Add corresponding hyperv support for Enhanced SMT protection. A fully enlightened SEV-SNP guest on Hyper-V builds the VMSA itself when bringing up an AP, so populate both fields there, before the page is turned into a VMSA and while it is still writable. Similar to KVM, fully set the sibling mask so that all threads of the same guest trust each other. Signed-off-by: Pratik R. Sampat --- v2..v3: No changes v1..v2: New patch --- arch/x86/hyperv/ivm.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/arch/x86/hyperv/ivm.c b/arch/x86/hyperv/ivm.c index 2ce4dfe53472..40dd252f333a 100644 --- a/arch/x86/hyperv/ivm.c +++ b/arch/x86/hyperv/ivm.c @@ -347,6 +347,17 @@ int hv_snp_boot_ap(u32 apic_id, unsigned long start_ip, unsigned int cpu) vmsa->vmpl = 0; vmsa->sev_features = sev_status >> 2; + if (sev_status & MSR_AMD64_SNP_ESMT_PROT) { + vmsa->vcpu_id = apic_id; + /* + * The mask fully set puts every vCPU in one group, so any two + * of them may be co-resident. A legal ESMTP sibling must + * also match on ASID, so the sibling of a vCPU in guest mode is + * always either another vCPU of this same guest or idle. + */ + vmsa->vcpu_sibling_mask = U32_MAX; + } + ret = snp_set_vmsa(vmsa, true); if (ret) { pr_err("RMPADJUST(%llx) failed: %llx\n", (u64)vmsa, ret); -- 2.43.0