mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2025-12-22 12:17:45 +01:00
30c2b98aa8
The Secure AVIC feature provides SEV-SNP guests hardware acceleration for performance sensitive APIC accesses while securely managing the guest-owned APIC state through the use of a private APIC backing page. This helps prevent the hypervisor from generating unexpected interrupts for a vCPU or otherwise violate architectural assumptions around the APIC behavior. Add a new x2APIC driver that will serve as the base of the Secure AVIC support. It is initially the same as the x2APIC physical driver (without IPI callbacks), but will be modified as features are implemented. As the new driver does not implement Secure AVIC features yet, if the hypervisor sets the Secure AVIC bit in SEV_STATUS, maintain the existing behavior to enforce the guest termination. [ bp: Massage commit message. ] Co-developed-by: Kishon Vijay Abraham I <kvijayab@amd.com> Signed-off-by: Kishon Vijay Abraham I <kvijayab@amd.com> Signed-off-by: Neeraj Upadhyay <Neeraj.Upadhyay@amd.com> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Reviewed-by: Tianyu Lan <tiala@microsoft.com> Link: https://lore.kernel.org/20250828070334.208401-2-Neeraj.Upadhyay@amd.com
136 lines
3.6 KiB
C
136 lines
3.6 KiB
C
/* SPDX-License-Identifier: GPL-2.0-only */
|
|
/*
|
|
* Confidential Computing Platform Capability checks
|
|
*
|
|
* Copyright (C) 2021 Advanced Micro Devices, Inc.
|
|
*
|
|
* Author: Tom Lendacky <thomas.lendacky@amd.com>
|
|
*/
|
|
|
|
#ifndef _LINUX_CC_PLATFORM_H
|
|
#define _LINUX_CC_PLATFORM_H
|
|
|
|
#include <linux/types.h>
|
|
#include <linux/stddef.h>
|
|
|
|
/**
|
|
* enum cc_attr - Confidential computing attributes
|
|
*
|
|
* These attributes represent confidential computing features that are
|
|
* currently active.
|
|
*/
|
|
enum cc_attr {
|
|
/**
|
|
* @CC_ATTR_MEM_ENCRYPT: Memory encryption is active
|
|
*
|
|
* The platform/OS is running with active memory encryption. This
|
|
* includes running either as a bare-metal system or a hypervisor
|
|
* and actively using memory encryption or as a guest/virtual machine
|
|
* and actively using memory encryption.
|
|
*
|
|
* Examples include SME, SEV and SEV-ES.
|
|
*/
|
|
CC_ATTR_MEM_ENCRYPT,
|
|
|
|
/**
|
|
* @CC_ATTR_HOST_MEM_ENCRYPT: Host memory encryption is active
|
|
*
|
|
* The platform/OS is running as a bare-metal system or a hypervisor
|
|
* and actively using memory encryption.
|
|
*
|
|
* Examples include SME.
|
|
*/
|
|
CC_ATTR_HOST_MEM_ENCRYPT,
|
|
|
|
/**
|
|
* @CC_ATTR_GUEST_MEM_ENCRYPT: Guest memory encryption is active
|
|
*
|
|
* The platform/OS is running as a guest/virtual machine and actively
|
|
* using memory encryption.
|
|
*
|
|
* Examples include SEV and SEV-ES.
|
|
*/
|
|
CC_ATTR_GUEST_MEM_ENCRYPT,
|
|
|
|
/**
|
|
* @CC_ATTR_GUEST_STATE_ENCRYPT: Guest state encryption is active
|
|
*
|
|
* The platform/OS is running as a guest/virtual machine and actively
|
|
* using memory encryption and register state encryption.
|
|
*
|
|
* Examples include SEV-ES.
|
|
*/
|
|
CC_ATTR_GUEST_STATE_ENCRYPT,
|
|
|
|
/**
|
|
* @CC_ATTR_GUEST_UNROLL_STRING_IO: String I/O is implemented with
|
|
* IN/OUT instructions
|
|
*
|
|
* The platform/OS is running as a guest/virtual machine and uses
|
|
* IN/OUT instructions in place of string I/O.
|
|
*
|
|
* Examples include TDX guest & SEV.
|
|
*/
|
|
CC_ATTR_GUEST_UNROLL_STRING_IO,
|
|
|
|
/**
|
|
* @CC_ATTR_SEV_SNP: Guest SNP is active.
|
|
*
|
|
* The platform/OS is running as a guest/virtual machine and actively
|
|
* using AMD SEV-SNP features.
|
|
*/
|
|
CC_ATTR_GUEST_SEV_SNP,
|
|
|
|
/**
|
|
* @CC_ATTR_GUEST_SNP_SECURE_TSC: SNP Secure TSC is active.
|
|
*
|
|
* The platform/OS is running as a guest/virtual machine and actively
|
|
* using AMD SEV-SNP Secure TSC feature.
|
|
*/
|
|
CC_ATTR_GUEST_SNP_SECURE_TSC,
|
|
|
|
/**
|
|
* @CC_ATTR_HOST_SEV_SNP: AMD SNP enabled on the host.
|
|
*
|
|
* The host kernel is running with the necessary features
|
|
* enabled to run SEV-SNP guests.
|
|
*/
|
|
CC_ATTR_HOST_SEV_SNP,
|
|
|
|
/**
|
|
* @CC_ATTR_SNP_SECURE_AVIC: Secure AVIC mode is active.
|
|
*
|
|
* The host kernel is running with the necessary features enabled
|
|
* to run SEV-SNP guests with full Secure AVIC capabilities.
|
|
*/
|
|
CC_ATTR_SNP_SECURE_AVIC,
|
|
};
|
|
|
|
#ifdef CONFIG_ARCH_HAS_CC_PLATFORM
|
|
|
|
/**
|
|
* cc_platform_has() - Checks if the specified cc_attr attribute is active
|
|
* @attr: Confidential computing attribute to check
|
|
*
|
|
* The cc_platform_has() function will return an indicator as to whether the
|
|
* specified Confidential Computing attribute is currently active.
|
|
*
|
|
* Context: Any context
|
|
* Return:
|
|
* * TRUE - Specified Confidential Computing attribute is active
|
|
* * FALSE - Specified Confidential Computing attribute is not active
|
|
*/
|
|
bool cc_platform_has(enum cc_attr attr);
|
|
void cc_platform_set(enum cc_attr attr);
|
|
void cc_platform_clear(enum cc_attr attr);
|
|
|
|
#else /* !CONFIG_ARCH_HAS_CC_PLATFORM */
|
|
|
|
static inline bool cc_platform_has(enum cc_attr attr) { return false; }
|
|
static inline void cc_platform_set(enum cc_attr attr) { }
|
|
static inline void cc_platform_clear(enum cc_attr attr) { }
|
|
|
|
#endif /* CONFIG_ARCH_HAS_CC_PLATFORM */
|
|
|
|
#endif /* _LINUX_CC_PLATFORM_H */
|