| Message ID | 482fe51f1671c1cd081039801b03db7ec0036332.1628873970.git.thomas.lendacky@amd.com (mailing list archive) |
|---|---|
| State | Deferred, archived |
| Headers | show |
| Series | Implement generic prot_guest_has() helper function | expand |
On 8/13/21 9:59 AM, Tom Lendacky wrote: > In prep for other protected virtualization technologies, introduce a > generic helper function, prot_guest_has(), that can be used to check > for specific protection attributes, like memory encryption. This is > intended to eliminate having to add multiple technology-specific checks > to the code (e.g. if (sev_active() || tdx_active())). > > Reviewed-by: Joerg Roedel<jroedel@suse.de> > Co-developed-by: Andi Kleen<ak@linux.intel.com> > Signed-off-by: Andi Kleen<ak@linux.intel.com> > Co-developed-by: Kuppuswamy Sathyanarayanan<sathyanarayanan.kuppuswamy@linux.intel.com> > Signed-off-by: Kuppuswamy Sathyanarayanan<sathyanarayanan.kuppuswamy@linux.intel.com> > Signed-off-by: Tom Lendacky<thomas.lendacky@amd.com> > --- > arch/Kconfig | 3 +++ > include/linux/protected_guest.h | 35 +++++++++++++++++++++++++++++++++ > 2 files changed, 38 insertions(+) > create mode 100644 include/linux/protected_guest.h Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
On Fri, Aug 13, 2021 at 11:59:21AM -0500, Tom Lendacky wrote: > In prep for other protected virtualization technologies, introduce a > generic helper function, prot_guest_has(), that can be used to check > for specific protection attributes, like memory encryption. This is > intended to eliminate having to add multiple technology-specific checks > to the code (e.g. if (sev_active() || tdx_active())). > > Reviewed-by: Joerg Roedel <jroedel@suse.de> > Co-developed-by: Andi Kleen <ak@linux.intel.com> > Signed-off-by: Andi Kleen <ak@linux.intel.com> > Co-developed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com> > Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com> > Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> > --- > arch/Kconfig | 3 +++ > include/linux/protected_guest.h | 35 +++++++++++++++++++++++++++++++++ > 2 files changed, 38 insertions(+) > create mode 100644 include/linux/protected_guest.h > > diff --git a/arch/Kconfig b/arch/Kconfig > index 98db63496bab..bd4f60c581f1 100644 > --- a/arch/Kconfig > +++ b/arch/Kconfig > @@ -1231,6 +1231,9 @@ config RELR > config ARCH_HAS_MEM_ENCRYPT > bool > > +config ARCH_HAS_PROTECTED_GUEST > + bool > + > config HAVE_SPARSE_SYSCALL_NR > bool > help > diff --git a/include/linux/protected_guest.h b/include/linux/protected_guest.h > new file mode 100644 > index 000000000000..43d4dde94793 > --- /dev/null > +++ b/include/linux/protected_guest.h > @@ -0,0 +1,35 @@ > +/* SPDX-License-Identifier: GPL-2.0-only */ > +/* > + * Protected Guest (and Host) Capability checks > + * > + * Copyright (C) 2021 Advanced Micro Devices, Inc. > + * > + * Author: Tom Lendacky <thomas.lendacky@amd.com> > + */ > + > +#ifndef _PROTECTED_GUEST_H > +#define _PROTECTED_GUEST_H > + > +#ifndef __ASSEMBLY__ ^^^^^^^^^^^^^ Do you really need that guard? It builds fine without it too. Or something coming later does need it...?
On 8/14/21 1:32 PM, Borislav Petkov wrote: > On Fri, Aug 13, 2021 at 11:59:21AM -0500, Tom Lendacky wrote: >> diff --git a/include/linux/protected_guest.h b/include/linux/protected_guest.h >> new file mode 100644 >> index 000000000000..43d4dde94793 >> --- /dev/null >> +++ b/include/linux/protected_guest.h >> @@ -0,0 +1,35 @@ >> +/* SPDX-License-Identifier: GPL-2.0-only */ >> +/* >> + * Protected Guest (and Host) Capability checks >> + * >> + * Copyright (C) 2021 Advanced Micro Devices, Inc. >> + * >> + * Author: Tom Lendacky <thomas.lendacky@amd.com> >> + */ >> + >> +#ifndef _PROTECTED_GUEST_H >> +#define _PROTECTED_GUEST_H >> + >> +#ifndef __ASSEMBLY__ > ^^^^^^^^^^^^^ > > Do you really need that guard? It builds fine without it too. Or > something coming later does need it...? No, I probably did it out of habit. I can remove it in the next version. Thanks, Tom >
On Fri, Aug 13, 2021 at 11:59:21AM -0500, Tom Lendacky wrote: > +#define PATTR_MEM_ENCRYPT 0 /* Encrypted memory */ > +#define PATTR_HOST_MEM_ENCRYPT 1 /* Host encrypted memory */ > +#define PATTR_GUEST_MEM_ENCRYPT 2 /* Guest encrypted memory */ > +#define PATTR_GUEST_PROT_STATE 3 /* Guest encrypted state */ Please write an actual detailed explanaton of what these mean, that is what implications it has on the kernel.
On 8/19/21 4:46 AM, Christoph Hellwig wrote: > On Fri, Aug 13, 2021 at 11:59:21AM -0500, Tom Lendacky wrote: >> +#define PATTR_MEM_ENCRYPT 0 /* Encrypted memory */ >> +#define PATTR_HOST_MEM_ENCRYPT 1 /* Host encrypted memory */ >> +#define PATTR_GUEST_MEM_ENCRYPT 2 /* Guest encrypted memory */ >> +#define PATTR_GUEST_PROT_STATE 3 /* Guest encrypted state */ > > Please write an actual detailed explanaton of what these mean, that > is what implications it has on the kernel. Will do. Thanks, Tom >
diff --git a/arch/Kconfig b/arch/Kconfig index 98db63496bab..bd4f60c581f1 100644 --- a/arch/Kconfig +++ b/arch/Kconfig @@ -1231,6 +1231,9 @@ config RELR config ARCH_HAS_MEM_ENCRYPT bool +config ARCH_HAS_PROTECTED_GUEST + bool + config HAVE_SPARSE_SYSCALL_NR bool help diff --git a/include/linux/protected_guest.h b/include/linux/protected_guest.h new file mode 100644 index 000000000000..43d4dde94793 --- /dev/null +++ b/include/linux/protected_guest.h @@ -0,0 +1,35 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* + * Protected Guest (and Host) Capability checks + * + * Copyright (C) 2021 Advanced Micro Devices, Inc. + * + * Author: Tom Lendacky <thomas.lendacky@amd.com> + */ + +#ifndef _PROTECTED_GUEST_H +#define _PROTECTED_GUEST_H + +#ifndef __ASSEMBLY__ + +#include <linux/types.h> +#include <linux/stddef.h> + +#define PATTR_MEM_ENCRYPT 0 /* Encrypted memory */ +#define PATTR_HOST_MEM_ENCRYPT 1 /* Host encrypted memory */ +#define PATTR_GUEST_MEM_ENCRYPT 2 /* Guest encrypted memory */ +#define PATTR_GUEST_PROT_STATE 3 /* Guest encrypted state */ + +#ifdef CONFIG_ARCH_HAS_PROTECTED_GUEST + +#include <asm/protected_guest.h> + +#else /* !CONFIG_ARCH_HAS_PROTECTED_GUEST */ + +static inline bool prot_guest_has(unsigned int attr) { return false; } + +#endif /* CONFIG_ARCH_HAS_PROTECTED_GUEST */ + +#endif /* __ASSEMBLY__ */ + +#endif /* _PROTECTED_GUEST_H */