| Message ID | cover.1631141919.git.thomas.lendacky@amd.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | Implement generic cc_platform_has() helper function | expand |
On 09.09.21 00:58, Tom Lendacky wrote: > This patch series provides a generic helper function, cc_platform_has(), > to replace the sme_active(), sev_active(), sev_es_active() and > mem_encrypt_active() functions. > > It is expected that as new confidential computing technologies are > added to the kernel, they can all be covered by a single function call > instead of a collection of specific function calls all called from the > same locations. > > The powerpc and s390 patches have been compile tested only. Can the > folks copied on this series verify that nothing breaks for them. Is there a tree somewhere? Also, > a new file, arch/powerpc/platforms/pseries/cc_platform.c, has been > created for powerpc to hold the out of line function. > > Cc: Andi Kleen <ak@linux.intel.com> > Cc: Andy Lutomirski <luto@kernel.org> > Cc: Ard Biesheuvel <ardb@kernel.org> > Cc: Baoquan He <bhe@redhat.com> > Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> > Cc: Borislav Petkov <bp@alien8.de> > Cc: Christian Borntraeger <borntraeger@de.ibm.com> > Cc: Daniel Vetter <daniel@ffwll.ch> > Cc: Dave Hansen <dave.hansen@linux.intel.com> > Cc: Dave Young <dyoung@redhat.com> > Cc: David Airlie <airlied@linux.ie> > Cc: Heiko Carstens <hca@linux.ibm.com> > Cc: Ingo Molnar <mingo@redhat.com> > Cc: Joerg Roedel <joro@8bytes.org> > Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> > Cc: Maxime Ripard <mripard@kernel.org> > Cc: Michael Ellerman <mpe@ellerman.id.au> > Cc: Paul Mackerras <paulus@samba.org> > Cc: Peter Zijlstra <peterz@infradead.org> > Cc: Thomas Gleixner <tglx@linutronix.de> > Cc: Thomas Zimmermann <tzimmermann@suse.de> > Cc: Vasily Gorbik <gor@linux.ibm.com> > Cc: VMware Graphics <linux-graphics-maintainer@vmware.com> > Cc: Will Deacon <will@kernel.org> > Cc: Christoph Hellwig <hch@infradead.org> > > --- > > Patches based on: > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master > 4b93c544e90e ("thunderbolt: test: split up test cases in tb_test_credit_alloc_all") > > Changes since v2: > - Changed the name from prot_guest_has() to cc_platform_has() > - Took the cc_platform_has() function out of line. Created two new files, > cc_platform.c, in both x86 and ppc to implment the function. As a > result, also changed the attribute defines into enums. > - Removed any received Reviewed-by's and Acked-by's given changes in this > version. > - Added removal of new instances of mem_encrypt_active() usage in powerpc > arch. > - Based on latest Linux tree to pick up powerpc changes related to the > mem_encrypt_active() function. > > Changes since v1: > - Moved some arch ioremap functions within #ifdef CONFIG_AMD_MEM_ENCRYPT > in prep for use of prot_guest_has() by TDX. > - Added type includes to the the protected_guest.h header file to prevent > build errors outside of x86. > - Made amd_prot_guest_has() EXPORT_SYMBOL_GPL > - Used amd_prot_guest_has() in place of checking sme_me_mask in the > arch/x86/mm/mem_encrypt.c file. > > Tom Lendacky (8): > x86/ioremap: Selectively build arch override encryption functions > mm: Introduce a function to check for confidential computing features > x86/sev: Add an x86 version of cc_platform_has() > powerpc/pseries/svm: Add a powerpc version of cc_platform_has() > x86/sme: Replace occurrences of sme_active() with cc_platform_has() > x86/sev: Replace occurrences of sev_active() with cc_platform_has() > x86/sev: Replace occurrences of sev_es_active() with cc_platform_has() > treewide: Replace the use of mem_encrypt_active() with > cc_platform_has() > > arch/Kconfig | 3 + > arch/powerpc/include/asm/mem_encrypt.h | 5 -- > arch/powerpc/platforms/pseries/Kconfig | 1 + > arch/powerpc/platforms/pseries/Makefile | 2 + > arch/powerpc/platforms/pseries/cc_platform.c | 26 ++++++ > arch/powerpc/platforms/pseries/svm.c | 5 +- > arch/s390/include/asm/mem_encrypt.h | 2 - > arch/x86/Kconfig | 1 + > arch/x86/include/asm/io.h | 8 ++ > arch/x86/include/asm/kexec.h | 2 +- > arch/x86/include/asm/mem_encrypt.h | 14 +--- > arch/x86/kernel/Makefile | 3 + > arch/x86/kernel/cc_platform.c | 21 +++++ > arch/x86/kernel/crash_dump_64.c | 4 +- > arch/x86/kernel/head64.c | 4 +- > arch/x86/kernel/kvm.c | 3 +- > arch/x86/kernel/kvmclock.c | 4 +- > arch/x86/kernel/machine_kexec_64.c | 19 +++-- > arch/x86/kernel/pci-swiotlb.c | 9 +- > arch/x86/kernel/relocate_kernel_64.S | 2 +- > arch/x86/kernel/sev.c | 6 +- > arch/x86/kvm/svm/svm.c | 3 +- > arch/x86/mm/ioremap.c | 18 ++-- > arch/x86/mm/mem_encrypt.c | 57 +++++++------ > arch/x86/mm/mem_encrypt_identity.c | 3 +- > arch/x86/mm/pat/set_memory.c | 3 +- > arch/x86/platform/efi/efi_64.c | 9 +- > arch/x86/realmode/init.c | 8 +- > drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 4 +- > drivers/gpu/drm/drm_cache.c | 4 +- > drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 4 +- > drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 6 +- > drivers/iommu/amd/init.c | 7 +- > drivers/iommu/amd/iommu.c | 3 +- > drivers/iommu/amd/iommu_v2.c | 3 +- > drivers/iommu/iommu.c | 3 +- > fs/proc/vmcore.c | 6 +- > include/linux/cc_platform.h | 88 ++++++++++++++++++++ > include/linux/mem_encrypt.h | 4 - > kernel/dma/swiotlb.c | 4 +- > 40 files changed, 267 insertions(+), 114 deletions(-) > create mode 100644 arch/powerpc/platforms/pseries/cc_platform.c > create mode 100644 arch/x86/kernel/cc_platform.c > create mode 100644 include/linux/cc_platform.h > > > base-commit: 4b93c544e90e2b28326182d31ee008eb80e02074 >
On 9/9/21 2:32 AM, Christian Borntraeger wrote: > > > On 09.09.21 00:58, Tom Lendacky wrote: >> This patch series provides a generic helper function, cc_platform_has(), >> to replace the sme_active(), sev_active(), sev_es_active() and >> mem_encrypt_active() functions. >> >> It is expected that as new confidential computing technologies are >> added to the kernel, they can all be covered by a single function call >> instead of a collection of specific function calls all called from the >> same locations. >> >> The powerpc and s390 patches have been compile tested only. Can the >> folks copied on this series verify that nothing breaks for them. > > Is there a tree somewhere? I pushed it up to github: https://github.com/AMDESE/linux/tree/prot-guest-has-v3 Thanks, Tom > > Also, >> a new file, arch/powerpc/platforms/pseries/cc_platform.c, has been >> created for powerpc to hold the out of line function. >> >> Cc: Andi Kleen <ak@linux.intel.com> >> Cc: Andy Lutomirski <luto@kernel.org> >> Cc: Ard Biesheuvel <ardb@kernel.org> >> Cc: Baoquan He <bhe@redhat.com> >> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> >> Cc: Borislav Petkov <bp@alien8.de> >> Cc: Christian Borntraeger <borntraeger@de.ibm.com> >> Cc: Daniel Vetter <daniel@ffwll.ch> >> Cc: Dave Hansen <dave.hansen@linux.intel.com> >> Cc: Dave Young <dyoung@redhat.com> >> Cc: David Airlie <airlied@linux.ie> >> Cc: Heiko Carstens <hca@linux.ibm.com> >> Cc: Ingo Molnar <mingo@redhat.com> >> Cc: Joerg Roedel <joro@8bytes.org> >> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> >> Cc: Maxime Ripard <mripard@kernel.org> >> Cc: Michael Ellerman <mpe@ellerman.id.au> >> Cc: Paul Mackerras <paulus@samba.org> >> Cc: Peter Zijlstra <peterz@infradead.org> >> Cc: Thomas Gleixner <tglx@linutronix.de> >> Cc: Thomas Zimmermann <tzimmermann@suse.de> >> Cc: Vasily Gorbik <gor@linux.ibm.com> >> Cc: VMware Graphics <linux-graphics-maintainer@vmware.com> >> Cc: Will Deacon <will@kernel.org> >> Cc: Christoph Hellwig <hch@infradead.org> >> >> --- >> >> Patches based on: >> >> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgit.kernel.org%2Fpub%2Fscm%2Flinux%2Fkernel%2Fgit%2Ftorvalds%2Flinux.git&data=04%7C01%7Cthomas.lendacky%40amd.com%7C5cd71ef2c2ce4b90060708d973640358%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637667695657121432%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=FVngrPSxCCRKutAaIMtU2Nk8WArFQB1dEE2wN7v8RgA%3D&reserved=0 >> master >> 4b93c544e90e ("thunderbolt: test: split up test cases in >> tb_test_credit_alloc_all") >> >> Changes since v2: >> - Changed the name from prot_guest_has() to cc_platform_has() >> - Took the cc_platform_has() function out of line. Created two new files, >> cc_platform.c, in both x86 and ppc to implment the function. As a >> result, also changed the attribute defines into enums. >> - Removed any received Reviewed-by's and Acked-by's given changes in this >> version. >> - Added removal of new instances of mem_encrypt_active() usage in powerpc >> arch. >> - Based on latest Linux tree to pick up powerpc changes related to the >> mem_encrypt_active() function. >> >> Changes since v1: >> - Moved some arch ioremap functions within #ifdef CONFIG_AMD_MEM_ENCRYPT >> in prep for use of prot_guest_has() by TDX. >> - Added type includes to the the protected_guest.h header file to prevent >> build errors outside of x86. >> - Made amd_prot_guest_has() EXPORT_SYMBOL_GPL >> - Used amd_prot_guest_has() in place of checking sme_me_mask in the >> arch/x86/mm/mem_encrypt.c file. >> >> Tom Lendacky (8): >> x86/ioremap: Selectively build arch override encryption functions >> mm: Introduce a function to check for confidential computing features >> x86/sev: Add an x86 version of cc_platform_has() >> powerpc/pseries/svm: Add a powerpc version of cc_platform_has() >> x86/sme: Replace occurrences of sme_active() with cc_platform_has() >> x86/sev: Replace occurrences of sev_active() with cc_platform_has() >> x86/sev: Replace occurrences of sev_es_active() with cc_platform_has() >> treewide: Replace the use of mem_encrypt_active() with >> cc_platform_has() >> >> arch/Kconfig | 3 + >> arch/powerpc/include/asm/mem_encrypt.h | 5 -- >> arch/powerpc/platforms/pseries/Kconfig | 1 + >> arch/powerpc/platforms/pseries/Makefile | 2 + >> arch/powerpc/platforms/pseries/cc_platform.c | 26 ++++++ >> arch/powerpc/platforms/pseries/svm.c | 5 +- >> arch/s390/include/asm/mem_encrypt.h | 2 - >> arch/x86/Kconfig | 1 + >> arch/x86/include/asm/io.h | 8 ++ >> arch/x86/include/asm/kexec.h | 2 +- >> arch/x86/include/asm/mem_encrypt.h | 14 +--- >> arch/x86/kernel/Makefile | 3 + >> arch/x86/kernel/cc_platform.c | 21 +++++ >> arch/x86/kernel/crash_dump_64.c | 4 +- >> arch/x86/kernel/head64.c | 4 +- >> arch/x86/kernel/kvm.c | 3 +- >> arch/x86/kernel/kvmclock.c | 4 +- >> arch/x86/kernel/machine_kexec_64.c | 19 +++-- >> arch/x86/kernel/pci-swiotlb.c | 9 +- >> arch/x86/kernel/relocate_kernel_64.S | 2 +- >> arch/x86/kernel/sev.c | 6 +- >> arch/x86/kvm/svm/svm.c | 3 +- >> arch/x86/mm/ioremap.c | 18 ++-- >> arch/x86/mm/mem_encrypt.c | 57 +++++++------ >> arch/x86/mm/mem_encrypt_identity.c | 3 +- >> arch/x86/mm/pat/set_memory.c | 3 +- >> arch/x86/platform/efi/efi_64.c | 9 +- >> arch/x86/realmode/init.c | 8 +- >> drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 4 +- >> drivers/gpu/drm/drm_cache.c | 4 +- >> drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 4 +- >> drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 6 +- >> drivers/iommu/amd/init.c | 7 +- >> drivers/iommu/amd/iommu.c | 3 +- >> drivers/iommu/amd/iommu_v2.c | 3 +- >> drivers/iommu/iommu.c | 3 +- >> fs/proc/vmcore.c | 6 +- >> include/linux/cc_platform.h | 88 ++++++++++++++++++++ >> include/linux/mem_encrypt.h | 4 - >> kernel/dma/swiotlb.c | 4 +- >> 40 files changed, 267 insertions(+), 114 deletions(-) >> create mode 100644 arch/powerpc/platforms/pseries/cc_platform.c >> create mode 100644 arch/x86/kernel/cc_platform.c >> create mode 100644 include/linux/cc_platform.h >> >> >> base-commit: 4b93c544e90e2b28326182d31ee008eb80e02074 >>
On Wed, Sep 08, 2021 at 05:58:31PM -0500, Tom Lendacky wrote: > This patch series provides a generic helper function, cc_platform_has(), > to replace the sme_active(), sev_active(), sev_es_active() and > mem_encrypt_active() functions. > > It is expected that as new confidential computing technologies are > added to the kernel, they can all be covered by a single function call > instead of a collection of specific function calls all called from the > same locations. > > The powerpc and s390 patches have been compile tested only. Can the > folks copied on this series verify that nothing breaks for them. Also, > a new file, arch/powerpc/platforms/pseries/cc_platform.c, has been > created for powerpc to hold the out of line function. ... > > Tom Lendacky (8): > x86/ioremap: Selectively build arch override encryption functions > mm: Introduce a function to check for confidential computing features > x86/sev: Add an x86 version of cc_platform_has() > powerpc/pseries/svm: Add a powerpc version of cc_platform_has() > x86/sme: Replace occurrences of sme_active() with cc_platform_has() > x86/sev: Replace occurrences of sev_active() with cc_platform_has() > x86/sev: Replace occurrences of sev_es_active() with cc_platform_has() > treewide: Replace the use of mem_encrypt_active() with > cc_platform_has() Ok, modulo the minor things the plan is to take this through tip after -rc2 releases in order to pick up the powerpc build fix and have a clean base (-rc2) to base stuff on, at the same time. Pls holler if something's still amiss. Sathya, if you want to prepare the Intel variant intel_cc_platform_has() ontop of those and send it to me, that would be good because then I can integrate it all in one branch which can be used to base future work ontop. Thx.
On 9/15/21 9:46 AM, Borislav Petkov wrote: > Sathya, > > if you want to prepare the Intel variant intel_cc_platform_has() ontop > of those and send it to me, that would be good because then I can > integrate it all in one branch which can be used to base future work > ontop. I have a Intel variant patch (please check following patch). But it includes TDX changes as well. Shall I move TDX changes to different patch and just create a separate patch for adding intel_cc_platform_has()? commit fc5f98a0ed94629d903827c5b44ee9295f835831 Author: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com> Date: Wed May 12 11:35:13 2021 -0700 x86/tdx: Add confidential guest support for TDX guest TDX architecture provides a way for VM guests to be highly secure and isolated (from untrusted VMM). To achieve this requirement, any data coming from VMM cannot be completely trusted. TDX guest fixes this issue by hardening the IO drivers against the attack from the VMM. So, when adding hardening fixes to the generic drivers, to protect custom fixes use cc_platform_has() API. Also add TDX guest support to cc_platform_has() API to protect the TDX specific fixes. Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index a5b14de03458..2e78358923a1 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -871,6 +871,7 @@ config INTEL_TDX_GUEST depends on SECURITY select X86_X2APIC select SECURITY_LOCKDOWN_LSM + select ARCH_HAS_CC_PLATFORM help Provide support for running in a trusted domain on Intel processors equipped with Trusted Domain eXtensions. TDX is a new Intel diff --git a/arch/x86/include/asm/intel_cc_platform.h b/arch/x86/include/asm/intel_cc_platform.h new file mode 100644 index 000000000000..472c3174beac --- /dev/null +++ b/arch/x86/include/asm/intel_cc_platform.h @@ -0,0 +1,13 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* Copyright (C) 2021 Intel Corporation */ +#ifndef _ASM_X86_INTEL_CC_PLATFORM_H +#define _ASM_X86_INTEL_CC_PLATFORM_H + +#if defined(CONFIG_CPU_SUP_INTEL) && defined(CONFIG_ARCH_HAS_CC_PLATFORM) +bool intel_cc_platform_has(unsigned int flag); +#else +static inline bool intel_cc_platform_has(unsigned int flag) { return false; } +#endif + +#endif /* _ASM_X86_INTEL_CC_PLATFORM_H */ + diff --git a/arch/x86/kernel/cc_platform.c b/arch/x86/kernel/cc_platform.c index 3c9bacd3c3f3..e83bc2f48efe 100644 --- a/arch/x86/kernel/cc_platform.c +++ b/arch/x86/kernel/cc_platform.c @@ -10,11 +10,16 @@ #include <linux/export.h> #include <linux/cc_platform.h> #include <linux/mem_encrypt.h> +#include <linux/processor.h> + +#include <asm/intel_cc_platform.h> bool cc_platform_has(enum cc_attr attr) { if (sme_me_mask) return amd_cc_platform_has(attr); + else if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) + return intel_cc_platform_has(attr); return false; } diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c index 8321c43554a1..ab486a3b1eb0 100644 --- a/arch/x86/kernel/cpu/intel.c +++ b/arch/x86/kernel/cpu/intel.c @@ -11,6 +11,7 @@ #include <linux/init.h> #include <linux/uaccess.h> #include <linux/delay.h> +#include <linux/cc_platform.h> #include <asm/cpufeature.h> #include <asm/msr.h> @@ -60,6 +61,21 @@ static u64 msr_test_ctrl_cache __ro_after_init; */ static bool cpu_model_supports_sld __ro_after_init; +#ifdef CONFIG_ARCH_HAS_CC_PLATFORM +bool intel_cc_platform_has(enum cc_attr attr) +{ + switch (attr) { + case CC_ATTR_GUEST_TDX: + return cpu_feature_enabled(X86_FEATURE_TDX_GUEST); + default: + return false; + } + + return false; +} +EXPORT_SYMBOL_GPL(intel_cc_platform_has); +#endif + /* * Processors which have self-snooping capability can handle conflicting * memory type across CPUs by snooping its own cache. However, there exists diff --git a/include/linux/cc_platform.h b/include/linux/cc_platform.h index 253f3ea66cd8..e38430e6e396 100644 --- a/include/linux/cc_platform.h +++ b/include/linux/cc_platform.h @@ -61,6 +61,15 @@ enum cc_attr { * Examples include SEV-ES. */ CC_ATTR_GUEST_STATE_ENCRYPT, + + /** + * @CC_ATTR_GUEST_TDX: Trusted Domain Extension Support + * + * The platform/OS is running as a TDX guest/virtual machine. + * + * Examples include SEV-ES. + */ + CC_ATTR_GUEST_TDX, }; #ifdef CONFIG_ARCH_HAS_CC_PLATFORM
On Wed, Sep 15, 2021 at 10:26:06AM -0700, Kuppuswamy, Sathyanarayanan wrote: > I have a Intel variant patch (please check following patch). But it includes > TDX changes as well. Shall I move TDX changes to different patch and just > create a separate patch for adding intel_cc_platform_has()? Yes, please, so that I can expedite that stuff separately and so that it can go in early in order for future work to be based ontop. Thx.
On 9/16/21 8:02 AM, Borislav Petkov wrote: > On Wed, Sep 15, 2021 at 10:26:06AM -0700, Kuppuswamy, Sathyanarayanan wrote: >> I have a Intel variant patch (please check following patch). But it includes >> TDX changes as well. Shall I move TDX changes to different patch and just >> create a separate patch for adding intel_cc_platform_has()? > > Yes, please, so that I can expedite that stuff separately and so that it > can go in early in order for future work to be based ontop. Sent it part of TDX patch series. Please check and cherry pick it. https://lore.kernel.org/lkml/20210916183550.15349-2-sathyanarayanan.kuppuswamy@linux.intel.com/ > > Thx. >
This patch series provides a generic helper function, cc_platform_has(), to replace the sme_active(), sev_active(), sev_es_active() and mem_encrypt_active() functions. It is expected that as new confidential computing technologies are added to the kernel, they can all be covered by a single function call instead of a collection of specific function calls all called from the same locations. The powerpc and s390 patches have been compile tested only. Can the folks copied on this series verify that nothing breaks for them. Also, a new file, arch/powerpc/platforms/pseries/cc_platform.c, has been created for powerpc to hold the out of line function. Cc: Andi Kleen <ak@linux.intel.com> Cc: Andy Lutomirski <luto@kernel.org> Cc: Ard Biesheuvel <ardb@kernel.org> Cc: Baoquan He <bhe@redhat.com> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Borislav Petkov <bp@alien8.de> Cc: Christian Borntraeger <borntraeger@de.ibm.com> Cc: Daniel Vetter <daniel@ffwll.ch> Cc: Dave Hansen <dave.hansen@linux.intel.com> Cc: Dave Young <dyoung@redhat.com> Cc: David Airlie <airlied@linux.ie> Cc: Heiko Carstens <hca@linux.ibm.com> Cc: Ingo Molnar <mingo@redhat.com> Cc: Joerg Roedel <joro@8bytes.org> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Maxime Ripard <mripard@kernel.org> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Paul Mackerras <paulus@samba.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Vasily Gorbik <gor@linux.ibm.com> Cc: VMware Graphics <linux-graphics-maintainer@vmware.com> Cc: Will Deacon <will@kernel.org> Cc: Christoph Hellwig <hch@infradead.org> --- Patches based on: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master 4b93c544e90e ("thunderbolt: test: split up test cases in tb_test_credit_alloc_all") Changes since v2: - Changed the name from prot_guest_has() to cc_platform_has() - Took the cc_platform_has() function out of line. Created two new files, cc_platform.c, in both x86 and ppc to implment the function. As a result, also changed the attribute defines into enums. - Removed any received Reviewed-by's and Acked-by's given changes in this version. - Added removal of new instances of mem_encrypt_active() usage in powerpc arch. - Based on latest Linux tree to pick up powerpc changes related to the mem_encrypt_active() function. Changes since v1: - Moved some arch ioremap functions within #ifdef CONFIG_AMD_MEM_ENCRYPT in prep for use of prot_guest_has() by TDX. - Added type includes to the the protected_guest.h header file to prevent build errors outside of x86. - Made amd_prot_guest_has() EXPORT_SYMBOL_GPL - Used amd_prot_guest_has() in place of checking sme_me_mask in the arch/x86/mm/mem_encrypt.c file. Tom Lendacky (8): x86/ioremap: Selectively build arch override encryption functions mm: Introduce a function to check for confidential computing features x86/sev: Add an x86 version of cc_platform_has() powerpc/pseries/svm: Add a powerpc version of cc_platform_has() x86/sme: Replace occurrences of sme_active() with cc_platform_has() x86/sev: Replace occurrences of sev_active() with cc_platform_has() x86/sev: Replace occurrences of sev_es_active() with cc_platform_has() treewide: Replace the use of mem_encrypt_active() with cc_platform_has() arch/Kconfig | 3 + arch/powerpc/include/asm/mem_encrypt.h | 5 -- arch/powerpc/platforms/pseries/Kconfig | 1 + arch/powerpc/platforms/pseries/Makefile | 2 + arch/powerpc/platforms/pseries/cc_platform.c | 26 ++++++ arch/powerpc/platforms/pseries/svm.c | 5 +- arch/s390/include/asm/mem_encrypt.h | 2 - arch/x86/Kconfig | 1 + arch/x86/include/asm/io.h | 8 ++ arch/x86/include/asm/kexec.h | 2 +- arch/x86/include/asm/mem_encrypt.h | 14 +--- arch/x86/kernel/Makefile | 3 + arch/x86/kernel/cc_platform.c | 21 +++++ arch/x86/kernel/crash_dump_64.c | 4 +- arch/x86/kernel/head64.c | 4 +- arch/x86/kernel/kvm.c | 3 +- arch/x86/kernel/kvmclock.c | 4 +- arch/x86/kernel/machine_kexec_64.c | 19 +++-- arch/x86/kernel/pci-swiotlb.c | 9 +- arch/x86/kernel/relocate_kernel_64.S | 2 +- arch/x86/kernel/sev.c | 6 +- arch/x86/kvm/svm/svm.c | 3 +- arch/x86/mm/ioremap.c | 18 ++-- arch/x86/mm/mem_encrypt.c | 57 +++++++------ arch/x86/mm/mem_encrypt_identity.c | 3 +- arch/x86/mm/pat/set_memory.c | 3 +- arch/x86/platform/efi/efi_64.c | 9 +- arch/x86/realmode/init.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 4 +- drivers/gpu/drm/drm_cache.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 6 +- drivers/iommu/amd/init.c | 7 +- drivers/iommu/amd/iommu.c | 3 +- drivers/iommu/amd/iommu_v2.c | 3 +- drivers/iommu/iommu.c | 3 +- fs/proc/vmcore.c | 6 +- include/linux/cc_platform.h | 88 ++++++++++++++++++++ include/linux/mem_encrypt.h | 4 - kernel/dma/swiotlb.c | 4 +- 40 files changed, 267 insertions(+), 114 deletions(-) create mode 100644 arch/powerpc/platforms/pseries/cc_platform.c create mode 100644 arch/x86/kernel/cc_platform.c create mode 100644 include/linux/cc_platform.h base-commit: 4b93c544e90e2b28326182d31ee008eb80e02074