[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20250806204659.59099-3-john.allen@amd.com>
Date: Wed, 6 Aug 2025 20:46:59 +0000
From: John Allen <john.allen@....com>
To: <kvm@...r.kernel.org>, <linux-kernel@...r.kernel.org>, <x86@...nel.org>,
<seanjc@...gle.com>, <pbonzini@...hat.com>, <dave.hansen@...el.com>
CC: <rick.p.edgecombe@...el.com>, <mlevitsk@...hat.com>,
<weijiang.yang@...el.com>, <chao.gao@...el.com>, <bp@...en8.de>,
<dave.hansen@...ux.intel.com>, <hpa@...or.com>, <mingo@...hat.com>,
<tglx@...utronix.de>, <thomas.lendacky@....com>, John Allen
<john.allen@....com>
Subject: [PATCH 2/2] x86/sev-es: Include XSS value in GHCB CPUID request
When a guest issues a cpuid instruction for Fn0000000D_x0B
(CetUserOffset), the hypervisor may intercept and access the guest XSS
value. For SEV-ES, this is encrypted and needs to be included in the
GHCB to be visible to the hypervisor.
Signed-off-by: John Allen <john.allen@....com>
---
arch/x86/coco/sev/vc-shared.c | 11 +++++++++++
arch/x86/include/asm/svm.h | 1 +
2 files changed, 12 insertions(+)
diff --git a/arch/x86/coco/sev/vc-shared.c b/arch/x86/coco/sev/vc-shared.c
index 2c0ab0fdc060..079fffdb12c0 100644
--- a/arch/x86/coco/sev/vc-shared.c
+++ b/arch/x86/coco/sev/vc-shared.c
@@ -1,5 +1,9 @@
// SPDX-License-Identifier: GPL-2.0
+#ifndef __BOOT_COMPRESSED
+#define has_cpuflag(f) boot_cpu_has(f)
+#endif
+
static enum es_result vc_check_opcode_bytes(struct es_em_ctxt *ctxt,
unsigned long exit_code)
{
@@ -452,6 +456,13 @@ static enum es_result vc_handle_cpuid(struct ghcb *ghcb,
/* xgetbv will cause #GP - use reset value for xcr0 */
ghcb_set_xcr0(ghcb, 1);
+ if (has_cpuflag(X86_FEATURE_SHSTK) && regs->ax == 0xd && regs->cx <= 1) {
+ struct msr m;
+
+ raw_rdmsr(MSR_IA32_XSS, &m);
+ ghcb_set_xss(ghcb, m.q);
+ }
+
ret = sev_es_ghcb_hv_call(ghcb, ctxt, SVM_EXIT_CPUID, 0, 0);
if (ret != ES_OK)
return ret;
diff --git a/arch/x86/include/asm/svm.h b/arch/x86/include/asm/svm.h
index ffc27f676243..870ebfef86d6 100644
--- a/arch/x86/include/asm/svm.h
+++ b/arch/x86/include/asm/svm.h
@@ -700,5 +700,6 @@ DEFINE_GHCB_ACCESSORS(sw_exit_info_1)
DEFINE_GHCB_ACCESSORS(sw_exit_info_2)
DEFINE_GHCB_ACCESSORS(sw_scratch)
DEFINE_GHCB_ACCESSORS(xcr0)
+DEFINE_GHCB_ACCESSORS(xss)
#endif
--
2.34.1
Powered by blists - more mailing lists