lkml.org 
[lkml]   [2023]   [Dec]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH v10 24/50] KVM: SEV: Add initial SEV-SNP support
    On Mon, Oct 16, 2023 at 08:27:53AM -0500, Michael Roth wrote:
    > From: Brijesh Singh <brijesh.singh@amd.com>
    >
    > The next generation of SEV is called SEV-SNP (Secure Nested Paging).
    > SEV-SNP builds upon existing SEV and SEV-ES functionality while adding new
    > hardware based security protection. SEV-SNP adds strong memory encryption
    > integrity protection to help prevent malicious hypervisor-based attacks
    > such as data replay, memory re-mapping, and more, to create an isolated
    > execution environment.
    >
    > The SNP feature is added incrementally, the later patches adds a new module
    > parameters that can be used to enabled SEV-SNP in the KVM.

    This sentence can simply go to /dev/null.

    > Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
    > Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>
    > ---
    > arch/x86/kvm/svm/sev.c | 10 ++++++++++
    > arch/x86/kvm/svm/svm.h | 8 ++++++++
    > 2 files changed, 18 insertions(+)
    >
    > diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
    > index 1cfb9232fc74..4eefc168ebb3 100644
    > --- a/arch/x86/kvm/svm/sev.c
    > +++ b/arch/x86/kvm/svm/sev.c
    > @@ -59,10 +59,14 @@ module_param_named(sev_es, sev_es_enabled, bool, 0444);
    > /* enable/disable SEV-ES DebugSwap support */
    > static bool sev_es_debug_swap_enabled = true;
    > module_param_named(debug_swap, sev_es_debug_swap_enabled, bool, 0444);
    > +
    > +/* enable/disable SEV-SNP support */

    Useless comment.

    > +static bool sev_snp_enabled;
    > #else
    > #define sev_enabled false
    > #define sev_es_enabled false
    > #define sev_es_debug_swap_enabled false
    > +#define sev_snp_enabled false
    > #endif /* CONFIG_KVM_AMD_SEV */
    >
    > #define AP_RESET_HOLD_NONE 0
    > @@ -2186,6 +2190,7 @@ void __init sev_hardware_setup(void)
    > {
    > #ifdef CONFIG_KVM_AMD_SEV
    > unsigned int eax, ebx, ecx, edx, sev_asid_count, sev_es_asid_count;
    > + bool sev_snp_supported = false;
    > bool sev_es_supported = false;
    > bool sev_supported = false;
    >
    > @@ -2261,6 +2266,10 @@ void __init sev_hardware_setup(void)
    > sev_es_asid_count = min_sev_asid - 1;
    > WARN_ON_ONCE(misc_cg_set_capacity(MISC_CG_RES_SEV_ES, sev_es_asid_count));
    > sev_es_supported = true;
    > + sev_snp_supported = sev_snp_enabled && cpu_feature_enabled(X86_FEATURE_SEV_SNP);
    > +
    > + pr_info("SEV-ES %ssupported: %u ASIDs\n",
    > + sev_snp_supported ? "and SEV-SNP " : "", sev_es_asid_count);

    Why like this?

    >
    > out:

    Here, below the "out:" label you're already dumping SEV and -ES status.
    Just do SNP exactly the same.

    > if (boot_cpu_has(X86_FEATURE_SEV))
    > @@ -2277,6 +2286,7 @@ void __init sev_hardware_setup(void)
    > if (!sev_es_enabled || !cpu_feature_enabled(X86_FEATURE_DEBUG_SWAP) ||
    > !cpu_feature_enabled(X86_FEATURE_NO_NESTED_DATA_BP))
    > sev_es_debug_swap_enabled = false;
    > + sev_snp_enabled = sev_snp_supported;
    > #endif
    > }

    --
    Regards/Gruss,
    Boris.

    https://people.kernel.org/tglx/notes-about-netiquette

    \
     
     \ /
      Last update: 2023-12-18 18:50    [W:5.783 / U:0.192 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site