On 12/16/21 5:39 PM, Mikolaj Lisik wrote:

On Thu, Dec 16, 2021 at 12:24 PM Venu Busireddy
[off-list ref] wrote:

quoted

On 2021-12-10 09:43:00 -0600, Brijesh Singh wrote:

quoted

Virtual Machine Privilege Level (VMPL) feature in the SEV-SNP architecture
allows a guest VM to divide its address space into four levels. The level
can be used to provide the hardware isolated abstraction layers with a VM.
The VMPL0 is the highest privilege, and VMPL3 is the least privilege.
Certain operations must be done by the VMPL0 software, such as:

* Validate or invalidate memory range (PVALIDATE instruction)
* Allocate VMSA page (RMPADJUST instruction when VMSA=1)

The initial SEV-SNP support requires that the guest kernel is running on
VMPL0. Add a check to make sure that kernel is running at VMPL0 before
continuing the boot. There is no easy method to query the current VMPL
level, so use the RMPADJUST instruction to determine whether the guest is
running at the VMPL0.

Signed-off-by: Brijesh Singh <redacted>
---
 arch/x86/boot/compressed/sev.c    | 34 ++++++++++++++++++++++++++++---
 arch/x86/include/asm/sev-common.h |  1 +
 arch/x86/include/asm/sev.h        | 16 +++++++++++++++
 3 files changed, 48 insertions(+), 3 deletions(-)

diff --git a/arch/x86/boot/compressed/sev.c b/arch/x86/boot/compressed/sev.c
index a0708f359a46..9be369f72299 100644
--- a/arch/x86/boot/compressed/sev.c
+++ b/arch/x86/boot/compressed/sev.c

@@ -212,6 +212,31 @@ static inline u64 rd_sev_status_msr(void)
      return ((high << 32) | low);
 }

+static void enforce_vmpl0(void)
+{
+     u64 attrs;
+     int err;
+
+     /*
+      * There is no straightforward way to query the current VMPL level. The
+      * simplest method is to use the RMPADJUST instruction to change a page
+      * permission to a VMPL level-1, and if the guest kernel is launched at
+      * a level <= 1, then RMPADJUST instruction will return an error.

Perhaps a nit. When you say "level <= 1", do you mean a level lower than or
equal to 1 semantically, or numerically?

Its numerically, please see the AMD APM vol 3.

Here is the snippet from the APM RMPAJUST.

IF (TARGET_VMPL <= CURRENT_VMPL)  // Only permissions for numerically

        EAX = FAIL_PERMISSION                // higher VMPL can be modified

        EXIT

+1 to this. Additionally I found the "level-1" confusing which I
interpreted as "level minus one".

Perhaps phrasing it as "level one", or "level=1" would be more explicit?

Sure, I will make it clear that its target vmpl level 1 and not (target
level - 1).

thanks