Provide SEV-SNP support for running under an SVSM

The snp_init() in boot/compressed/sev.c is local to that file and is not called from outside of the file. Change the name so that it is not tied to the function definition in arch/x86/include/asm/sev.h.

Quoted 3 lines · Tom Lendacky

The snp_init() in boot/compressed/sev.c is local to that file and is not called from outside of the file. Change the name so that it is not tied to the function definition in arch/x86/include/asm/sev.h.

That part I don't understand: I can rename the function without making it static and it builds fine, so where is it "tied" to the function definition in kernel proper?

Don't get me wrong - leaking kernel proper symbols into the decompressor has been a pet peeve of mine for a while now but this is not the case here, is it?

And yes, the patch is fine - I'm just asking...

Thx.

When it's not static and has the name snp_init(), then it has to match the definition in arch/x86/include/asm/sev.h, which is really intended for the snp_init() in arch/x86/kernel/sev.c when called from arch/x86/mm/mem_encrypt_identity.c.

So, yes, changing the name would be enough except then it remains not a static and you can get a compiler warning about not having a prototype for it if the -Wmissing-prototypes option is ever applied to that file (I don't believe it is today because it is in the decompressor code, but that can change). And since nothing calls the snp_init() in arch/x86/boot/compressed/sev.c from outside of that file, making it static was appropriate.

The snp_init() in boot/compressed/sev.c is local to that file and is not called from outside of the file. Change the name so that it is not tied to the function definition in arch/x86/include/asm/sev.h. Move the renamed snp_init() and related functions up in the file to avoid having to add a forward declaration and make the function static, too.

This will allow the snp_init() function in arch/x86/kernel/sev.c to be changed without having to make the same change in boot/compressed/sev.c.

Signed-off-by Tom Lendacky <[email protected]>

---
  arch/x86/boot/compressed/sev.c | 162 ++++++++++++++++-----------------
  1 file changed, 81 insertions(+), 81 deletions(-)

arch/x86/boot/compressed/sev.c +81 -81

index ec71846d28c9..5ad0ff4664f1 100644
@@ -413,6 +413,85 @@ void snp_check_features(void)
  	}
  }
 
+/* Search for Confidential Computing blob in the EFI config table. */
+static struct cc_blob_sev_info *find_cc_blob_efi(struct boot_params *bp)
+{
+	unsigned long cfg_table_pa;
+	unsigned int cfg_table_len;
+	int ret;
+
+	ret = efi_get_conf_table(bp, &cfg_table_pa, &cfg_table_len);
+	if (ret)
+		return NULL;
+
+	return (struct cc_blob_sev_info *)efi_find_vendor_table(bp, cfg_table_pa,
+								cfg_table_len,
+								EFI_CC_BLOB_GUID);
+}
+
+/*
+ * Initial set up of SNP relies on information provided by the
+ * Confidential Computing blob, which can be passed to the boot kernel
+ * by firmware/bootloader in the following ways:
+ *
+ * - via an entry in the EFI config table
+ * - via a setup_data structure, as defined by the Linux Boot Protocol
+ *
+ * Scan for the blob in that order.
+ */
+static struct cc_blob_sev_info *find_cc_blob(struct boot_params *bp)
+{
+	struct cc_blob_sev_info *cc_info;
+
+	cc_info = find_cc_blob_efi(bp);
+	if (cc_info)
+		goto found_cc_info;
+
+	cc_info = find_cc_blob_setup_data(bp);
+	if (!cc_info)
+		return NULL;
+
+found_cc_info:
+	if (cc_info->magic != CC_BLOB_SEV_HDR_MAGIC)
+		sev_es_terminate(SEV_TERM_SET_GEN, GHCB_SNP_UNSUPPORTED);
+
+	return cc_info;
+}
+
+/*
+ * Indicate SNP based on presence of SNP-specific CC blob. Subsequent checks
+ * will verify the SNP CPUID/MSR bits.
+ */
+static bool early_snp_init(struct boot_params *bp)
+{
+	struct cc_blob_sev_info *cc_info;
+
+	if (!bp)
+		return false;
+
+	cc_info = find_cc_blob(bp);
+	if (!cc_info)
+		return false;
+
+	/*
+	 * If a SNP-specific Confidential Computing blob is present, then
+	 * firmware/bootloader have indicated SNP support. Verifying this
+	 * involves CPUID checks which will be more reliable if the SNP
+	 * CPUID table is used. See comments over snp_setup_cpuid_table() for
+	 * more details.
+	 */
+	setup_cpuid_table(cc_info);
+
+	/*
+	 * Pass run-time kernel a pointer to CC info via boot_params so EFI
+	 * config table doesn't need to be searched again during early startup
+	 * phase.
+	 */
+	bp->cc_blob_address = (u32)(unsigned long)cc_info;
+
+	return true;
+}
+
  /*
   * sev_check_cpu_support - Check for SEV support in the CPU capabilities
   *

@@ -463,7 +542,7 @@ void sev_enable(struct boot_params *bp)
  		bp->cc_blob_address = 0;
 
  	/*
-	 * Do an initial SEV capability check before snp_init() which
+	 * Do an initial SEV capability check before early_snp_init() which
  	 * loads the CPUID page and the same checks afterwards are done
  	 * without the hypervisor and are trustworthy.
  	 *

@@ -478,7 +557,7 @@ void sev_enable(struct boot_params *bp)
  	 * Setup/preliminary detection of SNP. This will be sanity-checked
  	 * against CPUID/MSR values later.
  	 */
-	snp = snp_init(bp);
+	snp = early_snp_init(bp);
 
  	/* Now repeat the checks with the SNP CPUID table. */
 

@@ -535,85 +614,6 @@ u64 sev_get_status(void)
  	return m.q;
  }
 
-/* Search for Confidential Computing blob in the EFI config table. */
-static struct cc_blob_sev_info *find_cc_blob_efi(struct boot_params *bp)
-{
-	unsigned long cfg_table_pa;
-	unsigned int cfg_table_len;
-	int ret;
-
-	ret = efi_get_conf_table(bp, &cfg_table_pa, &cfg_table_len);
-	if (ret)
-		return NULL;
-
-	return (struct cc_blob_sev_info *)efi_find_vendor_table(bp, cfg_table_pa,
-								cfg_table_len,
-								EFI_CC_BLOB_GUID);
-}
-
-/*
- * Initial set up of SNP relies on information provided by the
- * Confidential Computing blob, which can be passed to the boot kernel
- * by firmware/bootloader in the following ways:
- *
- * - via an entry in the EFI config table
- * - via a setup_data structure, as defined by the Linux Boot Protocol
- *
- * Scan for the blob in that order.
- */
-static struct cc_blob_sev_info *find_cc_blob(struct boot_params *bp)
-{
-	struct cc_blob_sev_info *cc_info;
-
-	cc_info = find_cc_blob_efi(bp);
-	if (cc_info)
-		goto found_cc_info;
-
-	cc_info = find_cc_blob_setup_data(bp);
-	if (!cc_info)
-		return NULL;
-
-found_cc_info:
-	if (cc_info->magic != CC_BLOB_SEV_HDR_MAGIC)
-		sev_es_terminate(SEV_TERM_SET_GEN, GHCB_SNP_UNSUPPORTED);
-
-	return cc_info;
-}
-
-/*
- * Indicate SNP based on presence of SNP-specific CC blob. Subsequent checks
- * will verify the SNP CPUID/MSR bits.
- */
-bool snp_init(struct boot_params *bp)
-{
-	struct cc_blob_sev_info *cc_info;
-
-	if (!bp)
-		return false;
-
-	cc_info = find_cc_blob(bp);
-	if (!cc_info)
-		return false;
-
-	/*
-	 * If a SNP-specific Confidential Computing blob is present, then
-	 * firmware/bootloader have indicated SNP support. Verifying this
-	 * involves CPUID checks which will be more reliable if the SNP
-	 * CPUID table is used. See comments over snp_setup_cpuid_table() for
-	 * more details.
-	 */
-	setup_cpuid_table(cc_info);
-
-	/*
-	 * Pass run-time kernel a pointer to CC info via boot_params so EFI
-	 * config table doesn't need to be searched again during early startup
-	 * phase.
-	 */
-	bp->cc_blob_address = (u32)(unsigned long)cc_info;
-
-	return true;
-}
-
  void sev_prep_identity_maps(unsigned long top_level_pgt)
  {
  	/*

Currently, the enforce_vmpl0() function uses a set argument when testing for VMPL0 and terminates the guest if the guest is not running at VMPL0.

Make the function more generic by moving it into the common code, renaming it, allowing it to take an argument for use in the VMPL0 check (RMPADJUST instruction) and return the result of the check, allowing the caller to determine the action taken based on the result.

Signed-off-by Tom Lendacky <[email protected]>

---
  arch/x86/boot/compressed/sev.c | 13 ++++++-------
  1 file changed, 6 insertions(+), 7 deletions(-)

arch/x86/boot/compressed/sev.c +6 -7

index 5ad0ff4664f1..49dc9661176d 100644
@@ -335,10 +335,9 @@ void do_boot_stage2_vc(struct pt_regs *regs, unsigned long exit_code)
  		sev_es_terminate(SEV_TERM_SET_GEN, GHCB_SEV_ES_GEN_REQ);
  }
 
-static void enforce_vmpl0(void)
+static bool running_at_vmpl0(void *va)
  {
  	u64 attrs;
-	int err;
 
  	/*
  	 * RMPADJUST modifies RMP permissions of a lesser-privileged (numerically

@@ -347,12 +346,11 @@ static void enforce_vmpl0(void)
  	 *
  	 * If the guest is running at VMPL0, it will succeed. Even if that operation
  	 * modifies permission bits, it is still ok to do so currently because Linux
-	 * SNP guests are supported only on VMPL0 so VMPL1 or higher permission masks
-	 * changing is a don't-care.
+	 * SNP guests running at VMPL0 only run at VMPL0, so VMPL1 or higher
+	 * permission mask changes are a don't-care.
  	 */
  	attrs = 1;
-	if (rmpadjust((unsigned long)&boot_ghcb_page, RMP_PG_SIZE_4K, attrs))
-		sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_NOT_VMPL0);
+	return !rmpadjust((unsigned long)va, RMP_PG_SIZE_4K, attrs);
  }
 
  /*

@@ -588,7 +586,8 @@ void sev_enable(struct boot_params *bp)
  		if (!(get_hv_features() & GHCB_HV_FT_SNP))
  			sev_es_terminate(SEV_TERM_SET_GEN, GHCB_SNP_UNSUPPORTED);
 
-		enforce_vmpl0();
+		if (!running_at_vmpl0(&boot_ghcb_page))
+			sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_NOT_VMPL0);
  	}
 
  	if (snp && !(sev_status & MSR_AMD64_SEV_SNP_ENABLED))

arch/x86/boot/compressed/sev.c void do_boot_stage2_vc(struct pt_regs *regs, unsigned long exit_code) · line 338

Quoted 2 lines · Tom Lendacky

arch/x86/boot/compressed/sev.c +1 -1

-static void enforce_vmpl0(void)
+static bool running_at_vmpl0(void *va)

Not too crazy about it: you're turning it into a function which runs in boolean context but takes a void *?!

And the boolean result is only a side-effect or what it does to the argument - modify its permissions. Which is weird and not really obvious.

I'd prefer it if you made it into

static void vmpl0_modify_permissions(void *va)

which basically says, modify the permissions of @va in vmpl0, which is a lot closer to what the function does.

And then do

#define running_at_vmpl0(va) vmpl0_modify_permissions((va))

because then through the indirection is at least clear how that "am I running at VMPL0?" check is being done.

And later, if we need other VMPLs, we can extend vmpl0_modify_permissions() and even do a more generic

vmpl_modify_permissions(unsigned int vmpl_level, void *va)

and so on and kill the silly macro.

Thx.

Well, it doesn't really modify any permissions that matter. It tries to change the permission of a lesser privileged VMPL level.

Since the kernel only runs at a single VMPL it would never be effected. The operation performed here is to update VMPL1 permission levels (which can only be done successfully at VMPL0) and return the result of the operation. A success implies running at VMPL0 and failure implies not running at VMPL0.

On Wed, Apr 17, 2024 at 03:35:53PM -0500, Tom Lendacky wrote:

Yap.

The point is, it is calling RMPADJUST. And it does modify RMP permissions of a guest page.

Thus, if you prefer, you can go all out and call the helper

rmp_adjust_permissions(unsigned int tgt_vmpl, void *pa)

and make it generic from the get-go.

And then have the macro wrap around it in order to explain that particular use with the macro name.

If it is still not clear what I mean, lemme know and I'll do a diff ontop.

Thx.

I think I'll just eliminate the function then and call rmpadjust directly, that should make it clear.

During early boot phases, check for the presence of an SVSM when running as an SEV-SNP guest.

An SVSM is present if the 64-bit value at offset 0x148 into the secrets page is non-zero. If an SVSM is present, save the SVSM Calling Area address (CAA), located at offset 0x150 into the secrets page, and set the VMPL level of the guest, which should be non-zero, to indicate the presence of an SVSM.

Signed-off-by Tom Lendacky <[email protected]>

---
  arch/x86/boot/compressed/sev.c    | 35 ++++++++---------
  arch/x86/include/asm/sev-common.h |  4 ++
  arch/x86/include/asm/sev.h        | 25 +++++++++++-
  arch/x86/kernel/sev-shared.c      | 64 +++++++++++++++++++++++++++++++
  arch/x86/kernel/sev.c             | 16 ++++++++
  5 files changed, 125 insertions(+), 19 deletions(-)

arch/x86/boot/compressed/sev.c +17 -18

index 49dc9661176d..fe61ff630c7e 100644
@@ -12,6 +12,7 @@
   */
  #include "misc.h"
 
+#include <linux/mm.h>
  #include <asm/bootparam.h>
  #include <asm/pgtable_types.h>
  #include <asm/sev.h>

@@ -29,6 +30,15 @@
  static struct ghcb boot_ghcb_page __aligned(PAGE_SIZE);
  struct ghcb *boot_ghcb;
 
+/*
+ * SVSM related information:
+ *   When running under an SVSM, the VMPL that Linux is executing at must be
+ *   non-zero. The VMPL is therefore used to indicate the presence of an SVSM.
+ */
+static u8 vmpl __section(".data");
+static u64 boot_svsm_caa_pa __section(".data");
+static struct svsm_ca *boot_svsm_caa __section(".data");
+
  /*
   * Copy a version of this function here - insn-eval.c can't be used in
   * pre-decompression code.

@@ -335,24 +345,6 @@ void do_boot_stage2_vc(struct pt_regs *regs, unsigned long exit_code)
  		sev_es_terminate(SEV_TERM_SET_GEN, GHCB_SEV_ES_GEN_REQ);
  }
 
-static bool running_at_vmpl0(void *va)
-{
-	u64 attrs;
-
-	/*
-	 * RMPADJUST modifies RMP permissions of a lesser-privileged (numerically
-	 * higher) privilege level. Here, clear the VMPL1 permission mask of the
-	 * GHCB page. If the guest is not running at VMPL0, this will fail.
-	 *
-	 * If the guest is running at VMPL0, it will succeed. Even if that operation
-	 * modifies permission bits, it is still ok to do so currently because Linux
-	 * SNP guests running at VMPL0 only run at VMPL0, so VMPL1 or higher
-	 * permission mask changes are a don't-care.
-	 */
-	attrs = 1;
-	return !rmpadjust((unsigned long)va, RMP_PG_SIZE_4K, attrs);
-}
-
  /*
   * SNP_FEATURES_IMPL_REQ is the mask of SNP features that will need
   * guest side implementation for proper functioning of the guest. If any

@@ -480,6 +472,13 @@ static bool early_snp_init(struct boot_params *bp)
  	 */
  	setup_cpuid_table(cc_info);
 
+	/*
+	 * Record the SVSM Calling Area address (CAA) if the guest is not
+	 * running at VMPL0. The CA will be used to communicate with the
+	 * SVSM to perform the SVSM services.
+	 */
+	setup_svsm_ca(cc_info);
+
  	/*
  	 * Pass run-time kernel a pointer to CC info via boot_params so EFI
  	 * config table doesn't need to be searched again during early startup

arch/x86/include/asm/sev-common.h +4 -0

index b463fcbd4b90..68a8cdf6fd6a 100644
@@ -159,6 +159,10 @@ struct snp_psc_desc {
  #define GHCB_TERM_NOT_VMPL0		3	/* SNP guest is not running at VMPL-0 */
  #define GHCB_TERM_CPUID			4	/* CPUID-validation failure */
  #define GHCB_TERM_CPUID_HV		5	/* CPUID failure during hypervisor fallback */
+#define GHCB_TERM_SECRETS_PAGE		6	/* Secrets page failure */
+#define GHCB_TERM_NO_SVSM		7	/* SVSM is not advertised in the secrets page */
+#define GHCB_TERM_SVSM_VMPL0		8	/* SVSM is present but has set VMPL to 0 */
+#define GHCB_TERM_SVSM_CAA		9	/* SVSM is present but the CA is not page aligned */
 
  #define GHCB_RESP_CODE(v)		((v) & GHCB_MSR_INFO_MASK)
 

arch/x86/include/asm/sev.h +24 -1

index 9477b4053bce..891e7d9a1f66 100644
@@ -152,9 +152,32 @@ struct snp_secrets_page_layout {
  	u8 vmpck2[VMPCK_KEY_LEN];
  	u8 vmpck3[VMPCK_KEY_LEN];
  	struct secrets_os_area os_area;
-	u8 rsvd3[3840];
+
+	u8 vmsa_tweak_bitmap[64];
+
+	/* SVSM fields */
+	u64 svsm_base;
+	u64 svsm_size;
+	u64 svsm_caa;
+	u32 svsm_max_version;
+	u8 svsm_guest_vmpl;
+	u8 rsvd3[3];
+
+	/* Remainder of page */
+	u8 rsvd4[3744];
  } __packed;
 
+/*
+ * The SVSM Calling Area (CA) related structures.
+ */
+struct svsm_ca {
+	u8 call_pending;
+	u8 mem_available;
+	u8 rsvd1[6];
+
+	u8 svsm_buffer[PAGE_SIZE - 8];
+};
+
  #ifdef CONFIG_AMD_MEM_ENCRYPT
  extern void __sev_es_ist_enter(struct pt_regs *regs);
  extern void __sev_es_ist_exit(void);

arch/x86/kernel/sev-shared.c +64 -0

index 8b04958da5e7..66d33292eb78 100644
@@ -111,6 +111,24 @@ sev_es_terminate(unsigned int set, unsigned int reason)
  		asm volatile("hlt\n" : : : "memory");
  }
 
+static bool running_at_vmpl0(void *va)
+{
+	u64 attrs;
+
+	/*
+	 * RMPADJUST modifies RMP permissions of a lesser-privileged (numerically
+	 * higher) privilege level. Here, clear the VMPL1 permission mask of the
+	 * GHCB page. If the guest is not running at VMPL0, this will fail.
+	 *
+	 * If the guest is running at VMPL0, it will succeed. Even if that operation
+	 * modifies permission bits, it is still ok to do so currently because Linux
+	 * SNP guests running at VMPL0 only run at VMPL0, so VMPL1 or higher
+	 * permission mask changes are a don't-care.
+	 */
+	attrs = 1;
+	return !rmpadjust((unsigned long)va, RMP_PG_SIZE_4K, attrs);
+}
+
  /*
   * The hypervisor features are available from GHCB version 2 onward.
   */

@@ -1267,3 +1285,49 @@ static enum es_result vc_check_opcode_bytes(struct es_em_ctxt *ctxt,
 
  	return ES_UNSUPPORTED;
  }
+
+/*
+ * Maintain the GPA of the SVSM Calling Area (CA) in order to utilize the SVSM
+ * services needed when not running in VMPL0.
+ */
+static void __head setup_svsm_ca(const struct cc_blob_sev_info *cc_info)
+{
+	struct snp_secrets_page_layout *secrets_page;
+	u64 caa;
+
+	BUILD_BUG_ON(sizeof(*secrets_page) != PAGE_SIZE);
+
+	/*
+	 * Use __pa() since this routine is running identity mapped when
+	 * called, both by the decompressor code and the early kernel code.
+	 */
+	if (running_at_vmpl0((void *)__pa(&boot_ghcb_page)))
+		return;
+
+	/*
+	 * Not running at VMPL0, ensure everything has been properly supplied
+	 * for running under an SVSM.
+	 */
+	if (!cc_info || !cc_info->secrets_phys || cc_info->secrets_len != PAGE_SIZE)
+		sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_SECRETS_PAGE);
+
+	secrets_page = (struct snp_secrets_page_layout *)cc_info->secrets_phys;
+	if (!secrets_page->svsm_size)
+		sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_NO_SVSM);
+
+	if (!secrets_page->svsm_guest_vmpl)
+		sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_SVSM_VMPL0);
+
+	vmpl = secrets_page->svsm_guest_vmpl;
+
+	caa = secrets_page->svsm_caa;
+	if (!PAGE_ALIGNED(caa))
+		sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_SVSM_CAA);
+
+	/*
+	 * The CA is identity mapped when this routine is called, both by the
+	 * decompressor code and the early kernel code.
+	 */
+	boot_svsm_caa = (struct svsm_ca *)caa;
+	boot_svsm_caa_pa = caa;
+}

arch/x86/kernel/sev.c +16 -0

index b59b09c2f284..64799a04feb4 100644
@@ -135,6 +135,15 @@ struct ghcb_state {
  static DEFINE_PER_CPU(struct sev_es_runtime_data*, runtime_data);
  static DEFINE_PER_CPU(struct sev_es_save_area *, sev_vmsa);
 
+/*
+ * SVSM related information:
+ *   When running under an SVSM, the VMPL that Linux is executing at must be
+ *   non-zero. The VMPL is therefore used to indicate the presence of an SVSM.
+ */
+static u8 vmpl __ro_after_init;
+static struct svsm_ca *boot_svsm_caa __ro_after_init;
+static u64 boot_svsm_caa_pa __ro_after_init;
+
  struct sev_config {
  	__u64 debug		: 1,
 

@@ -2122,6 +2131,13 @@ bool __head snp_init(struct boot_params *bp)
 
  	setup_cpuid_table(cc_info);
 
+	/*
+	 * Record the SVSM Calling Area address (CAA) if the guest is not
+	 * running at VMPL0. The CA will be used to communicate with the
+	 * SVSM to perform the SVSM services.
+	 */
+	setup_svsm_ca(cc_info);
+
  	/*
  	 * The CC blob will be used later to access the secrets page. Cache
  	 * it here like the boot kernel does.

During early boot phases, check for the presence of an SVSM when running as an SEV-SNP guest.

An SVSM is present if the 64-bit value at offset 0x148 into the secrets page is non-zero. If an SVSM is present, save the SVSM Calling Area address (CAA), located at offset 0x150 into the secrets page, and set the VMPL level of the guest, which should be non-zero, to indicate the presence of an SVSM.

Signed-off-by Tom Lendacky <[email protected]>

---
 arch/x86/boot/compressed/sev.c    | 35 ++++++++---------
 arch/x86/include/asm/sev-common.h |  4 ++
 arch/x86/include/asm/sev.h        | 25 +++++++++++-
 arch/x86/kernel/sev-shared.c      | 64 +++++++++++++++++++++++++++++++
 arch/x86/kernel/sev.c             | 16 ++++++++
 5 files changed, 125 insertions(+), 19 deletions(-)

arch/x86/boot/compressed/sev.c +1 -0

index 49dc9661176d..fe61ff630c7e 100644
@@ -12,6 +12,7 @@
  */
 #include "misc.h"
 
+#include <linux/mm.h>
 #include <asm/bootparam.h>
 #include <asm/pgtable_types.h>
 #include <asm/sev.h>

@@ -29,6 +30,15 @@
 static struct ghcb boot_ghcb_page __aligned(PAGE_SIZE);

arch/x86/boot/compressed/sev.c +4 -0

+	 * SVSM to perform the SVSM services.
+	 */
+	setup_svsm_ca(cc_info);
+
 	/*
 	 * Pass run-time kernel a pointer to CC info via boot_params so EFI
 	 * config table doesn't need to be searched again during early startup

arch/x86/include/asm/sev-common.h +0 -0

index b463fcbd4b90..68a8cdf6fd6a 100644

arch/x86/include/asm/sev-common.h +34 -0

+	/*
+	 * Use __pa() since this routine is running identity mapped when
+	 * called, both by the decompressor code and the early kernel code.
+	 */
+	if (running_at_vmpl0((void *)__pa(&boot_ghcb_page)))
+		return;
+
+	/*
+	 * Not running at VMPL0, ensure everything has been properly supplied
+	 * for running under an SVSM.
+	 */
+	if (!cc_info || !cc_info->secrets_phys || cc_info->secrets_len != PAGE_SIZE)
+		sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_SECRETS_PAGE);
+
+	secrets_page = (struct snp_secrets_page_layout *)cc_info->secrets_phys;
+	if (!secrets_page->svsm_size)
+		sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_NO_SVSM);
+
+	if (!secrets_page->svsm_guest_vmpl)
+		sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_SVSM_VMPL0);
+
+	vmpl = secrets_page->svsm_guest_vmpl;
+
+	caa = secrets_page->svsm_caa;
+	if (!PAGE_ALIGNED(caa))
+		sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_SVSM_CAA);
+
+	/*
+	 * The CA is identity mapped when this routine is called, both by the
+	 * decompressor code and the early kernel code.
+	 */
+	boot_svsm_caa = (struct svsm_ca *)caa;
+	boot_svsm_caa_pa = caa;
+}

arch/x86/kernel/sev.c +0 -0

index b59b09c2f284..64799a04feb4 100644
@@ -135,6 +135,15 @@ struct ghcb_state {
 static DEFINE_PER_CPU(struct sev_es_runtime_data*, runtime_data);

Quoted 8 lines · Tom Lendacky

During early boot phases, check for the presence of an SVSM when running as an SEV-SNP guest.

An SVSM is present if the 64-bit value at offset 0x148 into the secrets page is non-zero. If an SVSM is present, save the SVSM Calling Area address (CAA), located at offset 0x150 into the secrets page, and set the VMPL level of the guest, which should be non-zero, to indicate the presence of an SVSM.

Where are we pointing to the SVSM spec?

This is in the 0th message

https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/specifications/58019.pdf

but pls add it to our documentation here:

Documentation/arch/x86/amd-memory-encryption.rst

Quoted 26 lines

Signed-off-by Tom Lendacky <[email protected]>

---
  arch/x86/boot/compressed/sev.c    | 35 ++++++++---------
  arch/x86/include/asm/sev-common.h |  4 ++
  arch/x86/include/asm/sev.h        | 25 +++++++++++-
  arch/x86/kernel/sev-shared.c      | 64 +++++++++++++++++++++++++++++++
  arch/x86/kernel/sev.c             | 16 ++++++++
  5 files changed, 125 insertions(+), 19 deletions(-)

arch/x86/boot/compressed/sev.c +1 -0

index 49dc9661176d..fe61ff630c7e 100644
@@ -12,6 +12,7 @@
   */
  #include "misc.h"
 
+#include <linux/mm.h>
  #include <asm/bootparam.h>
  #include <asm/pgtable_types.h>
  #include <asm/sev.h>

@@ -29,6 +30,15 @@
  static struct ghcb boot_ghcb_page __aligned(PAGE_SIZE);
  struct ghcb *boot_ghcb;
 

arch/x86/boot/compressed/sev.c line 40

Quoted 8 lines

arch/x86/boot/compressed/sev.c +8 -0

+/*
+ * SVSM related information:
+ *   When running under an SVSM, the VMPL that Linux is executing at must be
+ *   non-zero. The VMPL is therefore used to indicate the presence of an SVSM.
+ */
+static u8 vmpl __section(".data");
+static u64 boot_svsm_caa_pa __section(".data");
+static struct svsm_ca *boot_svsm_caa __section(".data");

Explain what those last 2 are in comments above it pls.

Quoted 8 lines

arch/x86/boot/compressed/sev.c +0 -0

  /*
   * SNP_FEATURES_IMPL_REQ is the mask of SNP features that will need
   * guest side implementation for proper functioning of the guest. If any

@@ -480,6 +472,13 @@ static bool early_snp_init(struct boot_params *bp)
  	 */
  	setup_cpuid_table(cc_info);
 

arch/x86/boot/compressed/sev.c static bool early_snp_init(struct boot_params *bp) · line 476

Quoted 2 lines

arch/x86/boot/compressed/sev.c +2 -0

+	/*
+	 * Record the SVSM Calling Area address (CAA) if the guest is not

Calling Area (CA) address

arch/x86/boot/compressed/sev.c static bool early_snp_init(struct boot_params *bp) · line 477

Quoted 1 line

arch/x86/boot/compressed/sev.c +1 -0

+	 * running at VMPL0. The CA will be used to communicate with the

and then you can use "CA" here.

Quoted 14 lines

arch/x86/boot/compressed/sev.c +4 -0

+	 * SVSM to perform the SVSM services.
+	 */
+	setup_svsm_ca(cc_info);
+
  	/*
  	 * Pass run-time kernel a pointer to CC info via boot_params so EFI
  	 * config table doesn't need to be searched again during early startup

arch/x86/include/asm/sev-common.h +0 -0

index b463fcbd4b90..68a8cdf6fd6a 100644
@@ -159,6 +159,10 @@ struct snp_psc_desc {
  #define GHCB_TERM_NOT_VMPL0		3	/* SNP guest is not running at VMPL-0 */

arch/x86/include/asm/sev-common.h struct snp_psc_desc { · line 165

Quoted 6 lines

arch/x86/include/asm/sev-common.h +4 -0

  #define GHCB_TERM_CPUID			4	/* CPUID-validation failure */
  #define GHCB_TERM_CPUID_HV		5	/* CPUID failure during hypervisor fallback */
+#define GHCB_TERM_SECRETS_PAGE		6	/* Secrets page failure */
+#define GHCB_TERM_NO_SVSM		7	/* SVSM is not advertised in the secrets page */
+#define GHCB_TERM_SVSM_VMPL0		8	/* SVSM is present but has set VMPL to 0 */
+#define GHCB_TERM_SVSM_CAA		9	/* SVSM is present but the CA is not page aligned */

"CAA" in the comment I guess. :)

arch/x86/include/asm/sev-common.h struct snp_psc_desc {

Quoted 8 lines

arch/x86/include/asm/sev-common.h +7 -0

+/*
+ * Maintain the GPA of the SVSM Calling Area (CA) in order to utilize the SVSM
+ * services needed when not running in VMPL0.
+ */
+static void __head setup_svsm_ca(const struct cc_blob_sev_info *cc_info)
+{
+	struct snp_secrets_page_layout *secrets_page;

Why was that thing ever called "_layout" and not simply snp_secrets_page?

Fix it?

arch/x86/include/asm/sev-common.h

Quoted 4 lines

arch/x86/include/asm/sev-common.h +3 -0

+	u64 caa;
+
+	BUILD_BUG_ON(sizeof(*secrets_page) != PAGE_SIZE);

Put it in the header under the struct definition I guess.

Quoted 41 lines

arch/x86/include/asm/sev-common.h +34 -0

+	/*
+	 * Use __pa() since this routine is running identity mapped when
+	 * called, both by the decompressor code and the early kernel code.
+	 */
+	if (running_at_vmpl0((void *)__pa(&boot_ghcb_page)))
+		return;
+
+	/*
+	 * Not running at VMPL0, ensure everything has been properly supplied
+	 * for running under an SVSM.
+	 */
+	if (!cc_info || !cc_info->secrets_phys || cc_info->secrets_len != PAGE_SIZE)
+		sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_SECRETS_PAGE);
+
+	secrets_page = (struct snp_secrets_page_layout *)cc_info->secrets_phys;
+	if (!secrets_page->svsm_size)
+		sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_NO_SVSM);
+
+	if (!secrets_page->svsm_guest_vmpl)
+		sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_SVSM_VMPL0);
+
+	vmpl = secrets_page->svsm_guest_vmpl;
+
+	caa = secrets_page->svsm_caa;
+	if (!PAGE_ALIGNED(caa))
+		sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_SVSM_CAA);
+
+	/*
+	 * The CA is identity mapped when this routine is called, both by the
+	 * decompressor code and the early kernel code.
+	 */
+	boot_svsm_caa = (struct svsm_ca *)caa;
+	boot_svsm_caa_pa = caa;
+}

arch/x86/kernel/sev.c +0 -0

index b59b09c2f284..64799a04feb4 100644
@@ -135,6 +135,15 @@ struct ghcb_state {
  static DEFINE_PER_CPU(struct sev_es_runtime_data*, runtime_data);

arch/x86/kernel/sev.c struct ghcb_state { · line 145

Quoted 10 lines

arch/x86/kernel/sev.c +8 -0

  static DEFINE_PER_CPU(struct sev_es_save_area *, sev_vmsa);
 
+/*
+ * SVSM related information:
+ *   When running under an SVSM, the VMPL that Linux is executing at must be
+ *   non-zero. The VMPL is therefore used to indicate the presence of an SVSM.
+ */
+static u8 vmpl __ro_after_init;
+static struct svsm_ca *boot_svsm_caa __ro_after_init;
+static u64 boot_svsm_caa_pa __ro_after_init;

Uff, duplication.

Let's put them in sev-shared.c pls and avoid that.

Thx.

Do you want it added as a in this patch or in a documentation patch at the end of the series?

Quoted 4 lines

Why was that thing ever called "_layout" and not simply snp_secrets_page?

Fix it?

Sure, I can change that as a pre-patch to the series.

Quoted 7 lines

arch/x86/kernel/sev-shared.c static enum es_result vc_check_opcode_bytes(struct es_em_ctxt *ctxt, · line 1298

Quoted 5 lines

arch/x86/kernel/sev-shared.c +3 -0

+	u64 caa;
+
+	BUILD_BUG_ON(sizeof(*secrets_page) != PAGE_SIZE);

Put it in the header under the struct definition I guess.

It can't stand on it's own in the header file. I'd have to put it in a #define or an inline function and then use that in some code. So it's probably best to keep it here.

Quoted 3 lines

Uff, duplication.

Let's put them in sev-shared.c pls and avoid that.

Ok, but it will require moving some functions after the inclusion of sev-shared.c and then (later) adding some advance function declarations.

The SVSM Calling Area (CA) is used to communicate between Linux and the SVSM. Since the firmware supplied CA for the BSP is likely to be in reserved memory, switch off that CA to a kernel provided CA so that access and use of the CA is available during boot. The CA switch is done using the SVSM core protocol SVSM_CORE_REMAP_CA call.

An SVSM call is executed by filling out the SVSM CA and setting the proper register state as documented by the SVSM protocol. The SVSM is invoked by by requesting the hypervisor to run VMPL0.

Once it is safe to allocate/reserve memory, allocate a CA for each CPU. After allocating the new CAs, the BSP will switch from the boot CA to the per-CPU CA. The CA for an AP is identified to the SVSM when creating the VMSA in preparation for booting the AP.

Signed-off-by Tom Lendacky <[email protected]>

---
  arch/x86/include/asm/sev-common.h |  13 ++
  arch/x86/include/asm/sev.h        |  32 +++++
  arch/x86/include/uapi/asm/svm.h   |   1 +
  arch/x86/kernel/sev-shared.c      |  94 +++++++++++++-
  arch/x86/kernel/sev.c             | 205 +++++++++++++++++++++++++-----
  arch/x86/mm/mem_encrypt_amd.c     |   8 +-
  6 files changed, 318 insertions(+), 35 deletions(-)

arch/x86/include/asm/sev-common.h +13 -0

index 68a8cdf6fd6a..71db5ba020b9 100644
@@ -96,6 +96,19 @@ enum psc_op {
  	/* GHCBData[63:32] */				\
  	(((u64)(val) & GENMASK_ULL(63, 32)) >> 32)
 
+/* GHCB Run at VMPL Request/Response */
+#define GHCB_MSR_VMPL_REQ		0x016
+#define GHCB_MSR_VMPL_REQ_LEVEL(v)			\
+	/* GHCBData[39:32] */				\
+	(((u64)(v) & GENMASK_ULL(7, 0) << 32) |		\
+	/* GHCBDdata[11:0] */				\
+	GHCB_MSR_VMPL_REQ)
+
+#define GHCB_MSR_VMPL_RESP		0x017
+#define GHCB_MSR_VMPL_RESP_VAL(v)			\
+	/* GHCBData[63:32] */				\
+	(((u64)(v) & GENMASK_ULL(63, 32)) >> 32)
+
  /* GHCB Hypervisor Feature Request/Response */
  #define GHCB_MSR_HV_FT_REQ		0x080
  #define GHCB_MSR_HV_FT_RESP		0x081

arch/x86/include/asm/sev.h +32 -0

index 891e7d9a1f66..4aa36905b047 100644
@@ -178,6 +178,36 @@ struct svsm_ca {
  	u8 svsm_buffer[PAGE_SIZE - 8];
  };
 
+#define SVSM_SUCCESS				0
+#define SVSM_ERR_INCOMPLETE			0x80000000
+#define SVSM_ERR_UNSUPPORTED_PROTOCOL		0x80000001
+#define SVSM_ERR_UNSUPPORTED_CALL		0x80000002
+#define SVSM_ERR_INVALID_ADDRESS		0x80000003
+#define SVSM_ERR_INVALID_FORMAT			0x80000004
+#define SVSM_ERR_INVALID_PARAMETER		0x80000005
+#define SVSM_ERR_INVALID_REQUEST		0x80000006
+#define SVSM_ERR_BUSY				0x80000007
+
+/*
+ * SVSM protocol structure
+ */
+struct svsm_call {
+	struct svsm_ca *caa;
+	u64 rax;
+	u64 rcx;
+	u64 rdx;
+	u64 r8;
+	u64 r9;
+	u64 rax_out;
+	u64 rcx_out;
+	u64 rdx_out;
+	u64 r8_out;
+	u64 r9_out;
+};
+
+#define SVSM_CORE_CALL(x)		((0ULL << 32) | (x))
+#define SVSM_CORE_REMAP_CA		0
+
  #ifdef CONFIG_AMD_MEM_ENCRYPT
  extern void __sev_es_ist_enter(struct pt_regs *regs);
  extern void __sev_es_ist_exit(void);

@@ -253,6 +283,7 @@ u64 snp_get_unsupported_features(u64 status);
  u64 sev_get_status(void);
  void kdump_sev_callback(void);
  void sev_show_status(void);
+void snp_remap_svsm_ca(void);
  #else
  static inline void sev_es_ist_enter(struct pt_regs *regs) { }
  static inline void sev_es_ist_exit(void) { }

@@ -283,6 +314,7 @@ static inline u64 snp_get_unsupported_features(u64 status) { return 0; }
  static inline u64 sev_get_status(void) { return 0; }
  static inline void kdump_sev_callback(void) { }
  static inline void sev_show_status(void) { }
+static inline void snp_remap_svsm_ca(void) { }
  #endif
 
  #ifdef CONFIG_KVM_AMD_SEV

arch/x86/include/uapi/asm/svm.h +1 -0

index 80e1df482337..1814b413fd57 100644
@@ -115,6 +115,7 @@
  #define SVM_VMGEXIT_AP_CREATE_ON_INIT		0
  #define SVM_VMGEXIT_AP_CREATE			1
  #define SVM_VMGEXIT_AP_DESTROY			2
+#define SVM_VMGEXIT_SNP_RUN_VMPL		0x80000018
  #define SVM_VMGEXIT_HV_FEATURES			0x8000fffd
  #define SVM_VMGEXIT_TERM_REQUEST		0x8000fffe
  #define SVM_VMGEXIT_TERM_REASON(reason_set, reason_code)	\

arch/x86/kernel/sev-shared.c +93 -1

index 66d33292eb78..78d2b9f570de 100644
@@ -18,9 +18,11 @@
  #define sev_printk_rtl(fmt, ...)	printk_ratelimited(fmt, ##__VA_ARGS__)
  #else
  #undef WARN
-#define WARN(condition, format...) (!!(condition))
+#define WARN(condition, format...)	(!!(condition))
  #define sev_printk(fmt, ...)
  #define sev_printk_rtl(fmt, ...)
+#undef vc_forward_exception
+#define vc_forward_exception(c)		panic("SNP: Hypervisor requested exception\n")
  #endif
 
  /* I/O parameters for CPUID-related helpers */

@@ -247,6 +249,96 @@ static enum es_result verify_exception_info(struct ghcb *ghcb, struct es_em_ctxt
  	return ES_VMM_ERROR;
  }
 
+static __always_inline void issue_svsm_call(struct svsm_call *call, u8 *pending)
+{
+	/*
+	 * Issue the VMGEXIT to run the SVSM:
+	 *   - Load the SVSM register state (RAX, RCX, RDX, R8 and R9)
+	 *   - Set the CA call pending field to 1
+	 *   - Issue VMGEXIT
+	 *   - Save the SVSM return register state (RAX, RCX, RDX, R8 and R9)
+	 *   - Perform atomic exchange of the CA call pending field
+	 */
+	asm volatile("mov %9, %%r8\n\t"
+		     "mov %10, %%r9\n\t"
+		     "movb $1, %11\n\t"
+		     "rep; vmmcall\n\t"
+		     "mov %%r8, %3\n\t"
+		     "mov %%r9, %4\n\t"
+		     "xchgb %5, %11\n\t"
+		     : "=a" (call->rax_out), "=c" (call->rcx_out), "=d" (call->rdx_out),
+		       "=m" (call->r8_out), "=m" (call->r9_out),
+		       "+r" (*pending)
+		     : "a" (call->rax), "c" (call->rcx), "d" (call->rdx),
+		       "r" (call->r8), "r" (call->r9),
+		       "m" (call->caa->call_pending)
+		     : "r8", "r9", "memory");
+}
+
+static int __svsm_msr_protocol(struct svsm_call *call)
+{
+	u64 val, resp;
+	u8 pending;
+
+	val = sev_es_rd_ghcb_msr();
+
+	sev_es_wr_ghcb_msr(GHCB_MSR_VMPL_REQ_LEVEL(0));
+
+	pending = 0;
+	issue_svsm_call(call, &pending);
+
+	resp = sev_es_rd_ghcb_msr();
+
+	sev_es_wr_ghcb_msr(val);
+
+	if (pending)
+		return -EINVAL;
+
+	if (GHCB_RESP_CODE(resp) != GHCB_MSR_VMPL_RESP)
+		return -EINVAL;
+
+	if (GHCB_MSR_VMPL_RESP_VAL(resp) != 0)
+		return -EINVAL;
+
+	return call->rax_out;
+}
+
+static int __svsm_ghcb_protocol(struct ghcb *ghcb, struct svsm_call *call)
+{
+	struct es_em_ctxt ctxt;
+	u8 pending;
+
+	vc_ghcb_invalidate(ghcb);
+
+	/* Fill in protocol and format specifiers */
+	ghcb->protocol_version = ghcb_version;
+	ghcb->ghcb_usage       = GHCB_DEFAULT_USAGE;
+
+	ghcb_set_sw_exit_code(ghcb, SVM_VMGEXIT_SNP_RUN_VMPL);
+	ghcb_set_sw_exit_info_1(ghcb, 0);
+	ghcb_set_sw_exit_info_2(ghcb, 0);
+
+	sev_es_wr_ghcb_msr(__pa(ghcb));
+
+	pending = 0;
+	issue_svsm_call(call, &pending);
+
+	if (pending)
+		return -EINVAL;
+
+	switch (verify_exception_info(ghcb, &ctxt)) {
+	case ES_OK:
+		break;
+	case ES_EXCEPTION:
+		vc_forward_exception(&ctxt);
+		fallthrough;
+	default:
+		return -EINVAL;
+	}
+
+	return call->rax_out;
+}
+
  static enum es_result sev_es_ghcb_hv_call(struct ghcb *ghcb,
  					  struct es_em_ctxt *ctxt,
  					  u64 exit_code, u64 exit_info_1,

arch/x86/kernel/sev.c +129 -27

index 64799a04feb4..af5017ab9746 100644
@@ -134,6 +134,8 @@ struct ghcb_state {
 
  static DEFINE_PER_CPU(struct sev_es_runtime_data*, runtime_data);
  static DEFINE_PER_CPU(struct sev_es_save_area *, sev_vmsa);
+static DEFINE_PER_CPU(struct svsm_ca *, svsm_caa);
+static DEFINE_PER_CPU(u64, svsm_caa_pa);
 
  /*
   * SVSM related information:

@@ -141,6 +143,7 @@ static DEFINE_PER_CPU(struct sev_es_save_area *, sev_vmsa);
   *   non-zero. The VMPL is therefore used to indicate the presence of an SVSM.
   */
  static u8 vmpl __ro_after_init;
+static struct svsm_ca boot_svsm_ca_page __aligned(PAGE_SIZE);
  static struct svsm_ca *boot_svsm_caa __ro_after_init;
  static u64 boot_svsm_caa_pa __ro_after_init;
 

@@ -158,11 +161,26 @@ struct sev_config {
  	       */
  	      ghcbs_initialized	: 1,
 
+	      /*
+	       * A flag used to indicate when the per-CPU SVSM CA is to be
+	       * used instead of the boot SVSM CA.
+	       *
+	       * For APs, the per-CPU SVSM CA is created as part of the AP
+	       * bringup, so this flag can be used globally for the BSP and APs.
+	       */
+	      cas_initialized	: 1,
+
  	      __reserved	: 62;
  };
 
  static struct sev_config sev_cfg __read_mostly;
 
+static struct svsm_ca *__svsm_get_caa(void)
+{
+	return sev_cfg.cas_initialized ? this_cpu_read(svsm_caa)
+				       : boot_svsm_caa;
+}
+
  static __always_inline bool on_vc_stack(struct pt_regs *regs)
  {
  	unsigned long sp = regs->sp;

@@ -580,6 +598,33 @@ static enum es_result vc_ioio_check(struct es_em_ctxt *ctxt, u16 port, size_t si
  	return ES_EXCEPTION;
  }
 
+static __always_inline void vc_forward_exception(struct es_em_ctxt *ctxt)
+{
+	long error_code = ctxt->fi.error_code;
+	int trapnr = ctxt->fi.vector;
+
+	ctxt->regs->orig_ax = ctxt->fi.error_code;
+
+	switch (trapnr) {
+	case X86_TRAP_GP:
+		exc_general_protection(ctxt->regs, error_code);
+		break;
+	case X86_TRAP_UD:
+		exc_invalid_op(ctxt->regs);
+		break;
+	case X86_TRAP_PF:
+		write_cr2(ctxt->fi.cr2);
+		exc_page_fault(ctxt->regs, error_code);
+		break;
+	case X86_TRAP_AC:
+		exc_alignment_check(ctxt->regs, error_code);
+		break;
+	default:
+		pr_emerg("Unsupported exception in #VC instruction emulation - can't continue\n");
+		BUG();
+	}
+}
+
  /* Include code shared with pre-decompression boot stage */
  #include "sev-shared.c"
 

@@ -608,6 +653,42 @@ static noinstr void __sev_put_ghcb(struct ghcb_state *state)
  	}
  }
 
+static int svsm_protocol(struct svsm_call *call)
+{
+	struct ghcb_state state;
+	unsigned long flags;
+	struct ghcb *ghcb;
+	int ret;
+
+	/*
+	 * This can be called very early in the boot, use native functions in
+	 * order to avoid paravirt issues.
+	 */
+	flags = native_save_fl();
+	if (flags & X86_EFLAGS_IF)
+		native_irq_disable();
+
+	if (sev_cfg.ghcbs_initialized)
+		ghcb = __sev_get_ghcb(&state);
+	else if (boot_ghcb)
+		ghcb = boot_ghcb;
+	else
+		ghcb = NULL;
+
+	do {
+		ret = ghcb ? __svsm_ghcb_protocol(ghcb, call)
+			   : __svsm_msr_protocol(call);
+	} while (ret == SVSM_ERR_BUSY);
+
+	if (sev_cfg.ghcbs_initialized)
+		__sev_put_ghcb(&state);
+
+	if (flags & X86_EFLAGS_IF)
+		native_irq_enable();
+
+	return ret;
+}
+
  void noinstr __sev_es_nmi_complete(void)
  {
  	struct ghcb_state state;

@@ -1369,6 +1450,18 @@ static void __init alloc_runtime_data(int cpu)
  		panic("Can't allocate SEV-ES runtime data");
 
  	per_cpu(runtime_data, cpu) = data;
+
+	if (vmpl) {
+		struct svsm_ca *caa;
+
+		/* Allocate the SVSM CA page if an SVSM is present */
+		caa = memblock_alloc(sizeof(*caa), PAGE_SIZE);
+		if (!caa)
+			panic("Can't allocate SVSM CA page\n");
+
+		per_cpu(svsm_caa, cpu) = caa;
+		per_cpu(svsm_caa_pa, cpu) = __pa(caa);
+	}
  }
 
  static void __init init_ghcb(int cpu)

@@ -1418,6 +1511,31 @@ void __init sev_es_init_vc_handling(void)
  		init_ghcb(cpu);
  	}
 
+	/* If running under an SVSM, switch to the per-cpu CA */
+	if (vmpl) {
+		struct svsm_call call = {};
+		unsigned long flags;
+		int ret;
+
+		local_irq_save(flags);
+
+		/*
+		 * SVSM_CORE_REMAP_CA call:
+		 *   RAX = 0 (Protocol=0, CallID=0)
+		 *   RCX = New CA GPA
+		 */
+		call.caa = __svsm_get_caa();
+		call.rax = SVSM_CORE_CALL(SVSM_CORE_REMAP_CA);
+		call.rcx = this_cpu_read(svsm_caa_pa);
+		ret = svsm_protocol(&call);
+		if (ret != SVSM_SUCCESS)
+			panic("Can't remap the SVSM CA, ret=%#x (%d)\n", ret, ret);
+
+		sev_cfg.cas_initialized = true;
+
+		local_irq_restore(flags);
+	}
+
  	sev_es_setup_play_dead();
 
  	/* Secondary CPUs use the runtime #VC handler */

@@ -1842,33 +1960,6 @@ static enum es_result vc_handle_exitcode(struct es_em_ctxt *ctxt,
  	return result;
  }
 
-static __always_inline void vc_forward_exception(struct es_em_ctxt *ctxt)
-{
-	long error_code = ctxt->fi.error_code;
-	int trapnr = ctxt->fi.vector;
-
-	ctxt->regs->orig_ax = ctxt->fi.error_code;
-
-	switch (trapnr) {
-	case X86_TRAP_GP:
-		exc_general_protection(ctxt->regs, error_code);
-		break;
-	case X86_TRAP_UD:
-		exc_invalid_op(ctxt->regs);
-		break;
-	case X86_TRAP_PF:
-		write_cr2(ctxt->fi.cr2);
-		exc_page_fault(ctxt->regs, error_code);
-		break;
-	case X86_TRAP_AC:
-		exc_alignment_check(ctxt->regs, error_code);
-		break;
-	default:
-		pr_emerg("Unsupported exception in #VC instruction emulation - can't continue\n");
-		BUG();
-	}
-}
-
  static __always_inline bool is_vc2_stack(unsigned long sp)
  {
  	return (sp >= __this_cpu_ist_bottom_va(VC2) && sp < __this_cpu_ist_top_va(VC2));

@@ -2118,6 +2209,50 @@ static __head struct cc_blob_sev_info *find_cc_blob(struct boot_params *bp)
  	return cc_info;
  }
 
+static __head void setup_svsm(struct cc_blob_sev_info *cc_info)
+{
+	struct svsm_call call = {};
+	int ret;
+	u64 pa;
+
+	/*
+	 * Record the SVSM Calling Area address (CAA) if the guest is not
+	 * running at VMPL0. The CA will be used to communicate with the
+	 * SVSM to perform the SVSM services.
+	 */

arch/x86/kernel/sev.c +33 -6

+	 * RIP-relative addressing.
+	 */
+	pa = (u64)&RIP_REL_REF(boot_svsm_ca_page);
+
+	/*
+	 * Switch over to the boot SVSM CA while the current CA is still
+	 * addressable. There is no GHCB at this point so use the MSR protocol.
+	 *
+	 * SVSM_CORE_REMAP_CA call:
+	 *   RAX = 0 (Protocol=0, CallID=0)
+	 *   RCX = New CA GPA
+	 */
+	call.caa = __svsm_get_caa();
+	call.rax = SVSM_CORE_CALL(SVSM_CORE_REMAP_CA);
+	call.rcx = pa;
+	ret = svsm_protocol(&call);
+	if (ret != SVSM_SUCCESS)
+		panic("Can't remap the SVSM CA, ret=%#x (%d)\n", ret, ret);
+
+	boot_svsm_caa = (struct svsm_ca *)pa;
+	boot_svsm_caa_pa = pa;
+}
+
  bool __head snp_init(struct boot_params *bp)
  {
  	struct cc_blob_sev_info *cc_info;

@@ -2131,12 +2266,7 @@ bool __head snp_init(struct boot_params *bp)
 
  	setup_cpuid_table(cc_info);
 
-	/*
-	 * Record the SVSM Calling Area address (CAA) if the guest is not
-	 * running at VMPL0. The CA will be used to communicate with the
-	 * SVSM to perform the SVSM services.
-	 */
-	setup_svsm_ca(cc_info);
+	setup_svsm(cc_info);
 
  	/*
  	 * The CC blob will be used later to access the secrets page. Cache

@@ -2328,3 +2458,12 @@ void sev_show_status(void)
  	}
  	pr_cont("\n");
  }
+
+void __init snp_remap_svsm_ca(void)
+{
+	if (!vmpl)
+		return;
+
+	/* Update the CAA to a proper kernel address */
+	boot_svsm_caa = &boot_svsm_ca_page;
+}

arch/x86/mm/mem_encrypt_amd.c +7 -1

index 70b91de2e053..8943286f9fdc 100644
@@ -2,7 +2,7 @@
  /*
   * AMD Memory Encryption Support
   *
- * Copyright (C) 2016 Advanced Micro Devices, Inc.
+ * Copyright (C) 2016-2024 Advanced Micro Devices, Inc.
   *
   * Author: Tom Lendacky <[email protected]>
   */

@@ -492,6 +492,12 @@ void __init sme_early_init(void)
  	 */
  	if (sev_status & MSR_AMD64_SEV_ENABLED)
  		ia32_disable();
+
+	/*
+	 * Switch the SVSM CA mapping (if active) from identity mapped to
+	 * kernel mapped.
+	 */
+	snp_remap_svsm_ca();
  }
 
  void __init mem_encrypt_free_decrypted_mem(void)

Using the RMPADJUST instruction, the VSMA attribute can only be changed at VMPL0. An SVSM will be present when running at VMPL1 or a lower privilege level.

When an SVSM is present, use the SVSM_CORE_CREATE_VCPU call or the SVSM_CORE_DESTROY_VCPU call to perform VMSA attribute changes. Use the VMPL level supplied by the SVSM within the VMSA and when starting the AP.

Signed-off-by Tom Lendacky <[email protected]>

---
  arch/x86/include/asm/sev.h |  2 ++
  arch/x86/kernel/sev.c      | 60 +++++++++++++++++++++++++++++++++-----
  2 files changed, 54 insertions(+), 8 deletions(-)

arch/x86/include/asm/sev.h +2 -0

index 204f0a4857d6..d7be613b7372 100644
@@ -229,6 +229,8 @@ struct svsm_call {
  #define SVSM_CORE_CALL(x)		((0ULL << 32) | (x))
  #define SVSM_CORE_REMAP_CA		0
  #define SVSM_CORE_PVALIDATE		1
+#define SVSM_CORE_CREATE_VCPU		2
+#define SVSM_CORE_DELETE_VCPU		3
 
  #ifdef CONFIG_AMD_MEM_ENCRYPT
  extern void __sev_es_ist_enter(struct pt_regs *regs);

arch/x86/kernel/sev.c +52 -8

index d3e182d69d65..ea8b43a0f01b 100644
@@ -1016,7 +1016,7 @@ void snp_accept_memory(phys_addr_t start, phys_addr_t end)
  	set_pages_state(vaddr, npages, SNP_PAGE_STATE_PRIVATE);
  }
 
-static int snp_set_vmsa(void *va, bool vmsa)
+static int base_snp_set_vmsa(void *va, bool vmsa)
  {
  	u64 attrs;
 

@@ -1034,6 +1034,40 @@ static int snp_set_vmsa(void *va, bool vmsa)
  	return rmpadjust((unsigned long)va, RMP_PG_SIZE_4K, attrs);
  }
 
+static int svsm_snp_set_vmsa(void *va, void *caa, int apic_id, bool vmsa)
+{
+	struct svsm_call call = {};
+	unsigned long flags;
+	int ret;
+
+	local_irq_save(flags);
+
+	call.caa = this_cpu_read(svsm_caa);
+	call.rcx = __pa(va);
+
+	if (vmsa) {
+		/* Protocol 0, Call ID 2 */
+		call.rax = SVSM_CORE_CALL(SVSM_CORE_CREATE_VCPU);
+		call.rdx = __pa(caa);
+		call.r8  = apic_id;
+	} else {
+		/* Protocol 0, Call ID 3 */
+		call.rax = SVSM_CORE_CALL(SVSM_CORE_DELETE_VCPU);
+	}
+
+	ret = svsm_protocol(&call);
+
+	local_irq_restore(flags);
+
+	return ret;
+}
+
+static int snp_set_vmsa(void *va, void *caa, int apic_id, bool vmsa)
+{
+	return vmpl ? svsm_snp_set_vmsa(va, caa, apic_id, vmsa)
+		    : base_snp_set_vmsa(va, vmsa);
+}
+
  #define __ATTR_BASE		(SVM_SELECTOR_P_MASK | SVM_SELECTOR_S_MASK)
  #define INIT_CS_ATTRIBS		(__ATTR_BASE | SVM_SELECTOR_READ_MASK | SVM_SELECTOR_CODE_MASK)
  #define INIT_DS_ATTRIBS		(__ATTR_BASE | SVM_SELECTOR_WRITE_MASK)

@@ -1065,11 +1099,11 @@ static void *snp_alloc_vmsa_page(void)
  	return page_address(p + 1);
  }
 
-static void snp_cleanup_vmsa(struct sev_es_save_area *vmsa)
+static void snp_cleanup_vmsa(struct sev_es_save_area *vmsa, int apic_id)
  {
  	int err;
 
-	err = snp_set_vmsa(vmsa, false);
+	err = snp_set_vmsa(vmsa, NULL, apic_id, false);
  	if (err)
  		pr_err("clear VMSA page failed (%u), leaking page\n", err);
  	else

@@ -1080,6 +1114,7 @@ static int wakeup_cpu_via_vmgexit(u32 apic_id, unsigned long start_ip)
  {
  	struct sev_es_save_area *cur_vmsa, *vmsa;
  	struct ghcb_state state;
+	struct svsm_ca *caa;
  	unsigned long flags;
  	struct ghcb *ghcb;
  	u8 sipi_vector;

@@ -1126,6 +1161,12 @@ static int wakeup_cpu_via_vmgexit(u32 apic_id, unsigned long start_ip)
  	if (!vmsa)
  		return -ENOMEM;
 
+	/*
+	 * If an SVSM is present, then the SVSM CAA per-CPU variable will
+	 * have a value, otherwise it will be NULL.
+	 */
+	caa = per_cpu(svsm_caa, cpu);
+
  	/* CR4 should maintain the MCE value */
  	cr4 = native_read_cr4() & X86_CR4_MCE;
 

@@ -1173,11 +1214,11 @@ static int wakeup_cpu_via_vmgexit(u32 apic_id, unsigned long start_ip)
  	 *   VMPL level
  	 *   SEV_FEATURES (matches the SEV STATUS MSR right shifted 2 bits)
  	 */
-	vmsa->vmpl		= 0;
+	vmsa->vmpl		= vmpl;
  	vmsa->sev_features	= sev_status >> 2;
 
  	/* Switch the page over to a VMSA page now that it is initialized */
-	ret = snp_set_vmsa(vmsa, true);
+	ret = snp_set_vmsa(vmsa, caa, apic_id, true);
  	if (ret) {
  		pr_err("set VMSA page failed (%u)\n", ret);
  		free_page((unsigned long)vmsa);

@@ -1193,7 +1234,10 @@ static int wakeup_cpu_via_vmgexit(u32 apic_id, unsigned long start_ip)
  	vc_ghcb_invalidate(ghcb);
  	ghcb_set_rax(ghcb, vmsa->sev_features);
  	ghcb_set_sw_exit_code(ghcb, SVM_VMGEXIT_AP_CREATION);
-	ghcb_set_sw_exit_info_1(ghcb, ((u64)apic_id << 32) | SVM_VMGEXIT_AP_CREATE);
+	ghcb_set_sw_exit_info_1(ghcb,
+				((u64)apic_id << 32)	|
+				((u64)vmpl << 16)	|
+				SVM_VMGEXIT_AP_CREATE);
  	ghcb_set_sw_exit_info_2(ghcb, __pa(vmsa));
 
  	sev_es_wr_ghcb_msr(__pa(ghcb));

@@ -1211,13 +1255,13 @@ static int wakeup_cpu_via_vmgexit(u32 apic_id, unsigned long start_ip)
 
  	/* Perform cleanup if there was an error */
  	if (ret) {
-		snp_cleanup_vmsa(vmsa);
+		snp_cleanup_vmsa(vmsa, apic_id);
  		vmsa = NULL;
  	}
 
  	/* Free up any previous VMSA page */
  	if (cur_vmsa)
-		snp_cleanup_vmsa(cur_vmsa);
+		snp_cleanup_vmsa(cur_vmsa, apic_id);
 
  	/* Record the current VMSA page */
  	per_cpu(sev_vmsa, cpu) = vmsa;

The SVSM specification documents an alternative method of discovery for the SVSM using a reserved CPUID bit and a reserved MSR.

For the CPUID support, the SNP CPUID table is updated to set bit 28 of the EAX register of the 0x8000001f leaf when an SVSM is present. This bit has been reserved for use in this capacity.

For the MSR support, a new reserved MSR 0xc001f000 has been defined. A #VC should be generated when accessing this MSR. The #VC handler is expected to ignore writes to this MSR and return the physical calling area address (CAA) on reads of this MSR.

Signed-off-by Tom Lendacky <[email protected]>

---
  arch/x86/include/asm/cpufeatures.h |  1 +
  arch/x86/include/asm/msr-index.h   |  2 ++
  arch/x86/kernel/sev-shared.c       | 11 +++++++++++
  arch/x86/kernel/sev.c              | 17 +++++++++++++++++
  4 files changed, 31 insertions(+)

arch/x86/include/asm/cpufeatures.h +1 -0

index a38f8f9ba657..51e7c879f057 100644
@@ -446,6 +446,7 @@
  #define X86_FEATURE_V_TSC_AUX		(19*32+ 9) /* "" Virtual TSC_AUX */
  #define X86_FEATURE_SME_COHERENT	(19*32+10) /* "" AMD hardware-enforced cache coherency */
  #define X86_FEATURE_DEBUG_SWAP		(19*32+14) /* AMD SEV-ES full debug state swap support */
+#define X86_FEATURE_SVSM_PRESENT	(19*32+28) /* "" SNP SVSM is present */
 
  /* AMD-defined Extended Feature 2 EAX, CPUID level 0x80000021 (EAX), word 20 */
  #define X86_FEATURE_NO_NESTED_DATA_BP	(20*32+ 0) /* "" No Nested Data Breakpoints */

arch/x86/include/asm/msr-index.h +2 -0

index 05956bd8bacf..cc4de3379265 100644
@@ -654,6 +654,8 @@
  #define MSR_AMD64_RMP_BASE		0xc0010132
  #define MSR_AMD64_RMP_END		0xc0010133
 
+#define MSR_SVSM_CAA			0xc001f000
+
  /* AMD Collaborative Processor Performance Control MSRs */
  #define MSR_AMD_CPPC_CAP1		0xc00102b0
  #define MSR_AMD_CPPC_ENABLE		0xc00102b1

arch/x86/kernel/sev-shared.c +11 -0

index e63c0a6eccd6..17eb42c4ae71 100644
@@ -1559,6 +1559,8 @@ static enum es_result vc_check_opcode_bytes(struct es_em_ctxt *ctxt,
  static void __head setup_svsm_ca(const struct cc_blob_sev_info *cc_info)
  {
  	struct snp_secrets_page_layout *secrets_page;
+	struct snp_cpuid_table *cpuid_table;
+	unsigned int i;
  	u64 caa;
 
  	BUILD_BUG_ON(sizeof(*secrets_page) != PAGE_SIZE);

@@ -1596,4 +1598,13 @@ static void __head setup_svsm_ca(const struct cc_blob_sev_info *cc_info)
  	 */
  	boot_svsm_caa = (struct svsm_ca *)caa;
  	boot_svsm_caa_pa = caa;
+
+	/* Advertise the SVSM presence via CPUID. */
+	cpuid_table = (struct snp_cpuid_table *)snp_cpuid_get_table();
+	for (i = 0; i < cpuid_table->count; i++) {
+		struct snp_cpuid_fn *fn = &cpuid_table->fn[i];
+
+		if (fn->eax_in == 0x8000001f)
+			fn->eax |= BIT(28);
+	}
  }

arch/x86/kernel/sev.c +17 -0

index ea8b43a0f01b..7f399ea87a3c 100644
@@ -1347,12 +1347,29 @@ int __init sev_es_efi_map_ghcbs(pgd_t *pgd)
  	return 0;
  }
 
+static enum es_result vc_handle_svsm_caa_msr(struct es_em_ctxt *ctxt)
+{
+	struct pt_regs *regs = ctxt->regs;
+
+	/* Writes to the SVSM CAA msr are ignored */
+	if (ctxt->insn.opcode.bytes[1] == 0x30)
+		return ES_OK;
+
+	regs->ax = lower_32_bits(this_cpu_read(svsm_caa_pa));
+	regs->dx = upper_32_bits(this_cpu_read(svsm_caa_pa));
+
+	return ES_OK;
+}
+
  static enum es_result vc_handle_msr(struct ghcb *ghcb, struct es_em_ctxt *ctxt)
  {
  	struct pt_regs *regs = ctxt->regs;
  	enum es_result ret;
  	u64 exit_info_1;
 
+	if (regs->cx == MSR_SVSM_CAA)
+		return vc_handle_svsm_caa_msr(ctxt);
+
  	/* Is it a WRMSR? */
  	exit_info_1 = (ctxt->insn.opcode.bytes[1] == 0x30) ? 1 : 0;
 

Currently, the sev-guest driver uses the vmpck-0 key by default. When an SVSM is present the kernel is running at a VMPL other than 0 and the vmpck-0 key is no longer available. So choose the vmpck key based on the active VMPL level.

Hey, Tom, came looking to review the tsm_report changes and noticed this...

Tom Lendacky wrote:

Quoted 4 lines

Currently, the sev-guest driver uses the vmpck-0 key by default. When an SVSM is present the kernel is running at a VMPL other than 0 and the vmpck-0 key is no longer available. So choose the vmpck key based on the active VMPL level.

The module parameter is not mentioned in the changelog. Is it not sufficient to always use snp_get_vmpl(), and if not should there be some documentation about when to specify vmpck_id?

Do users know that "vmpl" and "vmpck_id" are interchangeable?

Quoted 9 lines · Dan Williams

Hey, Tom, came looking to review the tsm_report changes and noticed this...

Quoted 4 lines · Tom Lendacky

Currently, the sev-guest driver uses the vmpck-0 key by default. When an SVSM is present the kernel is running at a VMPL other than 0 and the vmpck-0 key is no longer available. So choose the vmpck key based on the active VMPL level.

Quoted 3 lines

The module parameter is not mentioned in the changelog. Is it not sufficient to always use snp_get_vmpl(), and if not should there be some documentation about when to specify vmpck_id?

It is possible to encounter an issue that causes the vmpck key to be cleared. In that situation, the guest is allowed to use a vmpck key associated with a lower VMPL. For that reason, the module parameter was added to the driver when it was initially created.

I can update the changelog to mention this.

With the introduction of an SVSM, Linux will be running at a non-zero VMPL. Any request for an attestation report at a higher priviledge VMPL than what Linux is currently running will result in an error. Allow for the privlevel_floor attribute to be updated dynamically so that the attribute may be set dynamically.

Signed-off-by Tom Lendacky <[email protected]>

---
 drivers/virt/coco/sev-guest/sev-guest.c | 5 ++++-
 include/linux/tsm.h                     | 2 +-
 2 files changed, 5 insertions(+), 2 deletions(-)

drivers/virt/coco/sev-guest/sev-guest.c +1 -1

index 1ff897913bf4..bba6531cb606 100644
@@ -885,7 +885,7 @@ static int sev_report_new(struct tsm_report *report, void *data)
 	return 0;
 }
 
-static const struct tsm_ops sev_tsm_ops = {
+static struct tsm_ops sev_tsm_ops = {
 	.name = KBUILD_MODNAME,
 	.report_new = sev_report_new,
 };

Quoted 29 lines · Tom Lendacky

With the introduction of an SVSM, Linux will be running at a non-zero VMPL. Any request for an attestation report at a higher priviledge VMPL than what Linux is currently running will result in an error. Allow for the privlevel_floor attribute to be updated dynamically so that the attribute may be set dynamically.

Signed-off-by Tom Lendacky <[email protected]>

---
  drivers/virt/coco/sev-guest/sev-guest.c | 5 ++++-
  include/linux/tsm.h                     | 2 +-
  2 files changed, 5 insertions(+), 2 deletions(-)

drivers/virt/coco/sev-guest/sev-guest.c +1 -1

index 1ff897913bf4..bba6531cb606 100644
@@ -885,7 +885,7 @@ static int sev_report_new(struct tsm_report *report, void *data)
  	return 0;
  }
 
-static const struct tsm_ops sev_tsm_ops = {
+static struct tsm_ops sev_tsm_ops = {
  	.name = KBUILD_MODNAME,
  	.report_new = sev_report_new,
  };

@@ -972,6 +972,9 @@ static int __init sev_guest_probe(struct platform_device *pdev)
  	snp_dev->input.resp_gpa = __pa(snp_dev->response);
  	snp_dev->input.data_gpa = __pa(snp_dev->certs_data);
 

drivers/virt/coco/sev-guest/sev-guest.c static int __init sev_guest_probe(struct platform_device *pdev) · line 976

Quoted 2 lines

drivers/virt/coco/sev-guest/sev-guest.c +2 -0

+	/* Set the privlevel_floor attribute based on the current VMPL */
+	sev_tsm_ops.privlevel_floor = snp_get_vmpl();

Why is this not vmpck_id?

Quoted 30 lines · Dan Williams

Quoted 29 lines · Tom Lendacky

With the introduction of an SVSM, Linux will be running at a non-zero VMPL. Any request for an attestation report at a higher priviledge VMPL than what Linux is currently running will result in an error. Allow for the privlevel_floor attribute to be updated dynamically so that the attribute may be set dynamically.

Signed-off-by Tom Lendacky <[email protected]>

---
  drivers/virt/coco/sev-guest/sev-guest.c | 5 ++++-
  include/linux/tsm.h                     | 2 +-
  2 files changed, 5 insertions(+), 2 deletions(-)

drivers/virt/coco/sev-guest/sev-guest.c +1 -1

index 1ff897913bf4..bba6531cb606 100644
@@ -885,7 +885,7 @@ static int sev_report_new(struct tsm_report *report, void *data)
  	return 0;
  }
 
-static const struct tsm_ops sev_tsm_ops = {
+static struct tsm_ops sev_tsm_ops = {
  	.name = KBUILD_MODNAME,
  	.report_new = sev_report_new,
  };

@@ -972,6 +972,9 @@ static int __init sev_guest_probe(struct platform_device *pdev)
  	snp_dev->input.resp_gpa = __pa(snp_dev->response);
  	snp_dev->input.data_gpa = __pa(snp_dev->certs_data);
 

Quoted 4 lines

drivers/virt/coco/sev-guest/sev-guest.c static int __init sev_guest_probe(struct platform_device *pdev) · line 976

Quoted 2 lines

drivers/virt/coco/sev-guest/sev-guest.c +2 -0

+	/* Set the privlevel_floor attribute based on the current VMPL */
+	sev_tsm_ops.privlevel_floor = snp_get_vmpl();

Why is this not vmpck_id?

Good catch, this probably should be pulled out separately and submitted as a Fixes: against the current support. If you think it's important enough, I can do that and put this at the beginning of the series. Or I can just modify this to use the vmpck_id value. Any preference?

Quoted 36 lines · Tom Lendacky

Quoted 30 lines · Dan Williams

Quoted 29 lines · Tom Lendacky

With the introduction of an SVSM, Linux will be running at a non-zero VMPL. Any request for an attestation report at a higher priviledge VMPL than what Linux is currently running will result in an error. Allow for the privlevel_floor attribute to be updated dynamically so that the attribute may be set dynamically.

Signed-off-by Tom Lendacky <[email protected]>

---
   drivers/virt/coco/sev-guest/sev-guest.c | 5 ++++-
   include/linux/tsm.h                     | 2 +-
   2 files changed, 5 insertions(+), 2 deletions(-)

drivers/virt/coco/sev-guest/sev-guest.c +1 -1

index 1ff897913bf4..bba6531cb606 100644
@@ -885,7 +885,7 @@ static int sev_report_new(struct tsm_report *report, void *data)
   	return 0;
   }
 
-static const struct tsm_ops sev_tsm_ops = {
+static struct tsm_ops sev_tsm_ops = {
   	.name = KBUILD_MODNAME,
   	.report_new = sev_report_new,
   };

@@ -972,6 +972,9 @@ static int __init sev_guest_probe(struct platform_device *pdev)
   	snp_dev->input.resp_gpa = __pa(snp_dev->response);
   	snp_dev->input.data_gpa = __pa(snp_dev->certs_data);
 

Quoted 4 lines

drivers/virt/coco/sev-guest/sev-guest.c static int __init sev_guest_probe(struct platform_device *pdev) · line 976

Quoted 2 lines

drivers/virt/coco/sev-guest/sev-guest.c +2 -0

+	/* Set the privlevel_floor attribute based on the current VMPL */
+	sev_tsm_ops.privlevel_floor = snp_get_vmpl();

Why is this not vmpck_id?

Quoted 4 lines

Good catch, this probably should be pulled out separately and submitted as a Fixes: against the current support. If you think it's important enough, I can do that and put this at the beginning of the series. Or I can just modify this to use the vmpck_id value. Any preference?

I dunno, you tell me. What breaks if privlevel_floor is mismatched vs vmpl and/or vmpck_id? If it warrants a "Fixes:" it should probably be broken out.

However, I *guess* it is just adding some sanity checking precision to userspace requests and makes some input validation not catch errors when userspace tries to generate reports from the wrong level, right? I.e. privlevel_floor may be lower than expected, but userspace should not be depending on that since the report generation will fail.

When an SVSM is present, the guest can also request attestation reports from the SVSM. These SVSM attestation reports can be used to attest the SVSM and any services running within the SVSM.

Extend the config-fs attestation support to allow for an SVSM attestation report. This involves creating four (4) new config-fs attributes:

- 'service-provider' (input)
This attribute is used to determine whether the attestation request should be sent to the specified service provider or to the SEV firmware. The SVSM service provider is represented by the value 'svsm'.

- 'service_guid' (input)
Used for requesting the attestation of a single service within the service provider. A null GUID implies that the SVSM_ATTEST_SERVICES call should be used to request the attestation report. A non-null GUID implies that the SVSM_ATTEST_SINGLE_SERVICE call should be used.

- 'service_manifest_version' (input)
Used with the SVSM_ATTEST_SINGLE_SERVICE call, the service version represents a specific service manifest version be used for the attestation report.

- 'manifestblob' (output)
Used to return the service manifest associated with the attestation report.

Signed-off-by Tom Lendacky <[email protected]>

---
 Documentation/ABI/testing/configfs-tsm  |  69 +++++++++++
 arch/x86/include/asm/sev.h              |  31 ++++-
 arch/x86/kernel/sev.c                   |  50 ++++++++
 drivers/virt/coco/sev-guest/sev-guest.c | 151 ++++++++++++++++++++++++
 drivers/virt/coco/tsm.c                 |  93 ++++++++++++++-
 include/linux/tsm.h                     |  11 ++
 6 files changed, 402 insertions(+), 3 deletions(-)

Documentation/ABI/testing/configfs-tsm +4 -0

index dd24202b5ba5..72a7acdb5258 100644
@@ -31,6 +31,21 @@ Description:
 		Standardization v2.03 Section 4.1.8.1 MSG_REPORT_REQ.
 		https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/specifications/56421.pdf
 
+What:		/sys/kernel/config/tsm/report/$name/manifestblob
+Date:		January, 2024
+KernelVersion:	v6.10
+Contact:	[email protected]

Documentation/ABI/testing/configfs-tsm +8 -0

+
 What:		/sys/kernel/config/tsm/report/$name/provider
 Date:		September, 2023
 KernelVersion:	v6.7

@@ -80,3 +95,57 @@ Contact:	[email protected]
 Description:
 		(RO) Indicates the minimum permissible value that can be written
 		to @privlevel.
+
+What:		/sys/kernel/config/tsm/report/$name/service_provider
+Date:		January, 2024
+KernelVersion:	v6.10
+Contact:	[email protected]
+Description:
+		(WO) Attribute is visible if a TSM implementation provider

Documentation/ABI/testing/configfs-tsm +9 -0

+
+What:		/sys/kernel/config/tsm/report/$name/service_guid
+Date:		January, 2024
+KernelVersion:	v6.10
+Contact:	[email protected]
+Description:
+		(WO) Attribute is visible if a TSM implementation provider
+		supports the concept of attestation reports from a service
+		provider for TVMs, like SEV-SNP running under an SVSM.

Documentation/ABI/testing/configfs-tsm +4 -0

+
+What:		/sys/kernel/config/tsm/report/$name/service_manifest_version
+Date:		January, 2024
+KernelVersion:	v6.10

arch/x86/include/asm/sev.h +30 -1

index 066eb0ba3d63..94af7fb7a8e1 100644
@@ -209,6 +209,27 @@ struct svsm_pvalidate_call {
 	struct svsm_pvalidate_entry entry[];
 };
 
+/*
+ * The SVSM Attestation related structures
+ */
+struct svsm_location_entry {
+	u64 pa;
+	u32 len;
+	u8 rsvd[4];
+};
+
+struct svsm_attestation_call {
+	struct svsm_location_entry report_buffer;
+	struct svsm_location_entry nonce;
+	struct svsm_location_entry manifest_buffer;
+	struct svsm_location_entry certificates_buffer;
+
+	/* For attesting a single service */
+	u8 service_guid[16];
+	u32 service_manifest_version;
+	u8 rsvd[4];
+};
+
 /*
  * SVSM protocol structure
  */

@@ -232,6 +253,10 @@ struct svsm_call {
 #define SVSM_CORE_CREATE_VCPU		2
 #define SVSM_CORE_DELETE_VCPU		3
 
+#define SVSM_ATTEST_CALL(x)		((1ULL << 32) | (x))
+#define SVSM_ATTEST_SERVICES		0
+#define SVSM_ATTEST_SINGLE_SERVICE	1
+
 #ifdef CONFIG_AMD_MEM_ENCRYPT
 extern void __sev_es_ist_enter(struct pt_regs *regs);
 extern void __sev_es_ist_exit(void);

@@ -302,6 +327,7 @@ void snp_set_wakeup_secondary_cpu(void);
 bool snp_init(struct boot_params *bp);
 void __noreturn snp_abort(void);
 int snp_issue_guest_request(u64 exit_code, struct snp_req_data *input, struct snp_guest_request_ioctl *rio);
+int snp_issue_svsm_attestation_request(u64 call_id, struct svsm_attestation_call *input);
 void snp_accept_memory(phys_addr_t start, phys_addr_t end);
 u64 snp_get_unsupported_features(u64 status);
 u64 sev_get_status(void);

@@ -333,7 +359,10 @@ static inline int snp_issue_guest_request(u64 exit_code, struct snp_req_data *in
 {
 	return -ENOTTY;
 }
-
+static inline int snp_issue_svsm_attestation_request(u64 call_id, struct svsm_attestation_call *input)
+{
+	return -ENOTTY;
+}
 static inline void snp_accept_memory(phys_addr_t start, phys_addr_t end) { }
 static inline u64 snp_get_unsupported_features(u64 status) { return 0; }
 static inline u64 sev_get_status(void) { return 0; }

arch/x86/kernel/sev.c +50 -0

index 7e2b9934a95d..0a06632898c6 100644
@@ -2400,6 +2400,56 @@ static int __init init_sev_config(char *str)
 }
 __setup("sev=", init_sev_config);
 
+static void update_attestation_input(struct svsm_call *call, struct svsm_attestation_call *input)
+{
+	/* If (new) lengths have been returned, propograte them up */
+	if (call->rcx_out != call->rcx)
+		input->manifest_buffer.len = call->rcx_out;
+
+	if (call->rdx_out != call->rdx)
+		input->certificates_buffer.len = call->rdx_out;
+
+	if (call->r8_out != call->r8)
+		input->report_buffer.len = call->r8_out;
+}
+
+int snp_issue_svsm_attestation_request(u64 call_id, struct svsm_attestation_call *input)
+{
+	struct svsm_attestation_call *attest_call;
+	struct svsm_call call = {};
+	unsigned long flags;
+	u64 attest_call_pa;
+	int ret;
+
+	if (!vmpl)
+		return -EINVAL;
+
+	local_irq_save(flags);
+
+	call.caa = __svsm_get_caa();
+
+	attest_call = (struct svsm_attestation_call *)call.caa->svsm_buffer;
+	attest_call_pa = __svsm_get_caa_pa() + offsetof(struct svsm_ca, svsm_buffer);
+
+	*attest_call = *input;
+
+	/*
+	 * Set input registers for the request and set RDX and R8 to known
+	 * values in order to detect length values being returned in them.
+	 */
+	call.rax = call_id;
+	call.rcx = attest_call_pa;
+	call.rdx = -1;
+	call.r8 = -1;
+	ret = svsm_protocol(&call);
+	update_attestation_input(&call, input);
+
+	local_irq_restore(flags);
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(snp_issue_svsm_attestation_request);
+
 int snp_issue_guest_request(u64 exit_code, struct snp_req_data *input, struct snp_guest_request_ioctl *rio)
 {
 	struct ghcb_state state;

drivers/virt/coco/sev-guest/sev-guest.c +151 -0

index bba6531cb606..0d2c9926a97c 100644
@@ -38,6 +38,8 @@
 #define SNP_REQ_MAX_RETRY_DURATION	(60*HZ)
 #define SNP_REQ_RETRY_DELAY		(2*HZ)
 
+#define SVSM_MAX_RETRIES		3
+
 struct snp_guest_crypto {
 	struct crypto_aead *tfm;
 	u8 *iv, *authtag;

@@ -783,6 +785,148 @@ struct snp_msg_cert_entry {
 	u32 length;
 };
 
+static int sev_svsm_report_new(struct tsm_report *report, void *data)
+{
+	unsigned int report_len, manifest_len, certificates_len;
+	void *report_blob, *manifest_blob, *certificates_blob;
+	struct svsm_attestation_call attest_call = {};
+	struct tsm_desc *desc = &report->desc;
+	unsigned int retry_count;
+	unsigned int size;
+	bool try_again;
+	void *buffer;
+	u64 call_id;
+	int ret;
+
+	/*
+	 * Allocate pages for the request:
+	 * - Report blob (4K)
+	 * - Manifest blob (4K)
+	 * - Certificate blob (16K)
+	 *
+	 * Above addresses must be 4K aligned
+	 */
+	report_len = SZ_4K;
+	manifest_len = SZ_4K;
+	certificates_len = SEV_FW_BLOB_MAX_SIZE;
+
+	if (guid_is_null(&desc->service_guid)) {
+		call_id = SVSM_ATTEST_CALL(SVSM_ATTEST_SERVICES);
+	} else {
+		export_guid(attest_call.service_guid, &desc->service_guid);
+		attest_call.service_manifest_version = desc->service_manifest_version;
+
+		call_id = SVSM_ATTEST_CALL(SVSM_ATTEST_SINGLE_SERVICE);
+	}
+
+	retry_count = 0;
+
+retry:
+	size = report_len + manifest_len + certificates_len;
+	buffer = alloc_pages_exact(size, __GFP_ZERO);
+	if (!buffer)
+		return -ENOMEM;
+
+	report_blob = buffer;
+	attest_call.report_buffer.pa = __pa(report_blob);
+	attest_call.report_buffer.len = report_len;
+
+	manifest_blob = report_blob + report_len;
+	attest_call.manifest_buffer.pa = __pa(manifest_blob);
+	attest_call.manifest_buffer.len = manifest_len;
+
+	certificates_blob = manifest_blob + manifest_len;
+	attest_call.certificates_buffer.pa = __pa(certificates_blob);
+	attest_call.certificates_buffer.len = certificates_len;
+
+	attest_call.nonce.pa = __pa(desc->inblob);
+	attest_call.nonce.len = desc->inblob_len;
+
+	ret = snp_issue_svsm_attestation_request(call_id, &attest_call);
+	switch (ret) {
+	case SVSM_SUCCESS:
+		break;
+	case SVSM_ERR_INVALID_PARAMETER:
+		ret = -EINVAL;
+
+		if (retry_count >= SVSM_MAX_RETRIES)
+			goto error;
+
+		try_again = false;
+
+		if (attest_call.report_buffer.len > report_len) {
+			report_len = PAGE_ALIGN(attest_call.report_buffer.len);
+			try_again = true;
+		}
+
+		if (attest_call.manifest_buffer.len > manifest_len) {
+			manifest_len = PAGE_ALIGN(attest_call.manifest_buffer.len);
+			try_again = true;
+		}
+
+		if (attest_call.certificates_buffer.len > certificates_len) {
+			certificates_len = PAGE_ALIGN(attest_call.certificates_buffer.len);
+			try_again = true;
+		}
+
+		/* If one of the buffers wasn't large enough, retry the request */
+		if (try_again) {
+			free_pages_exact(buffer, size);
+			retry_count++;
+			goto retry;
+		}
+
+		goto error;
+	case SVSM_ERR_BUSY:
+		ret = -EAGAIN;
+		goto error;
+	default:
+		pr_err_ratelimited("SVSM attestation request failed (%#x)\n", ret);
+		ret = -EINVAL;
+		goto error;
+	}
+
+	ret = -ENOMEM;
+
+	report_len = attest_call.report_buffer.len;
+	void *rbuf __free(kvfree) = kvzalloc(report_len, GFP_KERNEL);
+	if (!rbuf)
+		goto error;
+
+	memcpy(rbuf, report_blob, report_len);
+	report->outblob = no_free_ptr(rbuf);
+	report->outblob_len = report_len;
+
+	manifest_len = attest_call.manifest_buffer.len;
+	void *mbuf __free(kvfree) = kvzalloc(manifest_len, GFP_KERNEL);
+	if (!mbuf)
+		goto error;
+
+	memcpy(mbuf, manifest_blob, manifest_len);
+	report->manifestblob = no_free_ptr(mbuf);
+	report->manifestblob_len = manifest_len;
+
+	certificates_len = attest_call.certificates_buffer.len;
+	if (!certificates_len)
+		goto success;
+
+	void *cbuf __free(kvfree) = kvzalloc(certificates_len, GFP_KERNEL);
+	if (!cbuf)
+		goto error;
+
+	memcpy(cbuf, certificates_blob, certificates_len);
+	report->auxblob = no_free_ptr(cbuf);
+	report->auxblob_len = certificates_len;
+
+success:
+	ret = 0;
+
+error:
+	free_pages_exact(buffer, size);
+
+	return ret;
+}
+
 static int sev_report_new(struct tsm_report *report, void *data)
 {
 	struct snp_msg_cert_entry *cert_table;

@@ -797,6 +941,13 @@ static int sev_report_new(struct tsm_report *report, void *data)
 	if (desc->inblob_len != SNP_REPORT_USER_DATA_SIZE)
 		return -EINVAL;
 
+	if (desc->service_provider) {
+		if (strcmp(desc->service_provider, "svsm"))
+			return -EINVAL;
+
+		return sev_svsm_report_new(report, data);
+	}
+
 	void *buf __free(kvfree) = kvzalloc(size, GFP_KERNEL);
 	if (!buf)
 		return -ENOMEM;

drivers/virt/coco/tsm.c +6 -1

index d1c2db83a8ca..46f230bf13ac 100644
@@ -35,7 +35,7 @@ static DECLARE_RWSEM(tsm_rwsem);
  * The attestation report format is TSM provider specific, when / if a standard
  * materializes that can be published instead of the vendor layout. Until then
  * the 'provider' attribute indicates the format of 'outblob', and optionally
- * 'auxblob'.
+ * 'auxblob' and 'manifestblob'.
  */
 
 struct tsm_report_state {

@@ -48,6 +48,7 @@ struct tsm_report_state {
 enum tsm_data_select {
 	TSM_REPORT,
 	TSM_CERTS,
+	TSM_MANIFEST,
 };
 
 static struct tsm_report *to_tsm_report(struct config_item *cfg)

@@ -119,6 +120,74 @@ static ssize_t tsm_report_privlevel_floor_show(struct config_item *cfg,
 }
 CONFIGFS_ATTR_RO(tsm_report_, privlevel_floor);
 
+static ssize_t tsm_report_service_provider_store(struct config_item *cfg,
+						 const char *buf, size_t len)
+{
+	struct tsm_report *report = to_tsm_report(cfg);