2020 18:02:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2392672AbgLJSCv (ORCPT ); Thu, 10 Dec 2020 13:02:51 -0500 Received: from mail-bn8nam11on2055.outbound.protection.outlook.com ([40.107.236.55]:12128 "EHLO NAM11-BN8-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S2392598AbgLJRMZ (ORCPT ); Thu, 10 Dec 2020 12:12:25 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=FY4srpZfhdtxeJ9XMI5AFsyICEceknNOhE1ILTOmLFXj5uZMKfYc/vqG2xbeQuPWwLdZkJLQ6hu7P8b8OPP+eCoZNY+qctEFuOcPBi+24dhT4Fho2CyyedkRt3iQtXYQmFbK4UgErEzV20/tegfOEhzEF0i0ejxAohySxhlXIkt0xkjeDwieDT1x05ODQY/BXDC0KxT2rzyiqeO1fV1v+qZwgUqmOe+I9BRgy/yECuSojYMjrkHgdHiwBuy8ASyN4TypPds97C4O6gozzwsbAdZM/bL+OASYJkVSvofBvSA1vrh8SUCmWuJUzFz/jF0wZxbr6lCC4GyXOh3hsXOyHQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/x/KtVi8hPGFLO6vKOwtBAPv4dLHZ2GgBJEUvm+W/dI=; b=V/P4UqA7slGI2TElJoT72NyT3r4AGAtHxP1WipYMlLoZrYdFahXzxg3FwVE0Tnx1qoQw+rHJBGOVf0xvB2yW9vBOM59Kw3FZrSHv75/mbQY73TMcWfFSZV0sXmBzIULp961br0jVxdT/JH7yJr8CoRfsjH/SrCDsA5fUtqtX6oNQTc3YFShOeIA9zI4uJgRb5JCWihqL2JP0rMKTtQOBMcE2g7L72xAWn8qFmk0vhd+phk/tU2OsLIdLORIhuz5l7A2ZOAWKImLfXQyB1fKyvq+dSJ9MFmoZPSYO+/TMlGplyD28UIR/LLrnh/tD6ToL6QozLjg+pQtTvaug8ewK0Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amdcloud.onmicrosoft.com; s=selector2-amdcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/x/KtVi8hPGFLO6vKOwtBAPv4dLHZ2GgBJEUvm+W/dI=; b=MFVPFf84bfBGeMJjKCIjRhs/kdutstkWNc+k2gU5lZjyiv15UXvtgdXriuIuZe6+A9knLrMdXTnQfmJwYP7gu81lyhSM8e63AklPXP7WyHS9WuZHVEcEQX3nM+HpGrOnCm0PLHldLqTKORunS/YjMbeLcFq7IvfISRaXi81cDZw= Authentication-Results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=amd.com; Received: from CY4PR12MB1352.namprd12.prod.outlook.com (2603:10b6:903:3a::13) by CY4PR1201MB0149.namprd12.prod.outlook.com (2603:10b6:910:1c::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3654.12; Thu, 10 Dec 2020 17:11:20 +0000 Received: from CY4PR12MB1352.namprd12.prod.outlook.com ([fe80::a10a:295e:908d:550d]) by CY4PR12MB1352.namprd12.prod.outlook.com ([fe80::a10a:295e:908d:550d%8]) with mapi id 15.20.3632.021; Thu, 10 Dec 2020 17:11:19 +0000 From: Tom Lendacky To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, x86@kernel.org Cc: Paolo Bonzini , Jim Mattson , Joerg Roedel , Sean Christopherson , Vitaly Kuznetsov , Wanpeng Li , Borislav Petkov , Ingo Molnar , Thomas Gleixner , Brijesh Singh Subject: [PATCH v5 07/34] KVM: SVM: Add required changes to support intercepts under SEV-ES Date: Thu, 10 Dec 2020 11:09:42 -0600 Message-Id: X-Mailer: git-send-email 2.28.0 In-Reply-To: References: X-Originating-IP: [165.204.77.1] X-ClientProxiedBy: CH2PR10CA0018.namprd10.prod.outlook.com (2603:10b6:610:4c::28) To CY4PR12MB1352.namprd12.prod.outlook.com (2603:10b6:903:3a::13) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from tlendack-t1.amd.com (165.204.77.1) by CH2PR10CA0018.namprd10.prod.outlook.com (2603:10b6:610:4c::28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3654.12 via Frontend Transport; Thu, 10 Dec 2020 17:11:18 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: f75ace3c-09d8-4c71-b996-08d89d2e9cea X-MS-TrafficTypeDiagnostic: CY4PR1201MB0149: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:9508; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: Xyn/YV4gVTYDUP+7jQfjbau2tBnO7Tv9gLf0MgTfIGFekRjE4XGUPbj3QqlZQAVq7dWkV1nCiSYt5ItsUnGTDHX/6rS+uF/PWk0KbYiv3rDyiXfOQTnHHDUgNbDGRQGDPuhmQGkMsYdzH967yvn5rmNuauipxJxkX53eJvufT5B74Q3G3FLri2Lm4415spRtByswg9eKgFEDxUldEKsaGi+TzqW3RtnsTp1SqwQD9tkwU+hQlTEnwutIbiWQgMsSHBEn76V892Yblv76HQxM8AHCS4bOg8C/C0Plx+QEqW7ezoGwikA55WNRBFLNAbzP2rZjFXmF4HsFgWRjkOw2cv9cgZyHVXruq5Pr/UUtQ4lI00UnJNgYKNYmaGxiNn3H X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CY4PR12MB1352.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(136003)(346002)(376002)(366004)(2906002)(5660300002)(6666004)(26005)(52116002)(186003)(83380400001)(16526019)(54906003)(6486002)(956004)(2616005)(8936002)(7696005)(508600001)(66946007)(66476007)(36756003)(8676002)(86362001)(34490700003)(4326008)(7416002)(66556008);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData: hefccWGge5E7BkZW4QsEAP6PBdLHHeC12fuebOC0t7a7wbdeGMiVKzcdw3nsytFWAUi/UeqLvIEesf1EvlTy14GRB9OOUuztEZs7ZTh/1osj5T0ag/st95ohzJ5H5NkDuxIsodvjAt2a8BOcDa3bSj/nc57jKXU39dlLn888EZ2j/X+cvLPsTslDj77nwt17gcEu+RRVkEiWdm8+xmkF4VwLsu9wYFf94arTznyS0caFRuDGI8+UoCHtsDIARItlLxdsVrTq4v2bZ3c6qPq4AQPGl+Q75T1M56WhaO1W558tOx2ZJPcksX9RCGwwWjT64ciriKdW8speR3BxrIpAma4TC0CWyu/J9lvChHTGmKn1dxoq/G0lZZLNSphsUbZB2QRjtB679RUTes3Z8cQllWMsCa9EzmcUXxTm4bJ5JG6tVB308P/JOZyu66prEimASzWXMTGYaQt5kLiT3TqnxkjTppzF6FunaLKoGKHiukRg1W6v5lmPOTBHrJgdRej2YYdgcnUH+SNT+LJlN/3UlnmnsG97FsxS4vkI95BYjBFSsIOoQrhnYTNEA/LpCccEhUcg9WH74ev/WfXjQBRtmJ2SNkVRyi90XF5scoe32pGqglyGo3DG56HGRqAbm1ywfvIr5oTd0zDPcVHid/Z38noEEifeHvn0H3+rFDR9CnQBApsVDMqkOQaEiWg2AV6ZzdddaVJkmyFwTWvNtpm085xKf/K7jW6OlOGKdu2Dmuqp2TatansRlWpJFWoA+8VhZCDF0j1sxUbS+H5Buq7Sq/AbUwBqF3tP9+ZCqb9TfcHdWCm3pduvR6wHQ9SxtNhSZbWx9I4wez2v6q1V8pzykHcHOkzuWkLH6UHtcEwRfB8hN0WdT7Q7f0tFCfttfD63v5lYXq6RiwpWvcWzbE0nKNDnUlkLFslFLqJIKxmehecRjsSzEVvRHgFN5EUDzzQc4EywFnYULuOVAWqUL2v8RiDwbDjAlB6QP0xwIPIG0hDVpFU5gyGEu7PESFWp9Jh9 X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-AuthSource: CY4PR12MB1352.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Dec 2020 17:11:19.8130 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-Network-Message-Id: f75ace3c-09d8-4c71-b996-08d89d2e9cea X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: pV9gsyfVIreujRaC5BgPQKqQZfN1SFDA6npkKqrzRlZ7ZkukrhNf3LakOpQBR4XOgdqrmyfwdqCZgApp9svUuw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR1201MB0149 Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org From: Tom Lendacky When a guest is running under SEV-ES, the hypervisor cannot access the guest register state. There are numerous places in the KVM code where certain registers are accessed that are not allowed to be accessed (e.g. RIP, CR0, etc). Add checks to prevent register accesses and add intercept update support at various points within the KVM code. Also, when handling a VMGEXIT, exceptions are passed back through the GHCB. Since the RDMSR/WRMSR intercepts (may) inject a #GP on error, update the SVM intercepts to handle this for SEV-ES guests. Signed-off-by: Tom Lendacky --- arch/x86/include/asm/svm.h | 3 +- arch/x86/kvm/svm/svm.c | 111 +++++++++++++++++++++++++++++++++---- arch/x86/kvm/x86.c | 6 +- 3 files changed, 107 insertions(+), 13 deletions(-) diff --git a/arch/x86/include/asm/svm.h b/arch/x86/include/asm/svm.h index 1edf24f51b53..bce28482d63d 100644 --- a/arch/x86/include/asm/svm.h +++ b/arch/x86/include/asm/svm.h @@ -178,7 +178,8 @@ struct __attribute__ ((__packed__)) vmcb_control_area { #define LBR_CTL_ENABLE_MASK BIT_ULL(0) #define VIRTUAL_VMLOAD_VMSAVE_ENABLE_MASK BIT_ULL(1) -#define SVM_INTERRUPT_SHADOW_MASK 1 +#define SVM_INTERRUPT_SHADOW_MASK BIT_ULL(0) +#define SVM_GUEST_INTERRUPT_MASK BIT_ULL(1) #define SVM_IOIO_STR_SHIFT 2 #define SVM_IOIO_REP_SHIFT 3 diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index cd4c9884e5a8..857d0d3f2752 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -36,6 +36,7 @@ #include #include #include +#include #include #include "trace.h" @@ -340,6 +341,13 @@ static int skip_emulated_instruction(struct kvm_vcpu *vcpu) { struct vcpu_svm *svm = to_svm(vcpu); + /* + * SEV-ES does not expose the next RIP. The RIP update is controlled by + * the type of exit and the #VC handler in the guest. + */ + if (sev_es_guest(vcpu->kvm)) + goto done; + if (nrips && svm->vmcb->control.next_rip != 0) { WARN_ON_ONCE(!static_cpu_has(X86_FEATURE_NRIPS)); svm->next_rip = svm->vmcb->control.next_rip; @@ -351,6 +359,8 @@ static int skip_emulated_instruction(struct kvm_vcpu *vcpu) } else { kvm_rip_write(vcpu, svm->next_rip); } + +done: svm_set_interrupt_shadow(vcpu, 0); return 1; @@ -1652,9 +1662,18 @@ static void svm_set_gdt(struct kvm_vcpu *vcpu, struct desc_ptr *dt) static void update_cr0_intercept(struct vcpu_svm *svm) { - ulong gcr0 = svm->vcpu.arch.cr0; - u64 *hcr0 = &svm->vmcb->save.cr0; + ulong gcr0; + u64 *hcr0; + + /* + * SEV-ES guests must always keep the CR intercepts cleared. CR + * tracking is done using the CR write traps. + */ + if (sev_es_guest(svm->vcpu.kvm)) + return; + gcr0 = svm->vcpu.arch.cr0; + hcr0 = &svm->vmcb->save.cr0; *hcr0 = (*hcr0 & ~SVM_CR0_SELECTIVE_MASK) | (gcr0 & SVM_CR0_SELECTIVE_MASK); @@ -1674,7 +1693,7 @@ void svm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0) struct vcpu_svm *svm = to_svm(vcpu); #ifdef CONFIG_X86_64 - if (vcpu->arch.efer & EFER_LME) { + if (vcpu->arch.efer & EFER_LME && !vcpu->arch.guest_state_protected) { if (!is_paging(vcpu) && (cr0 & X86_CR0_PG)) { vcpu->arch.efer |= EFER_LMA; svm->vmcb->save.efer |= EFER_LMA | EFER_LME; @@ -2608,7 +2627,29 @@ static int svm_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) static int rdmsr_interception(struct vcpu_svm *svm) { - return kvm_emulate_rdmsr(&svm->vcpu); + u32 ecx; + u64 data; + + if (!sev_es_guest(svm->vcpu.kvm)) + return kvm_emulate_rdmsr(&svm->vcpu); + + ecx = kvm_rcx_read(&svm->vcpu); + if (kvm_get_msr(&svm->vcpu, ecx, &data)) { + trace_kvm_msr_read_ex(ecx); + ghcb_set_sw_exit_info_1(svm->ghcb, 1); + ghcb_set_sw_exit_info_2(svm->ghcb, + X86_TRAP_GP | + SVM_EVTINJ_TYPE_EXEPT | + SVM_EVTINJ_VALID); + return 1; + } + + trace_kvm_msr_read(ecx, data); + + kvm_rax_write(&svm->vcpu, data & -1u); + kvm_rdx_write(&svm->vcpu, (data >> 32) & -1u); + + return kvm_skip_emulated_instruction(&svm->vcpu); } static int svm_set_vm_cr(struct kvm_vcpu *vcpu, u64 data) @@ -2797,7 +2838,27 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr) static int wrmsr_interception(struct vcpu_svm *svm) { - return kvm_emulate_wrmsr(&svm->vcpu); + u32 ecx; + u64 data; + + if (!sev_es_guest(svm->vcpu.kvm)) + return kvm_emulate_wrmsr(&svm->vcpu); + + ecx = kvm_rcx_read(&svm->vcpu); + data = kvm_read_edx_eax(&svm->vcpu); + if (kvm_set_msr(&svm->vcpu, ecx, data)) { + trace_kvm_msr_write_ex(ecx, data); + ghcb_set_sw_exit_info_1(svm->ghcb, 1); + ghcb_set_sw_exit_info_2(svm->ghcb, + X86_TRAP_GP | + SVM_EVTINJ_TYPE_EXEPT | + SVM_EVTINJ_VALID); + return 1; + } + + trace_kvm_msr_write(ecx, data); + + return kvm_skip_emulated_instruction(&svm->vcpu); } static int msr_interception(struct vcpu_svm *svm) @@ -2827,7 +2888,14 @@ static int interrupt_window_interception(struct vcpu_svm *svm) static int pause_interception(struct vcpu_svm *svm) { struct kvm_vcpu *vcpu = &svm->vcpu; - bool in_kernel = (svm_get_cpl(vcpu) == 0); + bool in_kernel; + + /* + * CPL is not made available for an SEV-ES guest, so just set in_kernel + * to true. + */ + in_kernel = (sev_es_guest(svm->vcpu.kvm)) ? true + : (svm_get_cpl(vcpu) == 0); if (!kvm_pause_in_guest(vcpu->kvm)) grow_ple_window(vcpu); @@ -3090,10 +3158,13 @@ static int handle_exit(struct kvm_vcpu *vcpu, fastpath_t exit_fastpath) trace_kvm_exit(exit_code, vcpu, KVM_ISA_SVM); - if (!svm_is_intercept(svm, INTERCEPT_CR0_WRITE)) - vcpu->arch.cr0 = svm->vmcb->save.cr0; - if (npt_enabled) - vcpu->arch.cr3 = svm->vmcb->save.cr3; + /* SEV-ES guests must use the CR write traps to track CR registers. */ + if (!sev_es_guest(vcpu->kvm)) { + if (!svm_is_intercept(svm, INTERCEPT_CR0_WRITE)) + vcpu->arch.cr0 = svm->vmcb->save.cr0; + if (npt_enabled) + vcpu->arch.cr3 = svm->vmcb->save.cr3; + } if (is_guest_mode(vcpu)) { int vmexit; @@ -3205,6 +3276,13 @@ static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr) { struct vcpu_svm *svm = to_svm(vcpu); + /* + * SEV-ES guests must always keep the CR intercepts cleared. CR + * tracking is done using the CR write traps. + */ + if (sev_es_guest(vcpu->kvm)) + return; + if (nested_svm_virtualize_tpr(vcpu)) return; @@ -3273,6 +3351,13 @@ bool svm_interrupt_blocked(struct kvm_vcpu *vcpu) struct vcpu_svm *svm = to_svm(vcpu); struct vmcb *vmcb = svm->vmcb; + /* + * SEV-ES guests to not expose RFLAGS. Use the VMCB interrupt mask + * bit to determine the state of the IF flag. + */ + if (sev_es_guest(svm->vcpu.kvm)) + return !(vmcb->control.int_state & SVM_GUEST_INTERRUPT_MASK); + if (!gif_set(svm)) return true; @@ -3458,6 +3543,12 @@ static void svm_complete_interrupts(struct vcpu_svm *svm) svm->vcpu.arch.nmi_injected = true; break; case SVM_EXITINTINFO_TYPE_EXEPT: + /* + * Never re-inject a #VC exception. + */ + if (vector == X86_TRAP_VC) + break; + /* * In case of software exceptions, do not reinject the vector, * but re-execute the instruction instead. Rewind RIP first diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index a3fdc16cfd6f..b6809a2851d2 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -4018,7 +4018,7 @@ void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu) { int idx; - if (vcpu->preempted) + if (vcpu->preempted && !vcpu->arch.guest_state_protected) vcpu->arch.preempted_in_kernel = !kvm_x86_ops.get_cpl(vcpu); /* @@ -8161,7 +8161,9 @@ static void post_kvm_run_save(struct kvm_vcpu *vcpu) { struct kvm_run *kvm_run = vcpu->run; - kvm_run->if_flag = (kvm_get_rflags(vcpu) & X86_EFLAGS_IF) != 0; + kvm_run->if_flag = (vcpu->arch.guest_state_protected) + ? kvm_arch_interrupt_allowed(vcpu) + : (kvm_get_rflags(vcpu) & X86_EFLAGS_IF) != 0; kvm_run->flags = is_smm(vcpu) ? KVM_RUN_X86_SMM : 0; kvm_run->cr8 = kvm_get_cr8(vcpu); kvm_run->apic_base = kvm_get_apic_base(vcpu);