AMD SME/SEV uses a bit in the page table entries to indicate that the
page is encrypted and not accessible to the VMM.
TDX uses a similar approach, but the polarity of the mask is opposite to
AMD: if the bit is set the page is accessible to VMM.
Provide vendor-neutral API to deal with the mask:
- cc_mkenc() and cc_mkdec() modify given address to make it
encrypted/decrypted. It can be applied to phys_addr_t, pgprotval_t
or page table entry value.
- cc_get_mask() returns encryption or decrypthion mask. It is useful
for set_memory_encrypted() and set_memory_decrypted()
implementation.
The implementation will be extended to cover TDX.
pgprot_decrypted() is used by drivers (i915, virtio_gpu, vfio).
cc_mkdec() called by pgprot_decrypted(). Export cc_mkdec().
HyperV doesn't use bits in page table entries, so the mask is 0 for both
encrypthion and decrypthion.
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@xxxxxxxxxxxxxxx>
@@ -84,7 +85,39 @@ bool cc_platform_has(enum cc_attr attr)
}
EXPORT_SYMBOL_GPL(cc_platform_has);
-__init void cc_init(enum cc_vendor vendor)
+u64 cc_get_mask(bool enc)
+{
+ switch (cc_vendor) {
+ case CC_VENDOR_AMD:
+ return enc ? cc_mask : 0;
+ default:
+ return 0;
+ }
+}
+
diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c
index eb7fbd85b77e..fa758247ab57 100644
--- a/arch/x86/mm/mem_encrypt_identity.c
+++ b/arch/x86/mm/mem_encrypt_identity.c
@@ -603,5 +603,5 @@ void __init sme_enable(struct boot_params *bp)
out:
physical_mask &= ~sme_me_mask;
if (sme_me_mask)
- cc_init(CC_VENDOR_AMD);
+ cc_init(CC_VENDOR_AMD, sme_me_mask);