mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-12-05 01:54:09 +08:00
cbd3d4f7c4
Version 2 of the GHCB specification added the advertisement of features that are supported by the hypervisor. If the hypervisor supports SEV-SNP then it must set the SEV-SNP features bit to indicate that the base functionality is supported. Check that feature bit while establishing the GHCB; if failed, terminate the guest. Version 2 of the GHCB specification adds several new Non-Automatic Exits (NAEs), most of them are optional except the hypervisor feature. Now that the hypervisor feature NAE is implemented, bump the GHCB maximum supported protocol version. While at it, move the GHCB protocol negotiation check from the #VC exception handler to sev_enable() so that all feature detection happens before the first #VC exception. While at it, document why the GHCB page cannot be setup from load_stage2_idt(). [ bp: Massage commit message. ] Signed-off-by: Brijesh Singh <brijesh.singh@amd.com> Signed-off-by: Borislav Petkov <bp@suse.de> Link: https://lore.kernel.org/r/20220307213356.2797205-13-brijesh.singh@amd.com
85 lines
2.3 KiB
C
85 lines
2.3 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
#include <asm/trap_pf.h>
|
|
#include <asm/segment.h>
|
|
#include <asm/trapnr.h>
|
|
#include "misc.h"
|
|
|
|
static void set_idt_entry(int vector, void (*handler)(void))
|
|
{
|
|
unsigned long address = (unsigned long)handler;
|
|
gate_desc entry;
|
|
|
|
memset(&entry, 0, sizeof(entry));
|
|
|
|
entry.offset_low = (u16)(address & 0xffff);
|
|
entry.segment = __KERNEL_CS;
|
|
entry.bits.type = GATE_TRAP;
|
|
entry.bits.p = 1;
|
|
entry.offset_middle = (u16)((address >> 16) & 0xffff);
|
|
entry.offset_high = (u32)(address >> 32);
|
|
|
|
memcpy(&boot_idt[vector], &entry, sizeof(entry));
|
|
}
|
|
|
|
/* Have this here so we don't need to include <asm/desc.h> */
|
|
static void load_boot_idt(const struct desc_ptr *dtr)
|
|
{
|
|
asm volatile("lidt %0"::"m" (*dtr));
|
|
}
|
|
|
|
/* Setup IDT before kernel jumping to .Lrelocated */
|
|
void load_stage1_idt(void)
|
|
{
|
|
boot_idt_desc.address = (unsigned long)boot_idt;
|
|
|
|
|
|
if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT))
|
|
set_idt_entry(X86_TRAP_VC, boot_stage1_vc);
|
|
|
|
load_boot_idt(&boot_idt_desc);
|
|
}
|
|
|
|
/*
|
|
* Setup IDT after kernel jumping to .Lrelocated.
|
|
*
|
|
* initialize_identity_maps() needs a #PF handler to be setup
|
|
* in order to be able to fault-in identity mapping ranges; see
|
|
* do_boot_page_fault().
|
|
*
|
|
* This #PF handler setup needs to happen in load_stage2_idt() where the
|
|
* IDT is loaded and there the #VC IDT entry gets setup too.
|
|
*
|
|
* In order to be able to handle #VCs, one needs a GHCB which
|
|
* gets setup with an already set up pagetable, which is done in
|
|
* initialize_identity_maps(). And there's the catch 22: the boot #VC
|
|
* handler do_boot_stage2_vc() needs to call early_setup_ghcb() itself
|
|
* (and, especially set_page_decrypted()) because the SEV-ES setup code
|
|
* cannot initialize a GHCB as there's no #PF handler yet...
|
|
*/
|
|
void load_stage2_idt(void)
|
|
{
|
|
boot_idt_desc.address = (unsigned long)boot_idt;
|
|
|
|
set_idt_entry(X86_TRAP_PF, boot_page_fault);
|
|
|
|
#ifdef CONFIG_AMD_MEM_ENCRYPT
|
|
set_idt_entry(X86_TRAP_VC, boot_stage2_vc);
|
|
#endif
|
|
|
|
load_boot_idt(&boot_idt_desc);
|
|
}
|
|
|
|
void cleanup_exception_handling(void)
|
|
{
|
|
/*
|
|
* Flush GHCB from cache and map it encrypted again when running as
|
|
* SEV-ES guest.
|
|
*/
|
|
sev_es_shutdown_ghcb();
|
|
|
|
/* Set a null-idt, disabling #PF and #VC handling */
|
|
boot_idt_desc.size = 0;
|
|
boot_idt_desc.address = 0;
|
|
load_boot_idt(&boot_idt_desc);
|
|
}
|