Messages in this thread | | | Date | Mon, 18 Dec 2023 18:43:11 +0100 | From | Borislav Petkov <> | Subject | Re: [PATCH v10 24/50] KVM: SEV: Add initial SEV-SNP support |
| |
On Mon, Oct 16, 2023 at 08:27:53AM -0500, Michael Roth wrote: > From: Brijesh Singh <brijesh.singh@amd.com> > > The next generation of SEV is called SEV-SNP (Secure Nested Paging). > SEV-SNP builds upon existing SEV and SEV-ES functionality while adding new > hardware based security protection. SEV-SNP adds strong memory encryption > integrity protection to help prevent malicious hypervisor-based attacks > such as data replay, memory re-mapping, and more, to create an isolated > execution environment. > > The SNP feature is added incrementally, the later patches adds a new module > parameters that can be used to enabled SEV-SNP in the KVM.
This sentence can simply go to /dev/null.
> Signed-off-by: Brijesh Singh <brijesh.singh@amd.com> > Signed-off-by: Ashish Kalra <ashish.kalra@amd.com> > --- > arch/x86/kvm/svm/sev.c | 10 ++++++++++ > arch/x86/kvm/svm/svm.h | 8 ++++++++ > 2 files changed, 18 insertions(+) > > diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c > index 1cfb9232fc74..4eefc168ebb3 100644 > --- a/arch/x86/kvm/svm/sev.c > +++ b/arch/x86/kvm/svm/sev.c > @@ -59,10 +59,14 @@ module_param_named(sev_es, sev_es_enabled, bool, 0444); > /* enable/disable SEV-ES DebugSwap support */ > static bool sev_es_debug_swap_enabled = true; > module_param_named(debug_swap, sev_es_debug_swap_enabled, bool, 0444); > + > +/* enable/disable SEV-SNP support */
Useless comment.
> +static bool sev_snp_enabled; > #else > #define sev_enabled false > #define sev_es_enabled false > #define sev_es_debug_swap_enabled false > +#define sev_snp_enabled false > #endif /* CONFIG_KVM_AMD_SEV */ > > #define AP_RESET_HOLD_NONE 0 > @@ -2186,6 +2190,7 @@ void __init sev_hardware_setup(void) > { > #ifdef CONFIG_KVM_AMD_SEV > unsigned int eax, ebx, ecx, edx, sev_asid_count, sev_es_asid_count; > + bool sev_snp_supported = false; > bool sev_es_supported = false; > bool sev_supported = false; > > @@ -2261,6 +2266,10 @@ void __init sev_hardware_setup(void) > sev_es_asid_count = min_sev_asid - 1; > WARN_ON_ONCE(misc_cg_set_capacity(MISC_CG_RES_SEV_ES, sev_es_asid_count)); > sev_es_supported = true; > + sev_snp_supported = sev_snp_enabled && cpu_feature_enabled(X86_FEATURE_SEV_SNP); > + > + pr_info("SEV-ES %ssupported: %u ASIDs\n", > + sev_snp_supported ? "and SEV-SNP " : "", sev_es_asid_count);
Why like this?
> > out:
Here, below the "out:" label you're already dumping SEV and -ES status. Just do SNP exactly the same.
> if (boot_cpu_has(X86_FEATURE_SEV)) > @@ -2277,6 +2286,7 @@ void __init sev_hardware_setup(void) > if (!sev_es_enabled || !cpu_feature_enabled(X86_FEATURE_DEBUG_SWAP) || > !cpu_feature_enabled(X86_FEATURE_NO_NESTED_DATA_BP)) > sev_es_debug_swap_enabled = false; > + sev_snp_enabled = sev_snp_supported; > #endif > }
-- Regards/Gruss, Boris.
https://people.kernel.org/tglx/notes-about-netiquette
| |