linux-kernel - [RFC 3/3] x86: Expose SEV-ES capabilities in sysfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Wed,  9 Mar 2022 17:06:08 -0500
From:   Alejandro Jimenez <alejandro.j.jimenez@...cle.com>
To:     tglx@...utronix.de, mingo@...hat.com, bp@...en8.de,
        dave.hansen@...ux.intel.com, luto@...nel.org, peterz@...radead.org,
        x86@...nel.org, linux-kernel@...r.kernel.org
Cc:     thomas.lendacky@....com, brijesh.singh@....com,
        kirill.shutemov@...ux.intel.com, hpa@...or.com,
        pbonzini@...hat.com, seanjc@...gle.com, srutherford@...gle.com,
        ashish.kalra@....com, darren.kenny@...cle.com,
        venu.busireddy@...cle.com, boris.ostrovsky@...cle.com,
        alejandro.j.jimenez@...cle.com
Subject: [RFC 3/3] x86: Expose SEV-ES capabilities in sysfs

Expose the state of the SEV-ES feature via the new sysfs interface.
Document the new ABI.

Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@...cle.com>
Reviewed-by: Darren Kenny <darren.kenny@...cle.com>
---
 .../ABI/testing/sysfs-kernel-mm-mem-encrypt   | 28 ++++++++++++-
 arch/x86/mm/mem_encrypt_amd.c                 | 40 ++++++++++++++++++-
 2 files changed, 66 insertions(+), 2 deletions(-)

diff --git a/Documentation/ABI/testing/sysfs-kernel-mm-mem-encrypt b/Documentation/ABI/testing/sysfs-kernel-mm-mem-encrypt
index 68a932d4540b..ecd491c0a7bd 100644
--- a/Documentation/ABI/testing/sysfs-kernel-mm-mem-encrypt
+++ b/Documentation/ABI/testing/sysfs-kernel-mm-mem-encrypt
@@ -49,7 +49,7 @@ Description:	Expose status of sev feature. Valid values are:
 
 		inactive (Guest only): Running in unencrypted virtual machine.
 
-What:		/sys/kernel/mm/mem_encrypt/sev/nr_asid_available
+What:		/sys/kernel/mm/mem_encrypt/{sev,sev_es}/nr_asid_available
 Date:		March 2022
 KernelVersion:	5.17
 Description:	(Host only) Total number of ASIDs available for encrypted
@@ -60,3 +60,29 @@ Date:		March 2022
 KernelVersion:	5.17
 Description:	(Host only) Number of ASIDs available for SEV guests with
 		SEV-ES disabled.
+
+What:		/sys/kernel/mm/mem_encrypt/sev_es/status
+Date:		March 2022
+KernelVersion:	5.17
+Description:	Expose status of sev_es feature. Valid values are:
+
+		unsupported: Secure Encrypted Virtualization with Encrypted
+		State is not supported by the processor.
+
+		enabled (Host only): Hypervisor host capable of running SEV
+		guests.
+
+		disabled (Host only): Memory encryption has been disabled by
+		System-Configuration Register (SYSCFG) MemEncryptionModeEn bit.
+
+		active (Guest only): Running in virtual machine with encrypted
+		code, data, and guest register state.
+
+		inactive (Guest only): Running in virtual machine with
+		unencrypted register state.
+
+What:		/sys/kernel/mm/mem_encrypt/sev_es/nr_sev_es_asid
+Date:		March 2022
+KernelVersion:	5.17
+Description:	(Host only) Number of ASIDs available for SEV guests with SEV-
+		ES enabled.
diff --git a/arch/x86/mm/mem_encrypt_amd.c b/arch/x86/mm/mem_encrypt_amd.c
index 86979e0e26c7..bafc34bf6121 100644
--- a/arch/x86/mm/mem_encrypt_amd.c
+++ b/arch/x86/mm/mem_encrypt_amd.c
@@ -39,6 +39,7 @@
 
 #define AMD_SME_BIT			BIT(0)
 #define AMD_SEV_BIT			BIT(1)
+#define AMD_SEV_ES_BIT			BIT(3)
 
 #define CC_ATTR_RO(_name) \
 	static struct kobj_attribute _name##_attr = __ATTR_RO(_name)
@@ -98,7 +99,8 @@ static void encrypted_mem_caps_init(void)
 	cpuid(AMD_CPUID_ENCRYPTED_MEM, &eax, &ebx, &ecx, &edx);
 
 	cbit_pos = ebx & 0x3f;
-	sec_encrypt_support_mask = eax & (AMD_SME_BIT | AMD_SEV_BIT);
+	sec_encrypt_support_mask = eax &
+		(AMD_SME_BIT | AMD_SEV_BIT | AMD_SEV_ES_BIT);
 
 	max_sev_asid = ecx;
 	min_sev_asid = edx;
@@ -174,6 +176,10 @@ static ssize_t status_show(struct kobject *kobj,
 	} else if (!strcmp(kobj->name, "sev")) {
 		return sev_status_show(AMD_SEV_BIT, X86_FEATURE_SEV,
 					CC_ATTR_GUEST_MEM_ENCRYPT, buf);
+
+	} else if (!strcmp(kobj->name, "sev_es")) {
+		return sev_status_show(AMD_SEV_ES_BIT, X86_FEATURE_SEV_ES,
+					CC_ATTR_GUEST_STATE_ENCRYPT, buf);
 	}
 
 	/*
@@ -210,6 +216,18 @@ static ssize_t nr_sev_asid_show(struct kobject *kobj,
 }
 CC_ATTR_RO(nr_sev_asid);
 
+static ssize_t nr_sev_es_asid_show(struct kobject *kobj,
+					struct kobj_attribute *attr, char *buf)
+{
+	unsigned int nr_sev_es_asid = 0;
+
+	if (min_sev_asid)
+		nr_sev_es_asid = min_sev_asid - 1;
+
+	return sysfs_emit(buf, "%u\n", nr_sev_es_asid);
+}
+CC_ATTR_RO(nr_sev_es_asid);
+
 static struct attribute *sme_attrs[] = {
 	&status_attr.attr,
 	NULL,
@@ -236,16 +254,36 @@ static const struct attribute_group sev_guest_attr_group = {
 	.attrs = sev_guest_attrs,
 };
 
+static struct attribute *sev_es_host_attrs[] = {
+	&status_attr.attr,
+	&nr_asid_available_attr.attr,
+	&nr_sev_es_asid_attr.attr,
+	NULL,
+};
+static const struct attribute_group sev_es_host_attr_group = {
+	.attrs = sev_es_host_attrs,
+};
+
+static struct attribute *sev_es_guest_attrs[] = {
+	&status_attr.attr,
+	NULL,
+};
+static const struct attribute_group sev_es_guest_attr_group = {
+	.attrs = sev_es_guest_attrs,
+};
+
 /* List of features to be exposed when running as hypervisor host */
 static struct amd_cc_feature host_cc_feat_list[] = {
 	AMD_CC_FEATURE("sme", sme_attr_group, NULL),
 	AMD_CC_FEATURE("sev", sev_host_attr_group, NULL),
+	AMD_CC_FEATURE("sev_es", sev_es_host_attr_group, NULL),
 	{},
 };
 
 /* List of features to be exposed when running as guest */
 static struct amd_cc_feature guest_cc_feat_list[] = {
 	AMD_CC_FEATURE("sev", sev_guest_attr_group, NULL),
+	AMD_CC_FEATURE("sev_es", sev_es_guest_attr_group, NULL),
 	{},
 };
 
-- 
2.34.1