| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <aca901e8-958c-46f0-9808-001a2afd8bae@amd.com>
Date: Wed, 20 Aug 2025 14:51:34 +0530
From: "Nikunj A. Dadhania" <nikunj@....com>
To: Sean Christopherson <seanjc@...gle.com>, Paolo Bonzini
<pbonzini@...hat.com>
CC: <kvm@...r.kernel.org>, <linux-kernel@...r.kernel.org>, Thomas Lendacky
<thomas.lendacky@....com>, Michael Roth <michael.roth@....com>, "Borislav
Petkov" <bp@...en8.de>, Vaishali Thakkar <vaishali.thakkar@...e.com>, "Kai
Huang" <kai.huang@...el.com>
Subject: Re: [PATCH v11 5/8] KVM: SEV: Move init of SNP guest state into
sev_init_vmcb()
On 8/20/2025 5:18 AM, Sean Christopherson wrote:
> Move the initialization of SNP guest state from svm_vcpu_reset() into
> sev_init_vmcb() to reduce the number of paths that deal with INIT/RESET
> for SEV+ vCPUs from 4+ to 1. Plumb in @init_event as necessary.
>
> Opportunistically check for an SNP guest outside of
> sev_snp_init_protected_guest_state() so that sev_init_vmcb() is consistent
> with respect to checking for SEV-ES+ and SNP+ guests.
>
> No functional change intended.
>
> Signed-off-by: Sean Christopherson <seanjc@...gle.com>
Reviewed-by: Nikunj A Dadhania <nikunj@....com>
> ---
> arch/x86/kvm/svm/sev.c | 16 +++++++++-------
> arch/x86/kvm/svm/svm.c | 9 +++------
> arch/x86/kvm/svm/svm.h | 4 +---
> 3 files changed, 13 insertions(+), 16 deletions(-)
>
> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> index c17cc4eb0fe1..c5726b091680 100644
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
> @@ -1975,7 +1975,7 @@ static void sev_migrate_from(struct kvm *dst_kvm, struct kvm *src_kvm)
> kvm_for_each_vcpu(i, dst_vcpu, dst_kvm) {
> dst_svm = to_svm(dst_vcpu);
>
> - sev_init_vmcb(dst_svm);
> + sev_init_vmcb(dst_svm, false);
>
> if (!dst->es_active)
> continue;
> @@ -3887,7 +3887,7 @@ static int snp_begin_psc(struct vcpu_svm *svm, struct psc_buffer *psc)
> /*
> * Invoked as part of svm_vcpu_reset() processing of an init event.
> */
> -void sev_snp_init_protected_guest_state(struct kvm_vcpu *vcpu)
> +static void sev_snp_init_protected_guest_state(struct kvm_vcpu *vcpu)
> {
> struct vcpu_svm *svm = to_svm(vcpu);
> struct kvm_memory_slot *slot;
> @@ -3895,9 +3895,6 @@ void sev_snp_init_protected_guest_state(struct kvm_vcpu *vcpu)
> kvm_pfn_t pfn;
> gfn_t gfn;
>
> - if (!sev_snp_guest(vcpu->kvm))
> - return;
> -
> guard(mutex)(&svm->sev_es.snp_vmsa_mutex);
>
> if (!svm->sev_es.snp_ap_waiting_for_reset)
> @@ -4546,8 +4543,10 @@ static void sev_es_init_vmcb(struct vcpu_svm *svm)
> svm_clr_intercept(svm, INTERCEPT_XSETBV);
> }
>
> -void sev_init_vmcb(struct vcpu_svm *svm)
> +void sev_init_vmcb(struct vcpu_svm *svm, bool init_event)
> {
> + struct kvm_vcpu *vcpu = &svm->vcpu;
> +
> svm->vmcb->control.nested_ctl |= SVM_NESTED_CTL_SEV_ENABLE;
> clr_exception_intercept(svm, UD_VECTOR);
>
> @@ -4557,7 +4556,10 @@ void sev_init_vmcb(struct vcpu_svm *svm)
> */
> clr_exception_intercept(svm, GP_VECTOR);
>
> - if (sev_es_guest(svm->vcpu.kvm))
> + if (init_event && sev_snp_guest(vcpu->kvm))
> + sev_snp_init_protected_guest_state(vcpu);
> +
> + if (sev_es_guest(vcpu->kvm))
> sev_es_init_vmcb(svm);
> }
>
> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> index 3d4c14e0244f..8ed135dbd649 100644
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
> @@ -1083,7 +1083,7 @@ static void svm_recalc_intercepts_after_set_cpuid(struct kvm_vcpu *vcpu)
> svm_recalc_msr_intercepts(vcpu);
> }
>
> -static void init_vmcb(struct kvm_vcpu *vcpu)
> +static void init_vmcb(struct kvm_vcpu *vcpu, bool init_event)
> {
> struct vcpu_svm *svm = to_svm(vcpu);
> struct vmcb *vmcb = svm->vmcb01.ptr;
> @@ -1221,7 +1221,7 @@ static void init_vmcb(struct kvm_vcpu *vcpu)
> svm_set_intercept(svm, INTERCEPT_BUSLOCK);
>
> if (sev_guest(vcpu->kvm))
> - sev_init_vmcb(svm);
> + sev_init_vmcb(svm, init_event);
>
> svm_hv_init_vmcb(vmcb);
>
> @@ -1256,10 +1256,7 @@ static void svm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
> svm->spec_ctrl = 0;
> svm->virt_spec_ctrl = 0;
>
> - if (init_event)
> - sev_snp_init_protected_guest_state(vcpu);
> -
> - init_vmcb(vcpu);
> + init_vmcb(vcpu, init_event);
>
> if (!init_event)
> __svm_vcpu_reset(vcpu);
> diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h
> index cf2569b5451a..321480ebe62f 100644
> --- a/arch/x86/kvm/svm/svm.h
> +++ b/arch/x86/kvm/svm/svm.h
> @@ -826,7 +826,7 @@ void avic_refresh_virtual_apic_mode(struct kvm_vcpu *vcpu);
> /* sev.c */
>
> int pre_sev_run(struct vcpu_svm *svm, int cpu);
> -void sev_init_vmcb(struct vcpu_svm *svm);
> +void sev_init_vmcb(struct vcpu_svm *svm, bool init_event);
> void sev_vcpu_after_set_cpuid(struct vcpu_svm *svm);
> int sev_es_string_io(struct vcpu_svm *svm, int size, unsigned int port, int in);
> void sev_es_vcpu_reset(struct vcpu_svm *svm);
> @@ -864,7 +864,6 @@ int sev_cpu_init(struct svm_cpu_data *sd);
> int sev_dev_get_attr(u32 group, u64 attr, u64 *val);
> extern unsigned int max_sev_asid;
> void sev_handle_rmp_fault(struct kvm_vcpu *vcpu, gpa_t gpa, u64 error_code);
> -void sev_snp_init_protected_guest_state(struct kvm_vcpu *vcpu);
> int sev_gmem_prepare(struct kvm *kvm, kvm_pfn_t pfn, gfn_t gfn, int max_order);
> void sev_gmem_invalidate(kvm_pfn_t start, kvm_pfn_t end);
> int sev_private_max_mapping_level(struct kvm *kvm, kvm_pfn_t pfn);
> @@ -891,7 +890,6 @@ static inline int sev_cpu_init(struct svm_cpu_data *sd) { return 0; }
> static inline int sev_dev_get_attr(u32 group, u64 attr, u64 *val) { return -ENXIO; }
> #define max_sev_asid 0
> static inline void sev_handle_rmp_fault(struct kvm_vcpu *vcpu, gpa_t gpa, u64 error_code) {}
> -static inline void sev_snp_init_protected_guest_state(struct kvm_vcpu *vcpu) {}
> static inline int sev_gmem_prepare(struct kvm *kvm, kvm_pfn_t pfn, gfn_t gfn, int max_order)
> {
> return 0;
Powered by blists - more mailing lists