lkml.org 
[lkml]   [2021]   [Aug]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH Part2 v5 36/45] KVM: SVM: Add support to handle GHCB GPA register VMGEXIT
    Date
    SEV-SNP guests are required to perform a GHCB GPA registration. Before
    using a GHCB GPA for a vCPU the first time, a guest must register the
    vCPU GHCB GPA. If hypervisor can work with the guest requested GPA then
    it must respond back with the same GPA otherwise return -1.

    On VMEXIT, Verify that GHCB GPA matches with the registered value. If a
    mismatch is detected then abort the guest.

    Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
    ---
    arch/x86/include/asm/sev-common.h | 8 ++++++++
    arch/x86/kvm/svm/sev.c | 27 +++++++++++++++++++++++++++
    arch/x86/kvm/svm/svm.h | 7 +++++++
    3 files changed, 42 insertions(+)

    diff --git a/arch/x86/include/asm/sev-common.h b/arch/x86/include/asm/sev-common.h
    index 779c7e8f836c..91089967ab09 100644
    --- a/arch/x86/include/asm/sev-common.h
    +++ b/arch/x86/include/asm/sev-common.h
    @@ -59,6 +59,14 @@
    #define GHCB_MSR_AP_RESET_HOLD_RESULT_POS 12
    #define GHCB_MSR_AP_RESET_HOLD_RESULT_MASK GENMASK_ULL(51, 0)

    +/* Preferred GHCB GPA Request */
    +#define GHCB_MSR_PREF_GPA_REQ 0x010
    +#define GHCB_MSR_GPA_VALUE_POS 12
    +#define GHCB_MSR_GPA_VALUE_MASK GENMASK_ULL(51, 0)
    +
    +#define GHCB_MSR_PREF_GPA_RESP 0x011
    +#define GHCB_MSR_PREF_GPA_NONE 0xfffffffffffff
    +
    /* GHCB GPA Register */
    #define GHCB_MSR_REG_GPA_REQ 0x012
    #define GHCB_MSR_REG_GPA_REQ_VAL(v) \
    diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
    index c41d972dadc3..991b8c996fc1 100644
    --- a/arch/x86/kvm/svm/sev.c
    +++ b/arch/x86/kvm/svm/sev.c
    @@ -2984,6 +2984,27 @@ static int sev_handle_vmgexit_msr_protocol(struct vcpu_svm *svm)
    GHCB_MSR_INFO_MASK, GHCB_MSR_INFO_POS);
    break;
    }
    + case GHCB_MSR_PREF_GPA_REQ: {
    + set_ghcb_msr_bits(svm, GHCB_MSR_PREF_GPA_NONE, GHCB_MSR_GPA_VALUE_MASK,
    + GHCB_MSR_GPA_VALUE_POS);
    + set_ghcb_msr_bits(svm, GHCB_MSR_PREF_GPA_RESP, GHCB_MSR_INFO_MASK,
    + GHCB_MSR_INFO_POS);
    + break;
    + }
    + case GHCB_MSR_REG_GPA_REQ: {
    + u64 gfn;
    +
    + gfn = get_ghcb_msr_bits(svm, GHCB_MSR_GPA_VALUE_MASK,
    + GHCB_MSR_GPA_VALUE_POS);
    +
    + svm->ghcb_registered_gpa = gfn_to_gpa(gfn);
    +
    + set_ghcb_msr_bits(svm, gfn, GHCB_MSR_GPA_VALUE_MASK,
    + GHCB_MSR_GPA_VALUE_POS);
    + set_ghcb_msr_bits(svm, GHCB_MSR_REG_GPA_RESP, GHCB_MSR_INFO_MASK,
    + GHCB_MSR_INFO_POS);
    + break;
    + }
    case GHCB_MSR_TERM_REQ: {
    u64 reason_set, reason_code;

    @@ -3024,6 +3045,12 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu)
    return -EINVAL;
    }

    + /* SEV-SNP guest requires that the GHCB GPA must be registered */
    + if (sev_snp_guest(svm->vcpu.kvm) && !ghcb_gpa_is_registered(svm, ghcb_gpa)) {
    + vcpu_unimpl(&svm->vcpu, "vmgexit: GHCB GPA [%#llx] is not registered.\n", ghcb_gpa);
    + return -EINVAL;
    + }
    +
    ret = sev_es_validate_vmgexit(svm, &exit_code);
    if (ret)
    return ret;
    diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h
    index 22c01d958898..d10f7166b39d 100644
    --- a/arch/x86/kvm/svm/svm.h
    +++ b/arch/x86/kvm/svm/svm.h
    @@ -210,6 +210,8 @@ struct vcpu_svm {
    */
    u64 ghcb_sw_exit_info_1;
    u64 ghcb_sw_exit_info_2;
    +
    + u64 ghcb_registered_gpa;
    };

    struct svm_cpu_data {
    @@ -266,6 +268,11 @@ static inline bool sev_snp_guest(struct kvm *kvm)
    return sev_es_guest(kvm) && sev->snp_active;
    }

    +static inline bool ghcb_gpa_is_registered(struct vcpu_svm *svm, u64 val)
    +{
    + return svm->ghcb_registered_gpa == val;
    +}
    +
    static inline void vmcb_mark_all_dirty(struct vmcb *vmcb)
    {
    vmcb->control.clean = 0;
    --
    2.17.1
    \
     
     \ /
      Last update: 2021-08-20 18:03    [W:2.733 / U:2.760 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site