| /* SPDX-License-Identifier: GPL-2.0-only */ | |
| /* | |
| * AMD Memory Encryption Support | |
| * | |
| * Copyright (C) 2017 Advanced Micro Devices, Inc. | |
| * | |
| * Author: Tom Lendacky <thomas.lendacky@amd.com> | |
| */ | |
| #include <linux/linkage.h> | |
| #include <asm/processor-flags.h> | |
| #include <asm/msr.h> | |
| #include <asm/asm-offsets.h> | |
| .text | |
| .code32 | |
| SYM_FUNC_START(get_sev_encryption_bit) | |
| xor %eax, %eax | |
| #ifdef CONFIG_AMD_MEM_ENCRYPT | |
| push %ebx | |
| push %ecx | |
| push %edx | |
| movl $0x80000000, %eax /* CPUID to check the highest leaf */ | |
| cpuid | |
| cmpl $0x8000001f, %eax /* See if 0x8000001f is available */ | |
| jb .Lno_sev | |
| /* | |
| * Check for the SEV feature: | |
| * CPUID Fn8000_001F[EAX] - Bit 1 | |
| * CPUID Fn8000_001F[EBX] - Bits 5:0 | |
| * Pagetable bit position used to indicate encryption | |
| */ | |
| movl $0x8000001f, %eax | |
| cpuid | |
| bt $1, %eax /* Check if SEV is available */ | |
| jnc .Lno_sev | |
| movl $MSR_AMD64_SEV, %ecx /* Read the SEV MSR */ | |
| rdmsr | |
| bt $MSR_AMD64_SEV_ENABLED_BIT, %eax /* Check if SEV is active */ | |
| jnc .Lno_sev | |
| movl %ebx, %eax | |
| andl $0x3f, %eax /* Return the encryption bit location */ | |
| jmp .Lsev_exit | |
| .Lno_sev: | |
| xor %eax, %eax | |
| .Lsev_exit: | |
| pop %edx | |
| pop %ecx | |
| pop %ebx | |
| #endif /* CONFIG_AMD_MEM_ENCRYPT */ | |
| ret | |
| SYM_FUNC_END(get_sev_encryption_bit) | |
| /** | |
| * sev_es_req_cpuid - Request a CPUID value from the Hypervisor using | |
| * the GHCB MSR protocol | |
| * | |
| * @%eax: Register to request (0=EAX, 1=EBX, 2=ECX, 3=EDX) | |
| * @%edx: CPUID Function | |
| * | |
| * Returns 0 in %eax on success, non-zero on failure | |
| * %edx returns CPUID value on success | |
| */ | |
| SYM_CODE_START_LOCAL(sev_es_req_cpuid) | |
| shll $30, %eax | |
| orl $0x00000004, %eax | |
| movl $MSR_AMD64_SEV_ES_GHCB, %ecx | |
| wrmsr | |
| rep; vmmcall # VMGEXIT | |
| rdmsr | |
| /* Check response */ | |
| movl %eax, %ecx | |
| andl $0x3ffff000, %ecx # Bits [12-29] MBZ | |
| jnz 2f | |
| /* Check return code */ | |
| andl $0xfff, %eax | |
| cmpl $5, %eax | |
| jne 2f | |
| /* All good - return success */ | |
| xorl %eax, %eax | |
| 1: | |
| ret | |
| 2: | |
| movl $-1, %eax | |
| jmp 1b | |
| SYM_CODE_END(sev_es_req_cpuid) | |
| SYM_CODE_START(startup32_vc_handler) | |
| pushl %eax | |
| pushl %ebx | |
| pushl %ecx | |
| pushl %edx | |
| /* Keep CPUID function in %ebx */ | |
| movl %eax, %ebx | |
| /* Check if error-code == SVM_EXIT_CPUID */ | |
| cmpl $0x72, 16(%esp) | |
| jne .Lfail | |
| movl $0, %eax # Request CPUID[fn].EAX | |
| movl %ebx, %edx # CPUID fn | |
| call sev_es_req_cpuid # Call helper | |
| testl %eax, %eax # Check return code | |
| jnz .Lfail | |
| movl %edx, 12(%esp) # Store result | |
| movl $1, %eax # Request CPUID[fn].EBX | |
| movl %ebx, %edx # CPUID fn | |
| call sev_es_req_cpuid # Call helper | |
| testl %eax, %eax # Check return code | |
| jnz .Lfail | |
| movl %edx, 8(%esp) # Store result | |
| movl $2, %eax # Request CPUID[fn].ECX | |
| movl %ebx, %edx # CPUID fn | |
| call sev_es_req_cpuid # Call helper | |
| testl %eax, %eax # Check return code | |
| jnz .Lfail | |
| movl %edx, 4(%esp) # Store result | |
| movl $3, %eax # Request CPUID[fn].EDX | |
| movl %ebx, %edx # CPUID fn | |
| call sev_es_req_cpuid # Call helper | |
| testl %eax, %eax # Check return code | |
| jnz .Lfail | |
| movl %edx, 0(%esp) # Store result | |
| /* | |
| * Sanity check CPUID results from the Hypervisor. See comment in | |
| * do_vc_no_ghcb() for more details on why this is necessary. | |
| */ | |
| /* Fail if SEV leaf not available in CPUID[0x80000000].EAX */ | |
| cmpl $0x80000000, %ebx | |
| jne .Lcheck_sev | |
| cmpl $0x8000001f, 12(%esp) | |
| jb .Lfail | |
| jmp .Ldone | |
| .Lcheck_sev: | |
| /* Fail if SEV bit not set in CPUID[0x8000001f].EAX[1] */ | |
| cmpl $0x8000001f, %ebx | |
| jne .Ldone | |
| btl $1, 12(%esp) | |
| jnc .Lfail | |
| .Ldone: | |
| popl %edx | |
| popl %ecx | |
| popl %ebx | |
| popl %eax | |
| /* Remove error code */ | |
| addl $4, %esp | |
| /* Jump over CPUID instruction */ | |
| addl $2, (%esp) | |
| iret | |
| .Lfail: | |
| /* Send terminate request to Hypervisor */ | |
| movl $0x100, %eax | |
| xorl %edx, %edx | |
| movl $MSR_AMD64_SEV_ES_GHCB, %ecx | |
| wrmsr | |
| rep; vmmcall | |
| /* If request fails, go to hlt loop */ | |
| hlt | |
| jmp .Lfail | |
| SYM_CODE_END(startup32_vc_handler) | |
| .code64 | |
| #include "../../kernel/sev_verify_cbit.S" | |
| SYM_FUNC_START(set_sev_encryption_mask) | |
| #ifdef CONFIG_AMD_MEM_ENCRYPT | |
| push %rbp | |
| push %rdx | |
| movq %rsp, %rbp /* Save current stack pointer */ | |
| call get_sev_encryption_bit /* Get the encryption bit position */ | |
| testl %eax, %eax | |
| jz .Lno_sev_mask | |
| bts %rax, sme_me_mask(%rip) /* Create the encryption mask */ | |
| /* | |
| * Read MSR_AMD64_SEV again and store it to sev_status. Can't do this in | |
| * get_sev_encryption_bit() because this function is 32-bit code and | |
| * shared between 64-bit and 32-bit boot path. | |
| */ | |
| movl $MSR_AMD64_SEV, %ecx /* Read the SEV MSR */ | |
| rdmsr | |
| /* Store MSR value in sev_status */ | |
| shlq $32, %rdx | |
| orq %rdx, %rax | |
| movq %rax, sev_status(%rip) | |
| .Lno_sev_mask: | |
| movq %rbp, %rsp /* Restore original stack pointer */ | |
| pop %rdx | |
| pop %rbp | |
| #endif | |
| xor %rax, %rax | |
| ret | |
| SYM_FUNC_END(set_sev_encryption_mask) | |
| .data | |
| #ifdef CONFIG_AMD_MEM_ENCRYPT | |
| .balign 8 | |
| SYM_DATA(sme_me_mask, .quad 0) | |
| SYM_DATA(sev_status, .quad 0) | |
| SYM_DATA(sev_check_data, .quad 0) | |
| #endif |