diff options
| author | Joerg Roedel <jroedel@suse.de> | 2020-09-07 15:15:37 +0200 |
|---|---|---|
| committer | Borislav Petkov <bp@suse.de> | 2020-09-07 23:00:20 +0200 |
| commit | b57de6cd16395be1ebdaa9b489ffbf462bb585c4 (patch) | |
| tree | 24169b5dddc82ac87771fec6d1b9f6818fc92879 /arch/x86/mm | |
| parent | 4b47cdbda6f1ad73b08dc7d497bac12b8f26ae0d (diff) | |
| download | lwn-b57de6cd16395be1ebdaa9b489ffbf462bb585c4.tar.gz lwn-b57de6cd16395be1ebdaa9b489ffbf462bb585c4.zip | |
x86/sev-es: Add SEV-ES Feature Detection
Add a sev_es_active() function for checking whether SEV-ES is enabled.
Also cache the value of MSR_AMD64_SEV at boot to speed up the feature
checking in the running code.
[ bp: Remove "!!" in sev_active() too. ]
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Kees Cook <keescook@chromium.org>
Link: https://lkml.kernel.org/r/20200907131613.12703-37-joro@8bytes.org
Diffstat (limited to 'arch/x86/mm')
| -rw-r--r-- | arch/x86/mm/mem_encrypt.c | 9 | ||||
| -rw-r--r-- | arch/x86/mm/mem_encrypt_identity.c | 3 |
2 files changed, 11 insertions, 1 deletions
diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c index 9f1177edc2e7..a38f55676bb7 100644 --- a/arch/x86/mm/mem_encrypt.c +++ b/arch/x86/mm/mem_encrypt.c @@ -38,6 +38,7 @@ * section is later cleared. */ u64 sme_me_mask __section(.data) = 0; +u64 sev_status __section(.data) = 0; EXPORT_SYMBOL(sme_me_mask); DEFINE_STATIC_KEY_FALSE(sev_enable_key); EXPORT_SYMBOL_GPL(sev_enable_key); @@ -347,7 +348,13 @@ bool sme_active(void) bool sev_active(void) { - return sme_me_mask && sev_enabled; + return sev_status & MSR_AMD64_SEV_ENABLED; +} + +/* Needs to be called from non-instrumentable code */ +bool noinstr sev_es_active(void) +{ + return sev_status & MSR_AMD64_SEV_ES_ENABLED; } /* Override for DMA direct allocation check - ARCH_HAS_FORCE_DMA_UNENCRYPTED */ diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c index e2b0e2ac07bb..68d75379e06a 100644 --- a/arch/x86/mm/mem_encrypt_identity.c +++ b/arch/x86/mm/mem_encrypt_identity.c @@ -540,6 +540,9 @@ void __init sme_enable(struct boot_params *bp) if (!(msr & MSR_AMD64_SEV_ENABLED)) return; + /* Save SEV_STATUS to avoid reading MSR again */ + sev_status = msr; + /* SEV state cannot be controlled by a command line option */ sme_me_mask = me_mask; sev_enabled = true; |