lkml.org 
[lkml]   [2021]   [Jun]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectRe: [RFC v2-fix-v2 1/1] x86: Introduce generic protected guest abstractionn
    From f1e9f051c86b09fe660f49b0307bc7c6cec5e6f4 Mon Sep 17 00:00:00 2001
    From: Borislav Petkov <bp@suse.de>
    Date: Thu, 3 Jun 2021 20:03:31 +0200
    Subject: Convert sme_active()

    diff --git a/arch/x86/include/asm/mem_encrypt.h b/arch/x86/include/asm/mem_encrypt.h
    index 9c80c68d75b5..1bb9f22629fc 100644
    --- a/arch/x86/include/asm/mem_encrypt.h
    +++ b/arch/x86/include/asm/mem_encrypt.h
    @@ -50,7 +50,6 @@ void __init mem_encrypt_free_decrypted_mem(void);
    void __init mem_encrypt_init(void);

    void __init sev_es_init_vc_handling(void);
    -bool sme_active(void);
    bool sev_active(void);
    bool sev_es_active(void);

    @@ -75,7 +74,6 @@ static inline void __init sme_encrypt_kernel(struct boot_params *bp) { }
    static inline void __init sme_enable(struct boot_params *bp) { }

    static inline void sev_es_init_vc_handling(void) { }
    -static inline bool sme_active(void) { return false; }
    static inline bool sev_active(void) { return false; }
    static inline bool sev_es_active(void) { return false; }

    diff --git a/arch/x86/kernel/machine_kexec_64.c b/arch/x86/kernel/machine_kexec_64.c
    index c078b0d3ab0e..1d88232146ab 100644
    --- a/arch/x86/kernel/machine_kexec_64.c
    +++ b/arch/x86/kernel/machine_kexec_64.c
    @@ -387,7 +387,7 @@ void machine_kexec(struct kimage *image)
    (unsigned long)page_list,
    image->start,
    image->preserve_context,
    - sme_active());
    + protected_guest_has(VM_HOST_MEM_ENCRYPT));

    #ifdef CONFIG_KEXEC_JUMP
    if (image->preserve_context)
    diff --git a/arch/x86/kernel/pci-swiotlb.c b/arch/x86/kernel/pci-swiotlb.c
    index c2cfa5e7c152..ce6f2b9a05c7 100644
    --- a/arch/x86/kernel/pci-swiotlb.c
    +++ b/arch/x86/kernel/pci-swiotlb.c
    @@ -49,7 +49,7 @@ int __init pci_swiotlb_detect_4gb(void)
    * buffers are allocated and used for devices that do not support
    * the addressing range required for the encryption mask.
    */
    - if (sme_active())
    + if (protected_guest_has(VM_HOST_MEM_ENCRYPT))
    swiotlb = 1;

    return swiotlb;
    diff --git a/arch/x86/kernel/sev.c b/arch/x86/kernel/sev.c
    index 01a224fdb897..3aa2658ced52 100644
    --- a/arch/x86/kernel/sev.c
    +++ b/arch/x86/kernel/sev.c
    @@ -1409,6 +1409,11 @@ bool sev_protected_guest_has(unsigned long flag)
    case VM_MEM_ENCRYPT:
    case VM_MEM_ENCRYPT_ACTIVE:
    return true;
    + case VM_HOST_MEM_ENCRYPT:
    + return sme_me_mask && !sev_active();
    + default:
    + WARN_ON_ONCE(1);
    + return false;
    }

    return false;
    diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
    index 667bba74e4c8..50ed2a768844 100644
    --- a/arch/x86/mm/ioremap.c
    +++ b/arch/x86/mm/ioremap.c
    @@ -703,7 +703,7 @@ bool arch_memremap_can_ram_remap(resource_size_t phys_addr, unsigned long size,
    if (flags & MEMREMAP_DEC)
    return false;

    - if (sme_active()) {
    + if (protected_guest_has(VM_HOST_MEM_ENCRYPT)) {
    if (memremap_is_setup_data(phys_addr, size) ||
    memremap_is_efi_data(phys_addr, size))
    return false;
    @@ -729,7 +729,7 @@ pgprot_t __init early_memremap_pgprot_adjust(resource_size_t phys_addr,

    encrypted_prot = true;

    - if (sme_active()) {
    + if (protected_guest_has(VM_HOST_MEM_ENCRYPT)) {
    if (early_memremap_is_setup_data(phys_addr, size) ||
    memremap_is_efi_data(phys_addr, size))
    encrypted_prot = false;
    diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c
    index 49d11bb6e02a..9b0cdac895ca 100644
    --- a/arch/x86/mm/mem_encrypt.c
    +++ b/arch/x86/mm/mem_encrypt.c
    @@ -145,7 +145,7 @@ void __init sme_unmap_bootdata(char *real_mode_data)
    struct boot_params *boot_data;
    unsigned long cmdline_paddr;

    - if (!sme_active())
    + if (!protected_guest_has(VM_HOST_MEM_ENCRYPT))
    return;

    /* Get the command line address before unmapping the real_mode_data */
    @@ -165,7 +165,7 @@ void __init sme_map_bootdata(char *real_mode_data)
    struct boot_params *boot_data;
    unsigned long cmdline_paddr;

    - if (!sme_active())
    + if (!protected_guest_has(VM_HOST_MEM_ENCRYPT))
    return;

    __sme_early_map_unmap_mem(real_mode_data, sizeof(boot_params), true);
    @@ -365,7 +365,7 @@ int __init early_set_memory_encrypted(unsigned long vaddr, unsigned long size)
    /*
    * SME and SEV are very similar but they are not the same, so there are
    * times that the kernel will need to distinguish between SME and SEV. The
    - * sme_active() and sev_active() functions are used for this. When a
    + * protected_guest_has(VM_HOST_MEM_ENCRYPT) and sev_active() functions are used for this. When a
    * distinction isn't needed, the mem_encrypt_active() function can be used.
    *
    * The trampoline code is a good example for this requirement. Before
    @@ -378,11 +378,6 @@ bool sev_active(void)
    {
    return sev_status & MSR_AMD64_SEV_ENABLED;
    }
    -
    -bool sme_active(void)
    -{
    - return sme_me_mask && !sev_active();
    -}
    EXPORT_SYMBOL_GPL(sev_active);

    /* Needs to be called from non-instrumentable code */
    @@ -405,7 +400,7 @@ bool amd_force_dma_unencrypted(struct device *dev)
    * device does not support DMA to addresses that include the
    * encryption mask.
    */
    - if (sme_active()) {
    + if (protected_guest_has(VM_HOST_MEM_ENCRYPT)) {
    u64 dma_enc_mask = DMA_BIT_MASK(__ffs64(sme_me_mask));
    u64 dma_dev_mask = min_not_zero(dev->coherent_dma_mask,
    dev->bus_dma_limit);
    @@ -446,7 +441,7 @@ static void print_mem_encrypt_feature_info(void)
    pr_info("AMD Memory Encryption Features active:");

    /* Secure Memory Encryption */
    - if (sme_active()) {
    + if (protected_guest_has(VM_HOST_MEM_ENCRYPT)) {
    /*
    * SME is mutually exclusive with any of the SEV
    * features below.
    diff --git a/arch/x86/mm/mem_encrypt_common.c b/arch/x86/mm/mem_encrypt_common.c
    index da94fc2e9b56..286357956762 100644
    --- a/arch/x86/mm/mem_encrypt_common.c
    +++ b/arch/x86/mm/mem_encrypt_common.c
    @@ -15,7 +15,7 @@
    /* Override for DMA direct allocation check - ARCH_HAS_FORCE_DMA_UNENCRYPTED */
    bool force_dma_unencrypted(struct device *dev)
    {
    - if (sev_active() || sme_active())
    + if (sev_active() || protected_guest_has(VM_HOST_MEM_ENCRYPT))
    return amd_force_dma_unencrypted(dev);

    if (protected_guest_has(VM_MEM_ENCRYPT))
    diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c
    index a9639f663d25..a92b49aa0d73 100644
    --- a/arch/x86/mm/mem_encrypt_identity.c
    +++ b/arch/x86/mm/mem_encrypt_identity.c
    @@ -30,6 +30,7 @@
    #include <linux/kernel.h>
    #include <linux/mm.h>
    #include <linux/mem_encrypt.h>
    +#include <linux/protected_guest.h>

    #include <asm/setup.h>
    #include <asm/sections.h>
    @@ -287,7 +288,7 @@ void __init sme_encrypt_kernel(struct boot_params *bp)
    unsigned long pgtable_area_len;
    unsigned long decrypted_base;

    - if (!sme_active())
    + if (!protected_guest_has(VM_HOST_MEM_ENCRYPT))
    return;

    /*
    diff --git a/arch/x86/realmode/init.c b/arch/x86/realmode/init.c
    index 2e1c1bec0f9e..7f9a708986a3 100644
    --- a/arch/x86/realmode/init.c
    +++ b/arch/x86/realmode/init.c
    @@ -42,7 +42,7 @@ void __init reserve_real_mode(void)
    static void sme_sev_setup_real_mode(struct trampoline_header *th)
    {
    #ifdef CONFIG_AMD_MEM_ENCRYPT
    - if (sme_active())
    + if (protected_guest_has(VM_HOST_MEM_ENCRYPT))
    th->flags |= TH_FLAGS_SME_ACTIVE;

    if (sev_es_active()) {
    @@ -79,7 +79,7 @@ static void __init setup_real_mode(void)
    * decrypted memory in order to bring up other processors
    * successfully. This is not needed for SEV.
    */
    - if (sme_active())
    + if (protected_guest_has(VM_HOST_MEM_ENCRYPT))
    set_memory_decrypted((unsigned long)base, size >> PAGE_SHIFT);

    memcpy(base, real_mode_blob, size);
    diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
    index d006724f4dc2..3c2365f13cc3 100644
    --- a/drivers/iommu/amd/init.c
    +++ b/drivers/iommu/amd/init.c
    @@ -965,7 +965,7 @@ static bool copy_device_table(void)
    pr_err("The address of old device table is above 4G, not trustworthy!\n");
    return false;
    }
    - old_devtb = (sme_active() && is_kdump_kernel())
    + old_devtb = (protected_guest_has(VM_HOST_MEM_ENCRYPT) && is_kdump_kernel())
    ? (__force void *)ioremap_encrypted(old_devtb_phys,
    dev_table_size)
    : memremap(old_devtb_phys, dev_table_size, MEMREMAP_WB);
    @@ -3022,7 +3022,7 @@ static int __init amd_iommu_init(void)

    static bool amd_iommu_sme_check(void)
    {
    - if (!sme_active() || (boot_cpu_data.x86 != 0x17))
    + if (!protected_guest_has(VM_HOST_MEM_ENCRYPT) || (boot_cpu_data.x86 != 0x17))
    return true;

    /* For Fam17h, a specific level of support is required */
    --
    Regards/Gruss,
    Boris.

    https://people.kernel.org/tglx/notes-about-netiquette

    \
     
     \ /
      Last update: 2021-06-03 20:16    [W:3.869 / U:0.116 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site