* [PATCH] x86/sev: get the AP jump table address from secrets page
@ 2022-04-20 15:27 Michael Roth
2022-04-20 18:30 ` Borislav Petkov
0 siblings, 1 reply; 2+ messages in thread
From: Michael Roth @ 2022-04-20 15:27 UTC (permalink / raw)
To: linux-kernel
Cc: Thomas Gleixner, Ingo Molnar, Borislav Petkov, Dave Hansen, x86,
H . Peter Anvin, Kees Cook, Kirill A . Shutemov, Tony Luck,
Nick Desaulniers, Kuppuswamy Sathyanarayanan, Tom Lendacky,
Venu Busireddy, Joerg Roedel, Tianyu Lan, Brijesh Singh
From: Brijesh Singh <brijesh.singh@amd.com>
The GHCB specification section 2.7 states that when SEV-SNP is enabled,
a hypervisor must provide the AP jump table physical address through
the SNP secrets pages.
Fixes: 0afb6b660a6b ("x86/sev: Use SEV-SNP AP creation to start secondary CPUs")
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
Signed-off-by: Michael Roth <michael.roth@amd.com>
---
arch/x86/include/asm/sev.h | 35 ++++++++++++++
arch/x86/kernel/sev.c | 70 ++++++++++++++++++---------
drivers/virt/coco/sevguest/sevguest.h | 35 --------------
3 files changed, 81 insertions(+), 59 deletions(-)
diff --git a/arch/x86/include/asm/sev.h b/arch/x86/include/asm/sev.h
index 9c2d33f1cfee..509a23c85fe8 100644
--- a/arch/x86/include/asm/sev.h
+++ b/arch/x86/include/asm/sev.h
@@ -99,6 +99,41 @@ struct snp_guest_platform_data {
u64 secrets_gpa;
};
+/*
+ * The secrets page contains 96-bytes of reserved field that can be used by
+ * the guest OS. The guest OS uses the area to save the message sequence
+ * number for each VMPCK.
+ *
+ * See the GHCB spec section Secret page layout for the format for this area.
+ */
+struct secrets_os_area {
+ u32 msg_seqno_0;
+ u32 msg_seqno_1;
+ u32 msg_seqno_2;
+ u32 msg_seqno_3;
+ u64 ap_jump_table_pa;
+ u8 rsvd[40];
+ u8 guest_usage[32];
+} __packed;
+
+#define VMPCK_KEY_LEN 32
+
+/* See the SNP spec version 0.9 for secrets page format */
+struct snp_secrets_page_layout {
+ u32 version;
+ u32 imien : 1,
+ rsvd1 : 31;
+ u32 fms;
+ u32 rsvd2;
+ u8 gosvw[16];
+ u8 vmpck0[VMPCK_KEY_LEN];
+ u8 vmpck1[VMPCK_KEY_LEN];
+ u8 vmpck2[VMPCK_KEY_LEN];
+ u8 vmpck3[VMPCK_KEY_LEN];
+ struct secrets_os_area os_area;
+ u8 rsvd3[3840];
+} __packed;
+
#ifdef CONFIG_AMD_MEM_ENCRYPT
extern struct static_key_false sev_es_enable_key;
extern void __sev_es_ist_enter(struct pt_regs *regs);
diff --git a/arch/x86/kernel/sev.c b/arch/x86/kernel/sev.c
index f01f4550e2c6..9cb27490745c 100644
--- a/arch/x86/kernel/sev.c
+++ b/arch/x86/kernel/sev.c
@@ -558,6 +558,49 @@ void noinstr __sev_es_nmi_complete(void)
__sev_put_ghcb(&state);
}
+static u64 get_secrets_page(void)
+{
+ u64 pa_data = boot_params.cc_blob_address;
+ struct cc_blob_sev_info info;
+ void *map;
+
+ /*
+ * The CC blob contains the address of the secrets page, check if the
+ * blob is present.
+ */
+ if (!pa_data)
+ return 0;
+
+ map = early_memremap(pa_data, sizeof(info));
+ memcpy(&info, map, sizeof(info));
+ early_memunmap(map, sizeof(info));
+
+ /* smoke-test the secrets page passed */
+ if (!info.secrets_phys || info.secrets_len != PAGE_SIZE)
+ return 0;
+
+ return info.secrets_phys;
+}
+
+static u64 get_snp_jump_table_addr(void)
+{
+ struct snp_secrets_page_layout *layout;
+ u64 pa = get_secrets_page();
+ u64 addr;
+
+ if (!pa)
+ return 0;
+
+ layout = (__force void *)ioremap_encrypted(pa, PAGE_SIZE);
+ if (!layout)
+ return 0;
+
+ addr = layout->os_area.ap_jump_table_pa;
+ iounmap(layout);
+
+ return addr;
+}
+
static u64 get_jump_table_addr(void)
{
struct ghcb_state state;
@@ -565,6 +608,9 @@ static u64 get_jump_table_addr(void)
struct ghcb *ghcb;
u64 ret = 0;
+ if (cc_platform_has(CC_ATTR_GUEST_SEV_SNP))
+ return get_snp_jump_table_addr();
+
local_irq_save(flags);
ghcb = __sev_get_ghcb(&state);
@@ -2171,30 +2217,6 @@ static struct platform_device guest_req_device = {
.id = -1,
};
-static u64 get_secrets_page(void)
-{
- u64 pa_data = boot_params.cc_blob_address;
- struct cc_blob_sev_info info;
- void *map;
-
- /*
- * The CC blob contains the address of the secrets page, check if the
- * blob is present.
- */
- if (!pa_data)
- return 0;
-
- map = early_memremap(pa_data, sizeof(info));
- memcpy(&info, map, sizeof(info));
- early_memunmap(map, sizeof(info));
-
- /* smoke-test the secrets page passed */
- if (!info.secrets_phys || info.secrets_len != PAGE_SIZE)
- return 0;
-
- return info.secrets_phys;
-}
-
static int __init snp_init_platform_device(void)
{
struct snp_guest_platform_data data;
diff --git a/drivers/virt/coco/sevguest/sevguest.h b/drivers/virt/coco/sevguest/sevguest.h
index d39bdd013765..21bda26fdb95 100644
--- a/drivers/virt/coco/sevguest/sevguest.h
+++ b/drivers/virt/coco/sevguest/sevguest.h
@@ -60,39 +60,4 @@ struct snp_guest_msg {
u8 payload[4000];
} __packed;
-/*
- * The secrets page contains 96-bytes of reserved field that can be used by
- * the guest OS. The guest OS uses the area to save the message sequence
- * number for each VMPCK.
- *
- * See the GHCB spec section Secret page layout for the format for this area.
- */
-struct secrets_os_area {
- u32 msg_seqno_0;
- u32 msg_seqno_1;
- u32 msg_seqno_2;
- u32 msg_seqno_3;
- u64 ap_jump_table_pa;
- u8 rsvd[40];
- u8 guest_usage[32];
-} __packed;
-
-#define VMPCK_KEY_LEN 32
-
-/* See the SNP spec version 0.9 for secrets page format */
-struct snp_secrets_page_layout {
- u32 version;
- u32 imien : 1,
- rsvd1 : 31;
- u32 fms;
- u32 rsvd2;
- u8 gosvw[16];
- u8 vmpck0[VMPCK_KEY_LEN];
- u8 vmpck1[VMPCK_KEY_LEN];
- u8 vmpck2[VMPCK_KEY_LEN];
- u8 vmpck3[VMPCK_KEY_LEN];
- struct secrets_os_area os_area;
- u8 rsvd3[3840];
-} __packed;
-
#endif /* __VIRT_SEVGUEST_H__ */
--
2.25.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] x86/sev: get the AP jump table address from secrets page
2022-04-20 15:27 [PATCH] x86/sev: get the AP jump table address from secrets page Michael Roth
@ 2022-04-20 18:30 ` Borislav Petkov
0 siblings, 0 replies; 2+ messages in thread
From: Borislav Petkov @ 2022-04-20 18:30 UTC (permalink / raw)
To: Michael Roth
Cc: linux-kernel, Thomas Gleixner, Ingo Molnar, Dave Hansen, x86,
H . Peter Anvin, Kees Cook, Kirill A . Shutemov, Tony Luck,
Nick Desaulniers, Kuppuswamy Sathyanarayanan, Tom Lendacky,
Venu Busireddy, Joerg Roedel, Tianyu Lan, Brijesh Singh
On Wed, Apr 20, 2022 at 10:27:51AM -0500, Michael Roth wrote:
> +static u64 get_secrets_page(void)
> +{
> + u64 pa_data = boot_params.cc_blob_address;
> + struct cc_blob_sev_info info;
> + void *map;
> +
> + /*
> + * The CC blob contains the address of the secrets page, check if the
> + * blob is present.
> + */
> + if (!pa_data)
> + return 0;
> +
> + map = early_memremap(pa_data, sizeof(info));
That function can return NULL so you need to handle it.
> + memcpy(&info, map, sizeof(info));
> + early_memunmap(map, sizeof(info));
> +
> + /* smoke-test the secrets page passed */
> + if (!info.secrets_phys || info.secrets_len != PAGE_SIZE)
> + return 0;
> +
> + return info.secrets_phys;
> +}
> +
> +static u64 get_snp_jump_table_addr(void)
> +{
> + struct snp_secrets_page_layout *layout;
> + u64 pa = get_secrets_page();
> + u64 addr;
Please don't hide the function call in the local variables declaration
but do this instead:
struct snp_secrets_page_layout *layout;
u64 pa, addr;
pa = get_secrets_page();
if (!pa)
return 0;
Thx.
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-04-20 18:31 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-04-20 15:27 [PATCH] x86/sev: get the AP jump table address from secrets page Michael Roth
2022-04-20 18:30 ` Borislav Petkov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).