• Nikunj A Dadhania's avatar
    x86/sev: Add SEV-SNP guest feature negotiation support · 8c29f016
    Nikunj A Dadhania authored
    The hypervisor can enable various new features (SEV_FEATURES[1:63]) and start a
    SNP guest. Some of these features need guest side implementation. If any of
    these features are enabled without it, the behavior of the SNP guest will be
    undefined.  It may fail booting in a non-obvious way making it difficult to
    debug.
    
    Instead of allowing the guest to continue and have it fail randomly later,
    detect this early and fail gracefully.
    
    The SEV_STATUS MSR indicates features which the hypervisor has enabled.  While
    booting, SNP guests should ascertain that all the enabled features have guest
    side implementation. In case a feature is not implemented in the guest, the
    guest terminates booting with GHCB protocol Non-Automatic Exit(NAE) termination
    request event, see "SEV-ES Guest-Hypervisor Communication Block Standardization"
    document (currently at https://developer.amd.com/wp-content/resources/56421.pdf),
    section "Termination Request".
    
    Populate SW_EXITINFO2 with mask of unsupported features that the hypervisor can
    easily report to the user.
    
    More details in the AMD64 APM Vol 2, Section "SEV_STATUS MSR".
    
      [ bp:
        - Massage.
        - Move snp_check_features() call to C code.
        Note: the CC:stable@ aspect here is to be able to protect older, stable
        kernels when running on newer hypervisors. Or not "running" but fail
        reliably and in a well-defined manner instead of randomly. ]
    
    Fixes: cbd3d4f7 ("x86/sev: Check SEV-SNP features support")
    Signed-off-by: default avatarNikunj A Dadhania <nikunj@amd.com>
    Signed-off-by: default avatarBorislav Petkov (AMD) <bp@alien8.de>
    Reviewed-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
    Cc: <stable@kernel.org>
    Link: https://lore.kernel.org/r/20230118061943.534309-1-nikunj@amd.com
    8c29f016
svm.h 9.56 KB