Commit b577f542 authored by Kirill A. Shutemov's avatar Kirill A. Shutemov Committed by Borislav Petkov
Browse files

x86/coco: Add API to handle encryption mask 



AMD SME/SEV uses a bit in the page table entries to indicate that the
page is encrypted and not accessible to the VMM.

TDX uses a similar approach, but the polarity of the mask is opposite to
AMD: if the bit is set the page is accessible to VMM.

Provide vendor-neutral API to deal with the mask: cc_mkenc() and
cc_mkdec() modify given address to make it encrypted/decrypted. It can
be applied to phys_addr_t, pgprotval_t or page table entry value.

pgprot_encrypted() and pgprot_decrypted() reimplemented using new
helpers.

The implementation will be extended to cover TDX.

pgprot_decrypted() is used by drivers (i915, virtio_gpu, vfio).
cc_mkdec() called by pgprot_decrypted(). Export cc_mkdec().

Signed-off-by: default avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
Reviewed-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
Link: https://lore.kernel.org/r/20220222185740.26228-5-kirill.shutemov@linux.intel.com
parent 655a0fa3

arch/x86/coco/core.c

+27 −0
Original line number Diff line number Diff line
@@ -14,6 +14,7 @@ 
#include <asm/processor.h>



static enum cc_vendor vendor __ro_after_init;

static u64 cc_mask __ro_after_init;



static bool intel_cc_platform_has(enum cc_attr attr)

{
@@ -84,7 +85,33 @@ bool cc_platform_has(enum cc_attr attr) 
}

EXPORT_SYMBOL_GPL(cc_platform_has);



u64 cc_mkenc(u64 val)

{

	switch (vendor) {

	case CC_VENDOR_AMD:

		return val | cc_mask;

	default:

		return val;

	}

}



u64 cc_mkdec(u64 val)

{

	switch (vendor) {

	case CC_VENDOR_AMD:

		return val & ~cc_mask;

	default:

		return val;

	}

}

EXPORT_SYMBOL_GPL(cc_mkdec);



__init void cc_set_vendor(enum cc_vendor v)

{

	vendor = v;

}



__init void cc_set_mask(u64 mask)

{

	cc_mask = mask;

}

arch/x86/include/asm/coco.h

+18 −0
Original line number Diff line number Diff line
@@ -2,6 +2,8 @@ 
#ifndef _ASM_X86_COCO_H

#define _ASM_X86_COCO_H



#include <asm/types.h>



enum cc_vendor {

	CC_VENDOR_NONE,

	CC_VENDOR_AMD,
@@ -10,5 +12,21 @@ enum cc_vendor { 
};



void cc_set_vendor(enum cc_vendor v);

void cc_set_mask(u64 mask);



#ifdef CONFIG_ARCH_HAS_CC_PLATFORM

u64 cc_mkenc(u64 val);

u64 cc_mkdec(u64 val);

#else

static inline u64 cc_mkenc(u64 val)

{

	return val;

}



static inline u64 cc_mkdec(u64 val)

{

	return val;

}

#endif



#endif /* _ASM_X86_COCO_H */

arch/x86/include/asm/pgtable.h

+7 −6
Original line number Diff line number Diff line
@@ -15,17 +15,12 @@ 
		     cachemode2protval(_PAGE_CACHE_MODE_UC_MINUS)))	\

	 : (prot))



/*

 * Macros to add or remove encryption attribute

 */

#define pgprot_encrypted(prot)	__pgprot(__sme_set(pgprot_val(prot)))

#define pgprot_decrypted(prot)	__pgprot(__sme_clr(pgprot_val(prot)))



#ifndef __ASSEMBLY__

#include <linux/spinlock.h>

#include <asm/x86_init.h>

#include <asm/pkru.h>

#include <asm/fpu/api.h>

#include <asm/coco.h>

#include <asm-generic/pgtable_uffd.h>

#include <linux/page_table_check.h>
@@ -38,6 +33,12 @@ void ptdump_walk_pgd_level_debugfs(struct seq_file *m, struct mm_struct *mm, 
void ptdump_walk_pgd_level_checkwx(void);

void ptdump_walk_user_pgd_level_checkwx(void);



/*

 * Macros to add or remove encryption attribute

 */

#define pgprot_encrypted(prot)	__pgprot(cc_mkenc(pgprot_val(prot)))

#define pgprot_decrypted(prot)	__pgprot(cc_mkdec(pgprot_val(prot)))



#ifdef CONFIG_DEBUG_WX

#define debug_checkwx()		ptdump_walk_pgd_level_checkwx()

#define debug_checkwx_user()	ptdump_walk_user_pgd_level_checkwx()

arch/x86/mm/mem_encrypt_identity.c

+1 −0
Original line number Diff line number Diff line
@@ -604,5 +604,6 @@ void __init sme_enable(struct boot_params *bp) 
	if (sme_me_mask) {

		physical_mask &= ~sme_me_mask;

		cc_set_vendor(CC_VENDOR_AMD);

		cc_set_mask(sme_me_mask);

	}

}

arch/x86/mm/pat/set_memory.c

+3 −2
Original line number Diff line number Diff line
@@ -1989,6 +1989,7 @@ int set_memory_global(unsigned long addr, int numpages) 
 */

static int __set_memory_enc_pgtable(unsigned long addr, int numpages, bool enc)

{

	pgprot_t empty = __pgprot(0);

	struct cpa_data cpa;

	int ret;
@@ -1999,8 +2000,8 @@ static int __set_memory_enc_pgtable(unsigned long addr, int numpages, bool enc) 
	memset(&cpa, 0, sizeof(cpa));

	cpa.vaddr = &addr;

	cpa.numpages = numpages;

	cpa.mask_set = enc ? __pgprot(_PAGE_ENC) : __pgprot(0);

	cpa.mask_clr = enc ? __pgprot(0) : __pgprot(_PAGE_ENC);

	cpa.mask_set = enc ? pgprot_encrypted(empty) : pgprot_decrypted(empty);

	cpa.mask_clr = enc ? pgprot_decrypted(empty) : pgprot_encrypted(empty);

	cpa.pgd = init_mm.pgd;



	/* Must avoid aliasing mappings in the highmem code */