Commit b57de6cd authored by Joerg Roedel's avatar Joerg Roedel Committed by Borislav Petkov
Browse files

x86/sev-es: Add SEV-ES Feature Detection 



Add a sev_es_active() function for checking whether SEV-ES is enabled.
Also cache the value of MSR_AMD64_SEV at boot to speed up the feature
checking in the running code.

 [ bp: Remove "!!" in sev_active() too. ]

Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
Reviewed-by: default avatarKees Cook <keescook@chromium.org>
Link: https://lkml.kernel.org/r/20200907131613.12703-37-joro@8bytes.org
parent 4b47cdbd

arch/x86/include/asm/mem_encrypt.h

+3 −0
Original line number Diff line number Diff line
@@ -19,6 +19,7 @@ 
#ifdef CONFIG_AMD_MEM_ENCRYPT



extern u64 sme_me_mask;

extern u64 sev_status;

extern bool sev_enabled;



void sme_encrypt_execute(unsigned long encrypted_kernel_vaddr,
@@ -50,6 +51,7 @@ void __init mem_encrypt_init(void); 


bool sme_active(void);

bool sev_active(void);

bool sev_es_active(void);



#define __bss_decrypted __attribute__((__section__(".bss..decrypted")))
@@ -72,6 +74,7 @@ static inline void __init sme_enable(struct boot_params *bp) { } 


static inline bool sme_active(void) { return false; }

static inline bool sev_active(void) { return false; }

static inline bool sev_es_active(void) { return false; }



static inline int __init

early_set_memory_decrypted(unsigned long vaddr, unsigned long size) { return 0; }

arch/x86/include/asm/msr-index.h

+2 −0
Original line number Diff line number Diff line
@@ -469,7 +469,9 @@ 
#define MSR_AMD64_SEV_ES_GHCB		0xc0010130

#define MSR_AMD64_SEV			0xc0010131

#define MSR_AMD64_SEV_ENABLED_BIT	0

#define MSR_AMD64_SEV_ES_ENABLED_BIT	1

#define MSR_AMD64_SEV_ENABLED		BIT_ULL(MSR_AMD64_SEV_ENABLED_BIT)

#define MSR_AMD64_SEV_ES_ENABLED	BIT_ULL(MSR_AMD64_SEV_ES_ENABLED_BIT)



#define MSR_AMD64_VIRT_SPEC_CTRL	0xc001011f

arch/x86/mm/mem_encrypt.c

+8 −1
Original line number Diff line number Diff line
@@ -38,6 +38,7 @@ 
 * section is later cleared.

 */

u64 sme_me_mask __section(.data) = 0;

u64 sev_status __section(.data) = 0;

EXPORT_SYMBOL(sme_me_mask);

DEFINE_STATIC_KEY_FALSE(sev_enable_key);

EXPORT_SYMBOL_GPL(sev_enable_key);
@@ -347,7 +348,13 @@ bool sme_active(void) 


bool sev_active(void)

{

	return sme_me_mask && sev_enabled;

	return sev_status & MSR_AMD64_SEV_ENABLED;

}



/* Needs to be called from non-instrumentable code */

bool noinstr sev_es_active(void)

{

	return sev_status & MSR_AMD64_SEV_ES_ENABLED;

}



/* Override for DMA direct allocation check - ARCH_HAS_FORCE_DMA_UNENCRYPTED */

arch/x86/mm/mem_encrypt_identity.c

+3 −0
Original line number Diff line number Diff line
@@ -540,6 +540,9 @@ void __init sme_enable(struct boot_params *bp) 
		if (!(msr & MSR_AMD64_SEV_ENABLED))

			return;



		/* Save SEV_STATUS to avoid reading MSR again */

		sev_status = msr;



		/* SEV state cannot be controlled by a command line option */

		sme_me_mask = me_mask;

		sev_enabled = true;