lkml.org 
[lkml]   [2021]   [Jun]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH Part2 RFC v3 12/37] crypto: ccp: Add support to initialize the AMD-SP for SEV-SNP
    Date
    Before SNP VMs can be launched, the platform must be appropriately
    configured and initialized. Platform initialization is accomplished via
    the SNP_INIT command.

    Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
    ---
    drivers/crypto/ccp/sev-dev.c | 111 +++++++++++++++++++++++++++++++++--
    drivers/crypto/ccp/sev-dev.h | 2 +
    include/linux/psp-sev.h | 16 +++++
    3 files changed, 124 insertions(+), 5 deletions(-)

    diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
    index 0331d4cea7da..2203167dbc2e 100644
    --- a/drivers/crypto/ccp/sev-dev.c
    +++ b/drivers/crypto/ccp/sev-dev.c
    @@ -591,6 +591,92 @@ static int sev_update_firmware(struct device *dev)
    return ret;
    }

    +static void snp_set_hsave_pa(void *arg)
    +{
    + wrmsrl(MSR_VM_HSAVE_PA, 0);
    +}
    +
    +static int __sev_snp_init_locked(int *error)
    +{
    + struct psp_device *psp = psp_master;
    + struct sev_device *sev;
    + int rc = 0;
    +
    + if (!psp || !psp->sev_data)
    + return -ENODEV;
    +
    + sev = psp->sev_data;
    +
    + if (sev->snp_inited)
    + return 0;
    +
    + /* SNP_INIT requires the MSR_VM_HSAVE_PA must be set to 0h across all cores. */
    + on_each_cpu(snp_set_hsave_pa, NULL, 1);
    +
    + /* Prepare for first SEV guest launch after INIT */
    + wbinvd_on_all_cpus();
    +
    + /* Issue the SNP_INIT firmware command. */
    + rc = __sev_do_cmd_locked(SEV_CMD_SNP_INIT, NULL, error);
    + if (rc)
    + return rc;
    +
    + sev->snp_inited = true;
    + dev_dbg(sev->dev, "SEV-SNP firmware initialized\n");
    +
    + return rc;
    +}
    +
    +int sev_snp_init(int *error)
    +{
    + int rc;
    +
    + if (!cpu_feature_enabled(X86_FEATURE_SEV_SNP))
    + return -ENODEV;
    +
    + mutex_lock(&sev_cmd_mutex);
    + rc = __sev_snp_init_locked(error);
    + mutex_unlock(&sev_cmd_mutex);
    +
    + return rc;
    +}
    +EXPORT_SYMBOL_GPL(sev_snp_init);
    +
    +static int __sev_snp_shutdown_locked(int *error)
    +{
    + struct sev_device *sev = psp_master->sev_data;
    + int ret;
    +
    + if (!sev->snp_inited)
    + return 0;
    +
    + /* SHUTDOWN requires the DF_FLUSH */
    + wbinvd_on_all_cpus();
    + __sev_do_cmd_locked(SEV_CMD_SNP_DF_FLUSH, NULL, NULL);
    +
    + ret = __sev_do_cmd_locked(SEV_CMD_SNP_SHUTDOWN, NULL, error);
    + if (ret) {
    + dev_err(sev->dev, "SEV-SNP firmware shutdown failed\n");
    + return ret;
    + }
    +
    + sev->snp_inited = false;
    + dev_dbg(sev->dev, "SEV-SNP firmware shutdown\n");
    +
    + return ret;
    +}
    +
    +static int sev_snp_shutdown(int *error)
    +{
    + int rc;
    +
    + mutex_lock(&sev_cmd_mutex);
    + rc = __sev_snp_shutdown_locked(NULL);
    + mutex_unlock(&sev_cmd_mutex);
    +
    + return rc;
    +}
    +
    static int sev_ioctl_do_pek_import(struct sev_issue_cmd *argp, bool writable)
    {
    struct sev_device *sev = psp_master->sev_data;
    @@ -1095,6 +1181,21 @@ void sev_pci_init(void)
    "SEV: TMR allocation failed, SEV-ES support unavailable\n");
    }

    + /*
    + * If boot CPU supports the SNP, then let first attempt to initialize
    + * the SNP firmware.
    + */
    + if (cpu_feature_enabled(X86_FEATURE_SEV_SNP)) {
    + rc = sev_snp_init(&error);
    + if (rc) {
    + /*
    + * If we failed to INIT SNP then don't abort the probe.
    + * Continue to initialize the legacy SEV firmware.
    + */
    + dev_err(sev->dev, "SEV-SNP: failed to INIT error %#x\n", error);
    + }
    + }
    +
    /* Initialize the platform */
    rc = sev_platform_init(&error);
    if (rc && (error == SEV_RET_SECURE_DATA_INVALID)) {
    @@ -1109,13 +1210,11 @@ void sev_pci_init(void)
    rc = sev_platform_init(&error);
    }

    - if (rc) {
    + if (rc)
    dev_err(sev->dev, "SEV: failed to INIT error %#x\n", error);
    - return;
    - }

    - dev_info(sev->dev, "SEV API:%d.%d build:%d\n", sev->api_major,
    - sev->api_minor, sev->build);
    + dev_info(sev->dev, "SEV%s API:%d.%d build:%d\n", sev->snp_inited ?
    + "-SNP" : "", sev->api_major, sev->api_minor, sev->build);

    return;

    @@ -1138,4 +1237,6 @@ void sev_pci_exit(void)
    get_order(SEV_ES_TMR_SIZE));
    sev_es_tmr = NULL;
    }
    +
    + sev_snp_shutdown(NULL);
    }
    diff --git a/drivers/crypto/ccp/sev-dev.h b/drivers/crypto/ccp/sev-dev.h
    index 666c21eb81ab..186ad20cbd24 100644
    --- a/drivers/crypto/ccp/sev-dev.h
    +++ b/drivers/crypto/ccp/sev-dev.h
    @@ -52,6 +52,8 @@ struct sev_device {
    u8 build;

    void *cmd_buf;
    +
    + bool snp_inited;
    };

    int sev_dev_init(struct psp_device *psp);
    diff --git a/include/linux/psp-sev.h b/include/linux/psp-sev.h
    index c3755099ab55..1b53e8782250 100644
    --- a/include/linux/psp-sev.h
    +++ b/include/linux/psp-sev.h
    @@ -748,6 +748,20 @@ struct sev_data_snp_init_ex {
    */
    int sev_platform_init(int *error);

    +/**
    + * sev_snp_init - perform SEV SNP_INIT command
    + *
    + * @error: SEV command return code
    + *
    + * Returns:
    + * 0 if the SEV successfully processed the command
    + * -%ENODEV if the SEV device is not available
    + * -%ENOTSUPP if the SEV does not support SEV
    + * -%ETIMEDOUT if the SEV command timed out
    + * -%EIO if the SEV returned a non-zero return code
    + */
    +int sev_snp_init(int *error);
    +
    /**
    * sev_platform_status - perform SEV PLATFORM_STATUS command
    *
    @@ -855,6 +869,8 @@ sev_platform_status(struct sev_user_data_status *status, int *error) { return -E

    static inline int sev_platform_init(int *error) { return -ENODEV; }

    +static inline int sev_snp_init(int *error) { return -ENODEV; }
    +
    static inline int
    sev_guest_deactivate(struct sev_data_deactivate *data, int *error) { return -ENODEV; }

    --
    2.17.1
    \
     
     \ /
      Last update: 2021-06-02 16:16    [W:4.109 / U:0.036 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site