Commit 6283f2ef authored by Tom Lendacky's avatar Tom Lendacky Committed by Borislav Petkov
Browse files

x86/sev: Replace occurrences of sev_es_active() with cc_platform_has() 



Replace uses of sev_es_active() with the more generic cc_platform_has()
using CC_ATTR_GUEST_STATE_ENCRYPT. If future support is added for other
memory encyrption techonologies, the use of CC_ATTR_GUEST_STATE_ENCRYPT
can be updated, as required.

Signed-off-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/20210928191009.32551-8-bp@alien8.de
parent 4d96f910

arch/x86/include/asm/mem_encrypt.h

+0 −2
Original line number Diff line number Diff line
@@ -51,7 +51,6 @@ void __init mem_encrypt_free_decrypted_mem(void); 
void __init mem_encrypt_init(void);



void __init sev_es_init_vc_handling(void);

bool sev_es_active(void);



#define __bss_decrypted __section(".bss..decrypted")
@@ -74,7 +73,6 @@ static inline void __init sme_encrypt_kernel(struct boot_params *bp) { } 
static inline void __init sme_enable(struct boot_params *bp) { }



static inline void sev_es_init_vc_handling(void) { }

static inline bool sev_es_active(void) { return false; }



static inline int __init

early_set_memory_decrypted(unsigned long vaddr, unsigned long size) { return 0; }

arch/x86/kernel/sev.c

+3 −3
Original line number Diff line number Diff line
@@ -11,7 +11,7 @@ 


#include <linux/sched/debug.h>	/* For show_regs() */

#include <linux/percpu-defs.h>

#include <linux/mem_encrypt.h>

#include <linux/cc_platform.h>

#include <linux/printk.h>

#include <linux/mm_types.h>

#include <linux/set_memory.h>
@@ -615,7 +615,7 @@ int __init sev_es_efi_map_ghcbs(pgd_t *pgd) 
	int cpu;

	u64 pfn;



	if (!sev_es_active())

	if (!cc_platform_has(CC_ATTR_GUEST_STATE_ENCRYPT))

		return 0;



	pflags = _PAGE_NX | _PAGE_RW;
@@ -774,7 +774,7 @@ void __init sev_es_init_vc_handling(void) 


	BUILD_BUG_ON(offsetof(struct sev_es_runtime_data, ghcb_page) % PAGE_SIZE);



	if (!sev_es_active())

	if (!cc_platform_has(CC_ATTR_GUEST_STATE_ENCRYPT))

		return;



	if (!sev_es_check_cpu_features())

arch/x86/mm/mem_encrypt.c

+3 −21
Original line number Diff line number Diff line
@@ -361,25 +361,6 @@ int __init early_set_memory_encrypted(unsigned long vaddr, unsigned long size) 
	return early_set_memory_enc_dec(vaddr, size, true);

}



/*

 * SME and SEV are very similar but they are not the same, so there are

 * times that the kernel will need to distinguish between SME and SEV. The

 * cc_platform_has() function is used for this.  When a distinction isn't

 * needed, the CC_ATTR_MEM_ENCRYPT attribute can be used.

 *

 * The trampoline code is a good example for this requirement.  Before

 * paging is activated, SME will access all memory as decrypted, but SEV

 * will access all memory as encrypted.  So, when APs are being brought

 * up under SME the trampoline area cannot be encrypted, whereas under SEV

 * the trampoline area must be encrypted.

 */



/* Needs to be called from non-instrumentable code */

bool noinstr sev_es_active(void)

{

	return sev_status & MSR_AMD64_SEV_ES_ENABLED;

}



/* Override for DMA direct allocation check - ARCH_HAS_FORCE_DMA_UNENCRYPTED */

bool force_dma_unencrypted(struct device *dev)

{
@@ -449,7 +430,7 @@ static void print_mem_encrypt_feature_info(void) 
		pr_cont(" SEV");



	/* Encrypted Register State */

	if (sev_es_active())

	if (cc_platform_has(CC_ATTR_GUEST_STATE_ENCRYPT))

		pr_cont(" SEV-ES");



	pr_cont("\n");
@@ -468,7 +449,8 @@ void __init mem_encrypt_init(void) 
	 * With SEV, we need to unroll the rep string I/O instructions,

	 * but SEV-ES supports them through the #VC handler.

	 */

	if (cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT) && !sev_es_active())

	if (cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT) &&

	    !cc_platform_has(CC_ATTR_GUEST_STATE_ENCRYPT))

		static_branch_enable(&sev_enable_key);



	print_mem_encrypt_feature_info();

arch/x86/realmode/init.c

+1 −2
Original line number Diff line number Diff line
@@ -2,7 +2,6 @@ 
#include <linux/io.h>

#include <linux/slab.h>

#include <linux/memblock.h>

#include <linux/mem_encrypt.h>

#include <linux/cc_platform.h>

#include <linux/pgtable.h>
@@ -48,7 +47,7 @@ static void sme_sev_setup_real_mode(struct trampoline_header *th) 
	if (cc_platform_has(CC_ATTR_HOST_MEM_ENCRYPT))

		th->flags |= TH_FLAGS_SME_ACTIVE;



	if (sev_es_active()) {

	if (cc_platform_has(CC_ATTR_GUEST_STATE_ENCRYPT)) {

		/*

		 * Skip the call to verify_cpu() in secondary_startup_64 as it

		 * will cause #VC exceptions when the AP can't handle them yet.