Messages in this thread Patch in this message | | | From | Alejandro Jimenez <> | Subject | [RFC 3/3] x86: Expose SEV-ES capabilities in sysfs | Date | Wed, 9 Mar 2022 17:06:08 -0500 |
| |
Expose the state of the SEV-ES feature via the new sysfs interface. Document the new ABI.
Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> --- .../ABI/testing/sysfs-kernel-mm-mem-encrypt | 28 ++++++++++++- arch/x86/mm/mem_encrypt_amd.c | 40 ++++++++++++++++++- 2 files changed, 66 insertions(+), 2 deletions(-)
diff --git a/Documentation/ABI/testing/sysfs-kernel-mm-mem-encrypt b/Documentation/ABI/testing/sysfs-kernel-mm-mem-encrypt index 68a932d4540b..ecd491c0a7bd 100644 --- a/Documentation/ABI/testing/sysfs-kernel-mm-mem-encrypt +++ b/Documentation/ABI/testing/sysfs-kernel-mm-mem-encrypt @@ -49,7 +49,7 @@ Description: Expose status of sev feature. Valid values are: inactive (Guest only): Running in unencrypted virtual machine. -What: /sys/kernel/mm/mem_encrypt/sev/nr_asid_available +What: /sys/kernel/mm/mem_encrypt/{sev,sev_es}/nr_asid_available Date: March 2022 KernelVersion: 5.17 Description: (Host only) Total number of ASIDs available for encrypted @@ -60,3 +60,29 @@ Date: March 2022 KernelVersion: 5.17 Description: (Host only) Number of ASIDs available for SEV guests with SEV-ES disabled. + +What: /sys/kernel/mm/mem_encrypt/sev_es/status +Date: March 2022 +KernelVersion: 5.17 +Description: Expose status of sev_es feature. Valid values are: + + unsupported: Secure Encrypted Virtualization with Encrypted + State is not supported by the processor. + + enabled (Host only): Hypervisor host capable of running SEV + guests. + + disabled (Host only): Memory encryption has been disabled by + System-Configuration Register (SYSCFG) MemEncryptionModeEn bit. + + active (Guest only): Running in virtual machine with encrypted + code, data, and guest register state. + + inactive (Guest only): Running in virtual machine with + unencrypted register state. + +What: /sys/kernel/mm/mem_encrypt/sev_es/nr_sev_es_asid +Date: March 2022 +KernelVersion: 5.17 +Description: (Host only) Number of ASIDs available for SEV guests with SEV- + ES enabled. diff --git a/arch/x86/mm/mem_encrypt_amd.c b/arch/x86/mm/mem_encrypt_amd.c index 86979e0e26c7..bafc34bf6121 100644 --- a/arch/x86/mm/mem_encrypt_amd.c +++ b/arch/x86/mm/mem_encrypt_amd.c @@ -39,6 +39,7 @@ #define AMD_SME_BIT BIT(0) #define AMD_SEV_BIT BIT(1) +#define AMD_SEV_ES_BIT BIT(3) #define CC_ATTR_RO(_name) \ static struct kobj_attribute _name##_attr = __ATTR_RO(_name) @@ -98,7 +99,8 @@ static void encrypted_mem_caps_init(void) cpuid(AMD_CPUID_ENCRYPTED_MEM, &eax, &ebx, &ecx, &edx); cbit_pos = ebx & 0x3f; - sec_encrypt_support_mask = eax & (AMD_SME_BIT | AMD_SEV_BIT); + sec_encrypt_support_mask = eax & + (AMD_SME_BIT | AMD_SEV_BIT | AMD_SEV_ES_BIT); max_sev_asid = ecx; min_sev_asid = edx; @@ -174,6 +176,10 @@ static ssize_t status_show(struct kobject *kobj, } else if (!strcmp(kobj->name, "sev")) { return sev_status_show(AMD_SEV_BIT, X86_FEATURE_SEV, CC_ATTR_GUEST_MEM_ENCRYPT, buf); + + } else if (!strcmp(kobj->name, "sev_es")) { + return sev_status_show(AMD_SEV_ES_BIT, X86_FEATURE_SEV_ES, + CC_ATTR_GUEST_STATE_ENCRYPT, buf); } /* @@ -210,6 +216,18 @@ static ssize_t nr_sev_asid_show(struct kobject *kobj, } CC_ATTR_RO(nr_sev_asid); +static ssize_t nr_sev_es_asid_show(struct kobject *kobj, + struct kobj_attribute *attr, char *buf) +{ + unsigned int nr_sev_es_asid = 0; + + if (min_sev_asid) + nr_sev_es_asid = min_sev_asid - 1; + + return sysfs_emit(buf, "%u\n", nr_sev_es_asid); +} +CC_ATTR_RO(nr_sev_es_asid); + static struct attribute *sme_attrs[] = { &status_attr.attr, NULL, @@ -236,16 +254,36 @@ static const struct attribute_group sev_guest_attr_group = { .attrs = sev_guest_attrs, }; +static struct attribute *sev_es_host_attrs[] = { + &status_attr.attr, + &nr_asid_available_attr.attr, + &nr_sev_es_asid_attr.attr, + NULL, +}; +static const struct attribute_group sev_es_host_attr_group = { + .attrs = sev_es_host_attrs, +}; + +static struct attribute *sev_es_guest_attrs[] = { + &status_attr.attr, + NULL, +}; +static const struct attribute_group sev_es_guest_attr_group = { + .attrs = sev_es_guest_attrs, +}; + /* List of features to be exposed when running as hypervisor host */ static struct amd_cc_feature host_cc_feat_list[] = { AMD_CC_FEATURE("sme", sme_attr_group, NULL), AMD_CC_FEATURE("sev", sev_host_attr_group, NULL), + AMD_CC_FEATURE("sev_es", sev_es_host_attr_group, NULL), {}, }; /* List of features to be exposed when running as guest */ static struct amd_cc_feature guest_cc_feat_list[] = { AMD_CC_FEATURE("sev", sev_guest_attr_group, NULL), + AMD_CC_FEATURE("sev_es", sev_es_guest_attr_group, NULL), {}, }; -- 2.34.1
| |