Enhanced SMT Protection requires every VMSA to carry the vCPU's identity and the mask of SMT siblings it may co-run with. The guest builds the VMSA itself when bringing up an AP, so populate both fields there, before the page is turned into a VMSA and while it is still writable. Fully set the sibling mask so that all threads of the same guest trust each other. Reviewed-by: Tom Lendacky Signed-off-by: Pratik R. Sampat --- v2..v3: * Collected Reviewed-by from Tom * Use sev_status to determine SNP support for guest as well - Tom v1..v2: * Add ESMTP to SNP_FEATURES_IMPL and SNP_FEATURES_IMPL_REQ --- arch/x86/boot/compressed/sev.c | 6 ++++-- arch/x86/coco/sev/core.c | 13 +++++++++++++ arch/x86/include/asm/msr-index.h | 4 +++- 3 files changed, 20 insertions(+), 3 deletions(-) diff --git a/arch/x86/boot/compressed/sev.c b/arch/x86/boot/compressed/sev.c index c6512f2ea31e..4e0fa5a5f70b 100644 --- a/arch/x86/boot/compressed/sev.c +++ b/arch/x86/boot/compressed/sev.c @@ -188,7 +188,8 @@ bool sev_es_check_ghcb_fault(unsigned long address) MSR_AMD64_SNP_RESERVED_BIT13 | \ MSR_AMD64_SNP_RESERVED_BIT15 | \ MSR_AMD64_SNP_SECURE_AVIC | \ - MSR_AMD64_SNP_RESERVED_BITS19_22 | \ + MSR_AMD64_SNP_ESMT_PROT | \ + MSR_AMD64_SNP_RESERVED_BITS20_22 | \ MSR_AMD64_SNP_RESERVED_MASK) #ifdef CONFIG_AMD_SECURE_AVIC @@ -204,7 +205,8 @@ bool sev_es_check_ghcb_fault(unsigned long address) */ #define SNP_FEATURES_IMPL (MSR_AMD64_SNP_DEBUG_SWAP | \ MSR_AMD64_SNP_SECURE_TSC | \ - SNP_FEATURE_SECURE_AVIC) + SNP_FEATURE_SECURE_AVIC | \ + MSR_AMD64_SNP_ESMT_PROT) u64 snp_get_unsupported_features(u64 status) { diff --git a/arch/x86/coco/sev/core.c b/arch/x86/coco/sev/core.c index cc292d7c6fd1..b89766bb9365 100644 --- a/arch/x86/coco/sev/core.c +++ b/arch/x86/coco/sev/core.c @@ -89,6 +89,7 @@ static const char * const sev_status_feat_names[] = { [MSR_AMD64_SNP_VMSA_REG_PROT_BIT] = "VMSARegProt", [MSR_AMD64_SNP_SMT_PROT_BIT] = "SMTProt", [MSR_AMD64_SNP_SECURE_AVIC_BIT] = "SecureAVIC", + [MSR_AMD64_SNP_ESMT_PROT_BIT] = "ESMTProt", [MSR_AMD64_SNP_IBPB_ON_ENTRY_BIT] = "IBPBOnEntry", }; @@ -849,6 +850,18 @@ static int wakeup_cpu_via_vmgexit(u32 apic_id, unsigned long start_ip, unsigned vmsa->vmpl = snp_vmpl; vmsa->sev_features = sev_status >> 2; + if (sev_status & MSR_AMD64_SEV_SNP_ENABLED && + (sev_status & MSR_AMD64_SNP_ESMT_PROT)) { + vmsa->vcpu_id = apic_id; + /* + * The mask fully set puts every vCPU in one group, so any two + * of them may be co-resident. A legal ESMTP sibling must + * also match on ASID, so the sibling of a vCPU in guest mode is + * always either another vCPU of this same guest or idle. + */ + vmsa->vcpu_sibling_mask = U32_MAX; + } + /* Populate AP's TSC scale/offset to get accurate TSC values. */ if (cc_platform_has(CC_ATTR_GUEST_SNP_SECURE_TSC)) { vmsa->tsc_scale = snp_tsc_scale; diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h index fbcb3313e946..6fd26151d146 100644 --- a/arch/x86/include/asm/msr-index.h +++ b/arch/x86/include/asm/msr-index.h @@ -745,7 +745,9 @@ #define MSR_AMD64_SNP_SMT_PROT BIT_ULL(MSR_AMD64_SNP_SMT_PROT_BIT) #define MSR_AMD64_SNP_SECURE_AVIC_BIT 18 #define MSR_AMD64_SNP_SECURE_AVIC BIT_ULL(MSR_AMD64_SNP_SECURE_AVIC_BIT) -#define MSR_AMD64_SNP_RESERVED_BITS19_22 GENMASK_ULL(22, 19) +#define MSR_AMD64_SNP_ESMT_PROT_BIT 19 +#define MSR_AMD64_SNP_ESMT_PROT BIT_ULL(MSR_AMD64_SNP_ESMT_PROT_BIT) +#define MSR_AMD64_SNP_RESERVED_BITS20_22 GENMASK_ULL(22, 20) #define MSR_AMD64_SNP_IBPB_ON_ENTRY_BIT 23 #define MSR_AMD64_SNP_IBPB_ON_ENTRY BIT_ULL(MSR_AMD64_SNP_IBPB_ON_ENTRY_BIT) #define MSR_AMD64_SNP_RESV_BIT 24 -- 2.43.0