Skip to content

Commit 6b9bfb1

Browse files
torvaldstorvalds
committed
Merge tag 'x86_cc_for_v5.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 confidential computing updates from Borislav Petkov: - Add shared confidential computing code which will be used by both vendors instead of proliferating home-grown solutions for technologies (SEV/SNP and TDX) which are pretty similar * tag 'x86_cc_for_v5.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mm/cpa: Generalize __set_memory_enc_pgtable() x86/coco: Add API to handle encryption mask x86/coco: Explicitly declare type of confidential computing platform x86/cc: Move arch/x86/{kernel/cc_platform.c => coco/core.c}
2 parents 61e2658 + 1e8c597 commit 6b9bfb1

13 files changed

Lines changed: 199 additions & 63 deletions

File tree

‎arch/x86/Kbuild‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
# SPDX-License-Identifier: GPL-2.0
2+
obj-$(CONFIG_ARCH_HAS_CC_PLATFORM) += coco/
3+
24
obj-y += entry/
35

46
obj-$(CONFIG_PERF_EVENTS) += events/

‎arch/x86/coco/Makefile‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# SPDX-License-Identifier: GPL-2.0
2+
CFLAGS_REMOVE_core.o = -pg
3+
KASAN_SANITIZE_core.o := n
4+
CFLAGS_core.o += -fno-stack-protector
5+
6+
obj-y += core.o

arch/x86/kernel/cc_platform.c renamed to arch/x86/coco/core.c

Lines changed: 44 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -9,18 +9,16 @@
99

1010
#include <linux/export.h>
1111
#include <linux/cc_platform.h>
12-
#include <linux/mem_encrypt.h>
1312

14-
#include <asm/mshyperv.h>
13+
#include <asm/coco.h>
1514
#include <asm/processor.h>
1615

17-
static bool __maybe_unused intel_cc_platform_has(enum cc_attr attr)
16+
static enum cc_vendor vendor __ro_after_init;
17+
static u64 cc_mask __ro_after_init;
18+
19+
static bool intel_cc_platform_has(enum cc_attr attr)
1820
{
19-
#ifdef CONFIG_INTEL_TDX_GUEST
20-
return false;
21-
#else
2221
return false;
23-
#endif
2422
}
2523

2624
/*
@@ -74,12 +72,46 @@ static bool hyperv_cc_platform_has(enum cc_attr attr)
7472

7573
bool cc_platform_has(enum cc_attr attr)
7674
{
77-
if (sme_me_mask)
75+
switch (vendor) {
76+
case CC_VENDOR_AMD:
7877
return amd_cc_platform_has(attr);
79-
80-
if (hv_is_isolation_supported())
78+
case CC_VENDOR_INTEL:
79+
return intel_cc_platform_has(attr);
80+
case CC_VENDOR_HYPERV:
8181
return hyperv_cc_platform_has(attr);
82-
83-
return false;
82+
default:
83+
return false;
84+
}
8485
}
8586
EXPORT_SYMBOL_GPL(cc_platform_has);
87+
88+
u64 cc_mkenc(u64 val)
89+
{
90+
switch (vendor) {
91+
case CC_VENDOR_AMD:
92+
return val | cc_mask;
93+
default:
94+
return val;
95+
}
96+
}
97+
98+
u64 cc_mkdec(u64 val)
99+
{
100+
switch (vendor) {
101+
case CC_VENDOR_AMD:
102+
return val & ~cc_mask;
103+
default:
104+
return val;
105+
}
106+
}
107+
EXPORT_SYMBOL_GPL(cc_mkdec);
108+
109+
__init void cc_set_vendor(enum cc_vendor v)
110+
{
111+
vendor = v;
112+
}
113+
114+
__init void cc_set_mask(u64 mask)
115+
{
116+
cc_mask = mask;
117+
}

‎arch/x86/include/asm/coco.h‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
/* SPDX-License-Identifier: GPL-2.0 */
2+
#ifndef _ASM_X86_COCO_H
3+
#define _ASM_X86_COCO_H
4+
5+
#include <asm/types.h>
6+
7+
enum cc_vendor {
8+
CC_VENDOR_NONE,
9+
CC_VENDOR_AMD,
10+
CC_VENDOR_HYPERV,
11+
CC_VENDOR_INTEL,
12+
};
13+
14+
void cc_set_vendor(enum cc_vendor v);
15+
void cc_set_mask(u64 mask);
16+
17+
#ifdef CONFIG_ARCH_HAS_CC_PLATFORM
18+
u64 cc_mkenc(u64 val);
19+
u64 cc_mkdec(u64 val);
20+
#else
21+
static inline u64 cc_mkenc(u64 val)
22+
{
23+
return val;
24+
}
25+
26+
static inline u64 cc_mkdec(u64 val)
27+
{
28+
return val;
29+
}
30+
#endif
31+
32+
#endif /* _ASM_X86_COCO_H */

‎arch/x86/include/asm/pgtable.h‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -15,17 +15,12 @@
1515
cachemode2protval(_PAGE_CACHE_MODE_UC_MINUS))) \
1616
: (prot))
1717

18-
/*
19-
* Macros to add or remove encryption attribute
20-
*/
21-
#define pgprot_encrypted(prot) __pgprot(__sme_set(pgprot_val(prot)))
22-
#define pgprot_decrypted(prot) __pgprot(__sme_clr(pgprot_val(prot)))
23-
2418
#ifndef __ASSEMBLY__
2519
#include <linux/spinlock.h>
2620
#include <asm/x86_init.h>
2721
#include <asm/pkru.h>
2822
#include <asm/fpu/api.h>
23+
#include <asm/coco.h>
2924
#include <asm-generic/pgtable_uffd.h>
3025
#include <linux/page_table_check.h>
3126

@@ -38,6 +33,12 @@ void ptdump_walk_pgd_level_debugfs(struct seq_file *m, struct mm_struct *mm,
3833
void ptdump_walk_pgd_level_checkwx(void);
3934
void ptdump_walk_user_pgd_level_checkwx(void);
4035

36+
/*
37+
* Macros to add or remove encryption attribute
38+
*/
39+
#define pgprot_encrypted(prot) __pgprot(cc_mkenc(pgprot_val(prot)))
40+
#define pgprot_decrypted(prot) __pgprot(cc_mkdec(pgprot_val(prot)))
41+
4142
#ifdef CONFIG_DEBUG_WX
4243
#define debug_checkwx() ptdump_walk_pgd_level_checkwx()
4344
#define debug_checkwx_user() ptdump_walk_user_pgd_level_checkwx()

‎arch/x86/include/asm/set_memory.h‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,6 @@ int set_pages_rw(struct page *page, int numpages);
8484
int set_direct_map_invalid_noflush(struct page *page);
8585
int set_direct_map_default_noflush(struct page *page);
8686
bool kernel_page_present(struct page *page);
87-
void notify_range_enc_status_changed(unsigned long vaddr, int npages, bool enc);
8887

8988
extern int kernel_set_to_readonly;
9089

‎arch/x86/include/asm/x86_init.h‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -141,6 +141,21 @@ struct x86_init_acpi {
141141
void (*reduced_hw_early_init)(void);
142142
};
143143

144+
/**
145+
* struct x86_guest - Functions used by misc guest incarnations like SEV, TDX, etc.
146+
*
147+
* @enc_status_change_prepare Notify HV before the encryption status of a range is changed
148+
* @enc_status_change_finish Notify HV after the encryption status of a range is changed
149+
* @enc_tlb_flush_required Returns true if a TLB flush is needed before changing page encryption status
150+
* @enc_cache_flush_required Returns true if a cache flush is needed before changing page encryption status
151+
*/
152+
struct x86_guest {
153+
void (*enc_status_change_prepare)(unsigned long vaddr, int npages, bool enc);
154+
bool (*enc_status_change_finish)(unsigned long vaddr, int npages, bool enc);
155+
bool (*enc_tlb_flush_required)(bool enc);
156+
bool (*enc_cache_flush_required)(void);
157+
};
158+
144159
/**
145160
* struct x86_init_ops - functions for platform specific setup
146161
*
@@ -287,6 +302,7 @@ struct x86_platform_ops {
287302
struct x86_legacy_features legacy;
288303
void (*set_legacy_features)(void);
289304
struct x86_hyper_runtime hyper;
305+
struct x86_guest guest;
290306
};
291307

292308
struct x86_apic_ops {

‎arch/x86/kernel/Makefile‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@ CFLAGS_REMOVE_ftrace.o = -pg
2121
CFLAGS_REMOVE_early_printk.o = -pg
2222
CFLAGS_REMOVE_head64.o = -pg
2323
CFLAGS_REMOVE_sev.o = -pg
24-
CFLAGS_REMOVE_cc_platform.o = -pg
2524
endif
2625

2726
KASAN_SANITIZE_head$(BITS).o := n
@@ -30,7 +29,6 @@ KASAN_SANITIZE_dumpstack_$(BITS).o := n
3029
KASAN_SANITIZE_stacktrace.o := n
3130
KASAN_SANITIZE_paravirt.o := n
3231
KASAN_SANITIZE_sev.o := n
33-
KASAN_SANITIZE_cc_platform.o := n
3432

3533
# With some compiler versions the generated code results in boot hangs, caused
3634
# by several compilation units. To be safe, disable all instrumentation.
@@ -49,7 +47,6 @@ endif
4947
KCOV_INSTRUMENT := n
5048

5149
CFLAGS_head$(BITS).o += -fno-stack-protector
52-
CFLAGS_cc_platform.o += -fno-stack-protector
5350

5451
CFLAGS_irq.o := -I $(srctree)/$(src)/../include/asm/trace
5552

@@ -151,8 +148,6 @@ obj-$(CONFIG_UNWINDER_GUESS) += unwind_guess.o
151148

152149
obj-$(CONFIG_AMD_MEM_ENCRYPT) += sev.o
153150

154-
obj-$(CONFIG_ARCH_HAS_CC_PLATFORM) += cc_platform.o
155-
156151
###
157152
# 64 bit specific files
158153
ifeq ($(CONFIG_X86_64),y)

‎arch/x86/kernel/cpu/mshyperv.c‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333
#include <asm/nmi.h>
3434
#include <clocksource/hyperv_timer.h>
3535
#include <asm/numa.h>
36+
#include <asm/coco.h>
3637

3738
/* Is Linux running as the root partition? */
3839
bool hv_root_partition;
@@ -344,6 +345,11 @@ static void __init ms_hyperv_init_platform(void)
344345
*/
345346
swiotlb_force = SWIOTLB_FORCE;
346347
#endif
348+
/* Isolation VMs are unenlightened SEV-based VMs, thus this check: */
349+
if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) {
350+
if (hv_get_isolation_type() != HV_ISOLATION_TYPE_NONE)
351+
cc_set_vendor(CC_VENDOR_HYPERV);
352+
}
347353
}
348354

349355
if (hv_max_functions_eax >= HYPERV_CPUID_NESTED_FEATURES) {

‎arch/x86/kernel/x86_init.c‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,11 @@ struct x86_cpuinit_ops x86_cpuinit = {
129129

130130
static void default_nmi_init(void) { };
131131

132+
static void enc_status_change_prepare_noop(unsigned long vaddr, int npages, bool enc) { }
133+
static bool enc_status_change_finish_noop(unsigned long vaddr, int npages, bool enc) { return false; }
134+
static bool enc_tlb_flush_required_noop(bool enc) { return false; }
135+
static bool enc_cache_flush_required_noop(void) { return false; }
136+
132137
struct x86_platform_ops x86_platform __ro_after_init = {
133138
.calibrate_cpu = native_calibrate_cpu_early,
134139
.calibrate_tsc = native_calibrate_tsc,
@@ -138,9 +143,16 @@ struct x86_platform_ops x86_platform __ro_after_init = {
138143
.is_untracked_pat_range = is_ISA_range,
139144
.nmi_init = default_nmi_init,
140145
.get_nmi_reason = default_get_nmi_reason,
141-
.save_sched_clock_state = tsc_save_sched_clock_state,
142-
.restore_sched_clock_state = tsc_restore_sched_clock_state,
146+
.save_sched_clock_state = tsc_save_sched_clock_state,
147+
.restore_sched_clock_state = tsc_restore_sched_clock_state,
143148
.hyper.pin_vcpu = x86_op_int_noop,
149+
150+
.guest = {
151+
.enc_status_change_prepare = enc_status_change_prepare_noop,
152+
.enc_status_change_finish = enc_status_change_finish_noop,
153+
.enc_tlb_flush_required = enc_tlb_flush_required_noop,
154+
.enc_cache_flush_required = enc_cache_flush_required_noop,
155+
},
144156
};
145157

146158
EXPORT_SYMBOL_GPL(x86_platform);

0 commit comments

Comments
 (0)