x86/Hyper-V: Add Hyper-V specific hvcall to set backing page

Secure AVIC provides backing page to aid the
guest in limiting which interrupt vectors can
be injected into the guest. Hyper-V has specific
hvcall to set backing page and call it in
Secure AVIC driver.

Signed-off-by: Tianyu Lan <tiala@microsoft.com>

Author: tiala

arch/x86/hyperv/hv_init.c

@@ -76,6 +76,7 @@ static inline void hv_set_hypercall_pg(void *ptr)
 EXPORT_SYMBOL_GPL(hv_hypercall_pg);
 #endif
 
+void *hv_vp_early_input_arg;
 union hv_ghcb * __percpu *hv_ghcb_pg;
 
 /* Storage to save the hypercall page temporarily for hibernation */
@@ -382,13 +383,32 @@ void __init hyperv_init(void)
 	u64 guest_id;
 	union hv_x64_msr_hypercall_contents hypercall_msr;
 	int cpuhp;
+	int ret;
 
 	if (x86_hyper_type != X86_HYPER_MS_HYPERV)
 		return;
 
 	if (hv_common_init())
 		return;
 
+	if (cc_platform_has(CC_ATTR_SNP_SECURE_AVIC)) {
+		hv_vp_early_input_arg = (void *)__get_free_pages(
+					     GFP_KERNEL | __GFP_ZERO,
+					     get_order(num_possible_cpus() * PAGE_SIZE));
+		if (hv_vp_early_input_arg) {
+			ret = set_memory_decrypted((u64)hv_vp_early_input_arg,
+					     num_possible_cpus());
+			if (ret) {
+				free_pages((unsigned long)hv_vp_early_input_arg,
+					   get_order(num_possible_cpus() * PAGE_SIZE));
+				hv_vp_early_input_arg = NULL;
+				goto common_free;
+			}
+		} else {
+			goto common_free;
+		}
+	}
+
 	if (ms_hyperv.paravisor_present && hv_isolation_type_snp()) {
 		/* Negotiate GHCB Version. */
 		if (!hv_ghcb_negotiate_protocol())
@@ -526,6 +546,16 @@ void __init hyperv_init(void)
 free_vp_assist_page:
 	kfree(hv_vp_assist_page);
 	hv_vp_assist_page = NULL;
+free_vp_early_input_arg:
+	if (hv_vp_early_input_arg) {
+		set_memory_encrypted((u64)hv_vp_early_input_arg,
+				     num_possible_cpus());
+		free_pages((unsigned long)hv_vp_early_input_arg,
+			   get_order(num_possible_cpus() * PAGE_SIZE));
+		hv_vp_early_input_arg = NULL;
+	}
+common_free:
+	hv_common_free();
 }
 
 /*

arch/x86/hyperv/ivm.c

@@ -291,6 +291,45 @@ static void snp_cleanup_vmsa(struct sev_es_save_area *vmsa)
 		free_page((unsigned long)vmsa);
 }
 
+enum es_result hv_set_savic_backing_page(u64 gfn)
+{
+	u64 control = HV_HYPERCALL_REP_COMP_1 | HVCALL_SET_VP_REGISTERS;
+	struct hv_set_vp_registers_input *input =
+		(struct hv_set_vp_registers_input *)
+		((u8 *)hv_vp_early_input_arg + smp_processor_id() * PAGE_SIZE);
+	union hv_x64_register_sev_gpa_page value;
+	unsigned long flags;
+	int retry = 5;
+	u64 ret;
+
+	local_irq_save(flags);
+
+	value.enabled = 1;
+	value.reserved = 0;
+	value.pagenumber = gfn;
+
+	memset(input, 0, struct_size(input, element, 1));
+	input->header.partitionid = HV_PARTITION_ID_SELF;
+	input->header.vpindex = HV_VP_INDEX_SELF;
+	input->header.inputvtl = ms_hyperv.vtl;
+	input->element[0].name = HV_X64_REGISTER_SEV_AVIC_GPA;
+	input->element[0].value.reg64 = value.u64;
+
+	do {
+		ret = hv_do_hypercall(control, input, NULL);
+	} while (ret == HV_STATUS_TIME_OUT && retry--);
+
+	if (!hv_result_success(ret))
+		pr_err("Failed to set secure AVIC backing page %llx.\n", ret);
+
+	local_irq_restore(flags);
+
+	if (hv_result_success(ret))
+		return ES_OK;
+	else
+		return ES_VMM_ERROR;
+}
+
 int hv_snp_boot_ap(u32 apic_id, unsigned long start_ip, unsigned int cpu)
 {
 	struct sev_es_save_area *vmsa = (struct sev_es_save_area *)

arch/x86/include/asm/mshyperv.h

@@ -44,6 +44,7 @@ extern u64 hv_std_hypercall(u64 control, u64 param1, u64 param2);
 
 #if IS_ENABLED(CONFIG_HYPERV)
 extern void *hv_hypercall_pg;
+extern void *hv_vp_early_input_arg;
 
 extern union hv_ghcb * __percpu *hv_ghcb_pg;
 
@@ -197,6 +198,7 @@ int hv_unmap_ioapic_interrupt(int ioapic_id, struct hv_interrupt_entry *entry);
 bool hv_ghcb_negotiate_protocol(void);
 void __noreturn hv_ghcb_terminate(unsigned int set, unsigned int reason);
 int hv_snp_boot_ap(u32 apic_id, unsigned long start_ip, unsigned int cpu);
+enum es_result hv_set_savic_backing_page(u64 gfn);
 #else
 static inline bool hv_ghcb_negotiate_protocol(void) { return false; }
 static inline void hv_ghcb_terminate(unsigned int set, unsigned int reason) {}
@@ -300,6 +302,20 @@ static inline void hv_vtl_idle(void)
 		native_safe_halt();
 }
 
+/*
+ * Registers are only accessible via HVCALL_GET_VP_REGISTERS hvcall and
+ * there is not associated MSR address.
+ */
+#ifndef HV_X64_REGISTER_VSM_VP_STATUS
+#define		HV_X64_REGISTER_VSM_VP_STATUS   0x000D0003
+#endif
+#ifndef HV_X64_VTL_MASK
+#define		HV_X64_VTL_MASK                 GENMASK(3, 0)
+#endif
+#ifndef HV_X64_REGISTER_SEV_AVIC_GPA
+#define		HV_X64_REGISTER_SEV_AVIC_GPA    0x00090043
+#endif
+
 #ifdef CONFIG_HYPERV_VTL_MODE
 void __init hv_vtl_init_platform(void);
 int __init hv_vtl_early_init(void);

arch/x86/kernel/apic/x2apic_savic.c

@@ -14,6 +14,7 @@
 
 #include <asm/apic.h>
 #include <asm/sev.h>
+#include <asm/mshyperv.h>
 
 #include "local.h"
 
@@ -342,6 +343,10 @@ static void savic_setup(void)
 	void *ap = this_cpu_ptr(savic_page);
 	enum es_result res;
 	unsigned long gpa;
+	unsigned long gfn;
+
+	if (!cc_platform_has(CC_ATTR_SNP_SECURE_AVIC))
+		return;
 
 	/*
 	 * Before Secure AVIC is enabled, APIC MSR reads are intercepted.
@@ -351,6 +356,8 @@ static void savic_setup(void)
 
 	gpa = __pa(ap);
 
+	gfn = gpa >> PAGE_SHIFT;
+
 	/*
 	 * The NPT entry for a vCPU's APIC backing page must always be
 	 * present when the vCPU is running in order for Secure AVIC to
@@ -361,7 +368,11 @@ static void savic_setup(void)
 	 * VMRUN, the hypervisor makes use of this information to make sure
 	 * the APIC backing page is mapped in NPT.
 	 */
-	res = savic_register_gpa(gpa);
+	if (hv_isolation_type_snp())
+		res = hv_set_savic_backing_page(gfn);
+	else
+		res = savic_register_gpa(gpa);
+
 	if (res != ES_OK)
 		sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_SAVIC_FAIL);
 

include/hyperv/hvgdk_mini.h

@@ -1141,11 +1141,15 @@ enum hv_register_name {
 
 	/* AMD SEV SNP configuration register */
 	HV_X64_REGISTER_SEV_CONTROL             = 0x00090040,
+	HV_X64_REGISTER_SEV_AVIC_GPA            = 0x00090043,
 #endif
-	HV_REGISTER_REG_PAGE	= 0x0009001C,
+	HV_REGISTER_REG_PAGE			= 0x0009001C,
 
 };
 
+#define		HV_X64_REGISTER_VSM_VP_STATUS   0x000D0003
+#define		HV_X64_VTL_MASK                 GENMASK(3, 0)
+
 /*
  * Arch compatibility regs for use with hv_set/get_register
  */
@@ -1371,6 +1375,36 @@ struct hv_input_get_vp_registers {
 	u32 names[];
 } __packed;
 
+union hv_x64_register_sev_gpa_page {
+       u64 u64;
+       struct {
+               u64 enabled:1;
+               u64 reserved:11;
+               u64 pagenumber:52;
+       };
+} __packed;
+
+struct hv_set_vp_registers_input {
+        struct {
+                u64 partitionid;
+                u32 vpindex;
+                u8  inputvtl;
+                u8  padding[3];
+        } header;
+        struct {
+                u32 name;
+                u32 padding1;
+                u64 padding2;
+                union {
+                        union hv_register_value value;
+                        struct {
+                                u64 valuelow;
+                                u64 valuehigh;
+                        };
+                };
+        } element[];
+} __packed;
+
 struct hv_input_set_vp_registers {
 	u64 partition_id;
 	u32 vp_index;