Commit aa5a4611 authored by Tom Lendacky's avatar Tom Lendacky Committed by Borislav Petkov
Browse files

x86/sev: Add an x86 version of cc_platform_has() 



Introduce an x86 version of the cc_platform_has() function. This will be
used to replace vendor specific calls like sme_active(), sev_active(),
etc.

Signed-off-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/20210928191009.32551-4-bp@alien8.de
parent 46b49b12

arch/x86/Kconfig

+1 −0
Original line number Diff line number Diff line
@@ -1518,6 +1518,7 @@ config AMD_MEM_ENCRYPT 
	select ARCH_HAS_FORCE_DMA_UNENCRYPTED

	select INSTRUCTION_DECODER

	select ARCH_HAS_RESTRICTED_VIRTIO_MEMORY_ACCESS

	select ARCH_HAS_CC_PLATFORM

	help

	  Say yes to enable support for the encryption of system memory.

	  This requires an AMD processor that supports Secure Memory

arch/x86/include/asm/mem_encrypt.h

+1 −0
Original line number Diff line number Diff line
@@ -13,6 +13,7 @@ 
#ifndef __ASSEMBLY__



#include <linux/init.h>

#include <linux/cc_platform.h>



#include <asm/bootparam.h>

arch/x86/kernel/Makefile

+6 −0
Original line number Diff line number Diff line
@@ -21,6 +21,7 @@ CFLAGS_REMOVE_ftrace.o = -pg 
CFLAGS_REMOVE_early_printk.o = -pg

CFLAGS_REMOVE_head64.o = -pg

CFLAGS_REMOVE_sev.o = -pg

CFLAGS_REMOVE_cc_platform.o = -pg

endif



KASAN_SANITIZE_head$(BITS).o				:= n
@@ -29,6 +30,7 @@ KASAN_SANITIZE_dumpstack_$(BITS).o := n 
KASAN_SANITIZE_stacktrace.o				:= n

KASAN_SANITIZE_paravirt.o				:= n

KASAN_SANITIZE_sev.o					:= n

KASAN_SANITIZE_cc_platform.o				:= n



# With some compiler versions the generated code results in boot hangs, caused

# by several compilation units. To be safe, disable all instrumentation.
@@ -47,6 +49,7 @@ endif 
KCOV_INSTRUMENT		:= n



CFLAGS_head$(BITS).o	+= -fno-stack-protector

CFLAGS_cc_platform.o	+= -fno-stack-protector



CFLAGS_irq.o := -I $(srctree)/$(src)/../include/asm/trace
@@ -147,6 +150,9 @@ obj-$(CONFIG_UNWINDER_FRAME_POINTER) += unwind_frame.o 
obj-$(CONFIG_UNWINDER_GUESS)		+= unwind_guess.o



obj-$(CONFIG_AMD_MEM_ENCRYPT)		+= sev.o



obj-$(CONFIG_ARCH_HAS_CC_PLATFORM)	+= cc_platform.o



###

# 64 bit specific files

ifeq ($(CONFIG_X86_64),y)

arch/x86/kernel/cc_platform.c

0 → 100644
+69 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/*

 * Confidential Computing Platform Capability checks

 *

 * Copyright (C) 2021 Advanced Micro Devices, Inc.

 *

 * Author: Tom Lendacky <thomas.lendacky@amd.com>

 */



#include <linux/export.h>

#include <linux/cc_platform.h>

#include <linux/mem_encrypt.h>



#include <asm/processor.h>



static bool __maybe_unused intel_cc_platform_has(enum cc_attr attr)

{

#ifdef CONFIG_INTEL_TDX_GUEST

	return false;

#else

	return false;

#endif

}



/*

 * SME and SEV are very similar but they are not the same, so there are

 * times that the kernel will need to distinguish between SME and SEV. The

 * cc_platform_has() function is used for this.  When a distinction isn't

 * needed, the CC_ATTR_MEM_ENCRYPT attribute can be used.

 *

 * The trampoline code is a good example for this requirement.  Before

 * paging is activated, SME will access all memory as decrypted, but SEV

 * will access all memory as encrypted.  So, when APs are being brought

 * up under SME the trampoline area cannot be encrypted, whereas under SEV

 * the trampoline area must be encrypted.

 */

static bool amd_cc_platform_has(enum cc_attr attr)

{

#ifdef CONFIG_AMD_MEM_ENCRYPT

	switch (attr) {

	case CC_ATTR_MEM_ENCRYPT:

		return sme_me_mask;



	case CC_ATTR_HOST_MEM_ENCRYPT:

		return sme_me_mask && !(sev_status & MSR_AMD64_SEV_ENABLED);



	case CC_ATTR_GUEST_MEM_ENCRYPT:

		return sev_status & MSR_AMD64_SEV_ENABLED;



	case CC_ATTR_GUEST_STATE_ENCRYPT:

		return sev_status & MSR_AMD64_SEV_ES_ENABLED;



	default:

		return false;

	}

#else

	return false;

#endif

}





bool cc_platform_has(enum cc_attr attr)

{

	if (sme_me_mask)

		return amd_cc_platform_has(attr);



	return false;

}

EXPORT_SYMBOL_GPL(cc_platform_has);

arch/x86/mm/mem_encrypt.c

+1 −0
Original line number Diff line number Diff line
@@ -20,6 +20,7 @@ 
#include <linux/bitops.h>

#include <linux/dma-mapping.h>

#include <linux/virtio_config.h>

#include <linux/cc_platform.h>



#include <asm/tlbflush.h>

#include <asm/fixmap.h>