linux.git/arch/x86/kernel/sev.c, branch v6.2

x86/insn: Avoid namespace clash by separating instruction decoder MMIO type from MMIO trace type

2023-01-03T17:46:06+00:00

Both  and  define various MMIO_ enum constants,
whose namespace overlaps.

Rename the  ones to have a INSN_ prefix, so that the headers can be
used from the same source file.

Signed-off-by: Jason A. Donenfeld 
Signed-off-by: Ingo Molnar 
Link: https://lore.kernel.org/r/20230101162910.710293-2-Jason@zx2c4.com

x86/sev: Mark snp_abort() noreturn

2022-08-25T13:54:03+00:00

Mark both the function prototype and definition as noreturn in order to
prevent the compiler from doing transformations which confuse objtool
like so:

  vmlinux.o: warning: objtool: sme_enable+0x71: unreachable instruction

This triggers with gcc-12.

Add it and sev_es_terminate() to the objtool noreturn tracking array
too. Sort it while at it.

Suggested-by: Michael Matz 
Signed-off-by: Borislav Petkov 
Acked-by: Peter Zijlstra 
Link: https://lore.kernel.org/r/20220824152420.20547-1-bp@alien8.de

x86/sev: Don't use cc_platform_has() for early SEV-SNP calls

2022-08-24T07:54:32+00:00

When running identity-mapped and depending on the kernel configuration,
it is possible that the compiler uses jump tables when generating code
for cc_platform_has().

This causes a boot failure because the jump table uses un-mapped kernel
virtual addresses, not identity-mapped addresses. This has been seen
with CONFIG_RETPOLINE=n.

Similar to sme_encrypt_kernel(), use an open-coded direct check for the
status of SNP rather than trying to eliminate the jump table. This
preserves any code optimization in cc_platform_has() that can be useful
post boot. It also limits the changes to SEV-specific files so that
future compiler features won't necessarily require possible build changes
just because they are not compatible with running identity-mapped.

  [ bp: Massage commit message. ]

Fixes: 5e5ccff60a29 ("x86/sev: Add helper for validating pages in early enc attribute changes")
Reported-by: Sean Christopherson 
Suggested-by: Sean Christopherson 
Signed-off-by: Tom Lendacky 
Signed-off-by: Borislav Petkov 
Cc:  # 5.19.x
Link: https://lore.kernel.org/all/YqfabnTRxFSM+LoX@google.com/

Revert "x86/sev: Expose sev_es_ghcb_hv_call() for use by HyperV"

2022-07-27T16:09:13+00:00

This reverts commit 007faec014cb5d26983c1f86fd08c6539b41392e.

Now that hyperv does its own protocol negotiation:

  49d6a3c062a1 ("x86/Hyper-V: Add SEV negotiate protocol support in Isolation VM")

revert this exposure of the sev_es_ghcb_hv_call() helper.

Cc: Wei Liu 
Signed-off-by: Borislav Petkov 
Reviewed-by：Tianyu Lan 
Link: https://lore.kernel.org/r/20220614014553.1915929-1-ltykernel@gmail.com

x86/sev: Fix address space sparse warning

2022-05-02T15:34:29+00:00

Fix:

  arch/x86/kernel/sev.c:605:16: warning: incorrect type in assignment (different address spaces)
  arch/x86/kernel/sev.c:605:16:    expected struct snp_secrets_page_layout *layout
  arch/x86/kernel/sev.c:605:16:    got void [noderef] __iomem *[assigned] mem

Reported-by: kernel test robot 
Signed-off-by: Borislav Petkov 
Link: https://lore.kernel.org/r/202205022233.XgNDR7WR-lkp@intel.com

x86/sev: Get the AP jump table address from secrets page

2022-04-27T11:31:38+00:00

The GHCB specification section 2.7 states that when SEV-SNP is enabled,
a guest should not rely on the hypervisor to provide the address of the
AP jump table. Instead, if a guest BIOS wants to provide an AP jump
table, it should record the address in the SNP secrets page so the guest
operating system can obtain it directly from there.

Fix this on the guest kernel side by having SNP guests use the AP jump
table address published in the secrets page rather than issuing a GHCB
request to get it.

  [ mroth:
    - Improve error handling when ioremap()/memremap() return NULL
    - Don't mix function calls with declarations
    - Add missing __init
    - Tweak commit message ]

Fixes: 0afb6b660a6b ("x86/sev: Use SEV-SNP AP creation to start secondary CPUs")
Signed-off-by: Brijesh Singh 
Signed-off-by: Michael Roth 
Signed-off-by: Borislav Petkov 
Link: https://lore.kernel.org/r/20220422135624.114172-3-michael.roth@amd.com

x86/sev: Add missing __init annotations to SEV init routines

2022-04-27T11:31:36+00:00

Currently, get_secrets_page() is only reachable from the following call
chain:

  __init snp_init_platform_device():
    get_secrets_page()

so mark it as __init as well. This is also needed since it calls
early_memremap(), which is also an __init routine.

Similarly, get_jump_table_addr() is only reachable from the following
call chain:

  __init setup_real_mode():
    sme_sev_setup_real_mode():
      sev_es_setup_ap_jump_table():
        get_jump_table_addr()

so mark get_jump_table_addr() and everything up that call chain as
__init as well. This is also needed since future patches will add a
call to get_secrets_page(), which needs to be __init due to the reasons
stated above.

Suggested-by: Borislav Petkov 
Signed-off-by: Michael Roth 
Signed-off-by: Borislav Petkov 
Link: https://lore.kernel.org/r/20220422135624.114172-2-michael.roth@amd.com

virt: sevguest: Change driver name to reflect generic SEV support

2022-04-21T09:48:24+00:00

During patch review, it was decided the SNP guest driver name should not
be SEV-SNP specific, but should be generic for use with anything SEV.
However, this feedback was missed and the driver name, and many of the
driver functions and structures, are SEV-SNP name specific. Rename the
driver to "sev-guest" (to match the misc device that is created) and
update some of the function and structure names, too.

While in the file, adjust the one pr_err() message to be a dev_err()
message so that the message, if issued, uses the driver name.

Signed-off-by: Tom Lendacky 
Signed-off-by: Borislav Petkov 
Link: https://lore.kernel.org/r/307710bb5515c9088a19fd0b930268c7300479b2.1650464054.git.thomas.lendacky@amd.com

x86/sev-es: Replace open-coded hlt-loop with sev_es_terminate()

2022-04-08T08:57:35+00:00

Replace the halt loop in handle_vc_boot_ghcb() with an
sev_es_terminate(). The HLT gives the system no indication the guest is
unhappy. The termination request will signal there was an error during
VC handling during boot.

  [ bp: Update it to pass the reason set too. ]

Signed-off-by: Peter Gonda 
Signed-off-by: Borislav Petkov 
Reviewed-by: Joerg Roedel 
Link: https://lore.kernel.org/r/20220317211913.1397427-1-pgonda@google.com

x86/sev: Register SEV-SNP guest request platform device

2022-04-07T14:47:12+00:00

Version 2 of the GHCB specification provides a Non Automatic Exit (NAE)
event type that can be used by the SEV-SNP guest to communicate with the
PSP without risk from a malicious hypervisor who wishes to read, alter,
drop or replay the messages sent.

SNP_LAUNCH_UPDATE can insert two special pages into the guest’s memory:
the secrets page and the CPUID page. The PSP firmware populates the
contents of the secrets page. The secrets page contains encryption keys
used by the guest to interact with the firmware. Because the secrets
page is encrypted with the guest’s memory encryption key, the hypervisor
cannot read the keys. See SEV-SNP firmware spec for further details on
the secrets page format.

Create a platform device that the SEV-SNP guest driver can bind to get
the platform resources such as encryption key and message id to use to
communicate with the PSP. The SEV-SNP guest driver provides a userspace
interface to get the attestation report, key derivation, extended
attestation report etc.

Signed-off-by: Brijesh Singh 
Signed-off-by: Borislav Petkov 
Link: https://lore.kernel.org/r/20220307213356.2797205-43-brijesh.singh@amd.com