With partition-level VTL1 enabled, the secure kernel image loaded, its initial vCPU context built, and VTL1 enabled on the boot CPU, the final step of the primary-CPU bring-up is to actually transition into VTL1 and start executing the secure kernel. Hyper-V restores the CPU state from the vp_context supplied during VTL1 enablement when the first vtlcall is issued.
Issue that first vtlcall on the primary CPU, passing the number of possible CPUs and the location of the secure kernel reserved region as the VTL1 boot handshake. Signed-off-by: Thara Gopinath <[email protected]> --- drivers/hv/hv_vsm_boot.c | 63 +++++++++++++++++++++++++++++++++++++++- 1 file changed, 62 insertions(+), 1 deletion(-) diff --git a/drivers/hv/hv_vsm_boot.c b/drivers/hv/hv_vsm_boot.c index abe82e03e1897..c4f15c42df1f6 100644 --- a/drivers/hv/hv_vsm_boot.c +++ b/drivers/hv/hv_vsm_boot.c @@ -35,6 +35,15 @@ static void *vsm_skm_va; +/* + * By default, when a processor boots in VTL1, we assume that MBEC (Mode-Based Execution Control) + * support is also enabled. MBEC distinguishes between user and kernel memory execution permissions. + * After the processor boots in VTL1, we verify whether MBEC is actually enabled. If it is not, + * we set a global flag to false. This flag is shared across all processors—if any processor fails + * to enable MBEC, the system treats MBEC as disabled. + */ +static bool hv_vsm_mbec_enabled = true; + static int hv_vsm_get_register(u32 reg_name, u64 *result) { struct hv_register_assoc reg = { @@ -300,6 +309,51 @@ static int __init hv_vsm_get_partition_status(u16 *enabled_vtl_set, u8 *max_vtl, return 0; } +static int __init hv_vsm_init_code_page_offsets(void) +{ + union hv_register_vsm_page_offsets offsets; + u64 result; + int ret; + + ret = hv_vsm_get_register(HV_REGISTER_VSM_CODE_PAGE_OFFSETS, &result); + if (ret) { + pr_err("Failed to read VSM code page offsets: %d\n", ret); + return ret; + } + + offsets.as_uint64 = result; + hv_vsm_init_vtlcall(offsets.vtl_call_offset); + return 0; +} + +static int __init hv_vsm_boot_vtl1(void) +{ + struct hv_vtlcall_param args = {0}; + u16 vp_enabled_vtl_set = 0; + u8 active_mbec_enabled = 0; + int ret; + s64 sk_status; + + args.a0 = num_possible_cpus(); + args.a1 = sk_res.start; + args.a2 = resource_size(&sk_res); + + /* Kick start vtl1 boot on the primary cpu. */ + sk_status = hv_vsm_vtlcall(&args); + if (sk_status) + pr_warn("VTL1 boot returned status %lld\n", sk_status); + + ret = hv_vsm_get_vp_status(&vp_enabled_vtl_set, &active_mbec_enabled); + if (ret) + return ret; + + if (!active_mbec_enabled) { + pr_err("Failed to enable MBEC for VP0\n"); + hv_vsm_mbec_enabled = false; + } + return 0; +} + static int __init hv_vsm_bootstrap_vtl(void) { u16 partition_enabled_vtl_set = 0, partition_mbec_enabled_vtl_set = 0; @@ -369,7 +423,14 @@ static int __init hv_vsm_bootstrap_vtl(void) return -EINVAL; } } - return 0; + + /* Point the vtlcall trampoline at the correct hypercall page offset */ + ret = hv_vsm_init_code_page_offsets(); + if (ret) + return ret; + + /* Boot primary virtual processor in VTL1 */ + return hv_vsm_boot_vtl1(); } static void __init hv_vsm_get_sk_mem(void) -- 2.34.1
