mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-11-27 22:24:11 +08:00
216d106c7f
The memory integrity guarantees of SEV-SNP are enforced through a new structure called the Reverse Map Table (RMP). The RMP is a single data structure shared across the system that contains one entry for every 4K page of DRAM that may be used by SEV-SNP VMs. The APM Volume 2 section on Secure Nested Paging (SEV-SNP) details a number of steps needed to detect/enable SEV-SNP and RMP table support on the host: - Detect SEV-SNP support based on CPUID bit - Initialize the RMP table memory reported by the RMP base/end MSR registers and configure IOMMU to be compatible with RMP access restrictions - Set the MtrrFixDramModEn bit in SYSCFG MSR - Set the SecureNestedPagingEn and VMPLEn bits in the SYSCFG MSR - Configure IOMMU RMP table entry format is non-architectural and it can vary by processor. It is defined by the PPR document for each respective CPU family. Restrict SNP support to CPU models/families which are compatible with the current RMP table entry format to guard against any undefined behavior when running on other system types. Future models/support will handle this through an architectural mechanism to allow for broader compatibility. SNP host code depends on CONFIG_KVM_AMD_SEV config flag which may be enabled even when CONFIG_AMD_MEM_ENCRYPT isn't set, so update the SNP-specific IOMMU helpers used here to rely on CONFIG_KVM_AMD_SEV instead of CONFIG_AMD_MEM_ENCRYPT. Signed-off-by: Brijesh Singh <brijesh.singh@amd.com> Co-developed-by: Ashish Kalra <ashish.kalra@amd.com> Signed-off-by: Ashish Kalra <ashish.kalra@amd.com> Co-developed-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Co-developed-by: Borislav Petkov (AMD) <bp@alien8.de> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Co-developed-by: Michael Roth <michael.roth@amd.com> Signed-off-by: Michael Roth <michael.roth@amd.com> Link: https://lore.kernel.org/r/20240126041126.1927228-5-michael.roth@amd.com
35 lines
579 B
Makefile
35 lines
579 B
Makefile
# SPDX-License-Identifier: GPL-2.0
|
|
obj-$(CONFIG_ARCH_HAS_CC_PLATFORM) += coco/
|
|
|
|
obj-y += entry/
|
|
|
|
obj-$(CONFIG_PERF_EVENTS) += events/
|
|
|
|
obj-$(CONFIG_KVM) += kvm/
|
|
|
|
# Xen paravirtualization support
|
|
obj-$(CONFIG_XEN) += xen/
|
|
|
|
obj-$(CONFIG_PVH) += platform/pvh/
|
|
|
|
# Hyper-V paravirtualization support
|
|
obj-$(subst m,y,$(CONFIG_HYPERV)) += hyperv/
|
|
|
|
obj-y += realmode/
|
|
obj-y += kernel/
|
|
obj-y += mm/
|
|
|
|
obj-y += crypto/
|
|
|
|
obj-$(CONFIG_IA32_EMULATION) += ia32/
|
|
|
|
obj-y += platform/
|
|
obj-y += net/
|
|
|
|
obj-$(CONFIG_KEXEC_FILE) += purgatory/
|
|
|
|
obj-y += virt/svm/
|
|
|
|
# for cleaning
|
|
subdir- += boot tools
|