On Mon, Oct 16, 2023 at 08:27:53AM -0500, Michael Roth wrote:
> From: Brijesh Singh <brijesh.singh@xxxxxxx>
>
> The next generation of SEV is called SEV-SNP (Secure Nested Paging).
> SEV-SNP builds upon existing SEV and SEV-ES functionality while adding new
> hardware based security protection. SEV-SNP adds strong memory encryption
> integrity protection to help prevent malicious hypervisor-based attacks
> such as data replay, memory re-mapping, and more, to create an isolated
> execution environment.
>
> The SNP feature is added incrementally, the later patches adds a new module
> parameters that can be used to enabled SEV-SNP in the KVM.
This sentence can simply go to /dev/null.
> Signed-off-by: Brijesh Singh <brijesh.singh@xxxxxxx>
> Signed-off-by: Ashish Kalra <ashish.kalra@xxxxxxx>
> ---
> arch/x86/kvm/svm/sev.c | 10 ++++++++++
> arch/x86/kvm/svm/svm.h | 8 ++++++++
> 2 files changed, 18 insertions(+)
>
> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> index 1cfb9232fc74..4eefc168ebb3 100644
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
> @@ -59,10 +59,14 @@ module_param_named(sev_es, sev_es_enabled, bool, 0444);
> /* enable/disable SEV-ES DebugSwap support */
> static bool sev_es_debug_swap_enabled = true;
> module_param_named(debug_swap, sev_es_debug_swap_enabled, bool, 0444);
> +
> +/* enable/disable SEV-SNP support */
Useless comment.
> +static bool sev_snp_enabled;
> #else
> #define sev_enabled false
> #define sev_es_enabled false
> #define sev_es_debug_swap_enabled false
> +#define sev_snp_enabled false
> #endif /* CONFIG_KVM_AMD_SEV */
>
> #define AP_RESET_HOLD_NONE 0
> @@ -2186,6 +2190,7 @@ void __init sev_hardware_setup(void)
> {
> #ifdef CONFIG_KVM_AMD_SEV
> unsigned int eax, ebx, ecx, edx, sev_asid_count, sev_es_asid_count;
> + bool sev_snp_supported = false;
> bool sev_es_supported = false;
> bool sev_supported = false;
>
> @@ -2261,6 +2266,10 @@ void __init sev_hardware_setup(void)
> sev_es_asid_count = min_sev_asid - 1;
> WARN_ON_ONCE(misc_cg_set_capacity(MISC_CG_RES_SEV_ES, sev_es_asid_count));
> sev_es_supported = true;
> + sev_snp_supported = sev_snp_enabled && cpu_feature_enabled(X86_FEATURE_SEV_SNP);
> +
> + pr_info("SEV-ES %ssupported: %u ASIDs\n",
> + sev_snp_supported ? "and SEV-SNP " : "", sev_es_asid_count);
Why like this?
>
> out:
Here, below the "out:" label you're already dumping SEV and -ES status.
Just do SNP exactly the same.
> if (boot_cpu_has(X86_FEATURE_SEV))
> @@ -2277,6 +2286,7 @@ void __init sev_hardware_setup(void)
> if (!sev_es_enabled || !cpu_feature_enabled(X86_FEATURE_DEBUG_SWAP) ||
> !cpu_feature_enabled(X86_FEATURE_NO_NESTED_DATA_BP))
> sev_es_debug_swap_enabled = false;
> + sev_snp_enabled = sev_snp_supported;
> #endif
> }
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette
