@@ -413,6 +413,85 @@ void snp_check_features(void)
413
413
}
414
414
}
415
415
416
+ /* Search for Confidential Computing blob in the EFI config table. */
417
+ static struct cc_blob_sev_info * find_cc_blob_efi (struct boot_params * bp )
418
+ {
419
+ unsigned long cfg_table_pa ;
420
+ unsigned int cfg_table_len ;
421
+ int ret ;
422
+
423
+ ret = efi_get_conf_table (bp , & cfg_table_pa , & cfg_table_len );
424
+ if (ret )
425
+ return NULL ;
426
+
427
+ return (struct cc_blob_sev_info * )efi_find_vendor_table (bp , cfg_table_pa ,
428
+ cfg_table_len ,
429
+ EFI_CC_BLOB_GUID );
430
+ }
431
+
432
+ /*
433
+ * Initial set up of SNP relies on information provided by the
434
+ * Confidential Computing blob, which can be passed to the boot kernel
435
+ * by firmware/bootloader in the following ways:
436
+ *
437
+ * - via an entry in the EFI config table
438
+ * - via a setup_data structure, as defined by the Linux Boot Protocol
439
+ *
440
+ * Scan for the blob in that order.
441
+ */
442
+ static struct cc_blob_sev_info * find_cc_blob (struct boot_params * bp )
443
+ {
444
+ struct cc_blob_sev_info * cc_info ;
445
+
446
+ cc_info = find_cc_blob_efi (bp );
447
+ if (cc_info )
448
+ goto found_cc_info ;
449
+
450
+ cc_info = find_cc_blob_setup_data (bp );
451
+ if (!cc_info )
452
+ return NULL ;
453
+
454
+ found_cc_info :
455
+ if (cc_info -> magic != CC_BLOB_SEV_HDR_MAGIC )
456
+ sev_es_terminate (SEV_TERM_SET_GEN , GHCB_SNP_UNSUPPORTED );
457
+
458
+ return cc_info ;
459
+ }
460
+
461
+ /*
462
+ * Indicate SNP based on presence of SNP-specific CC blob. Subsequent checks
463
+ * will verify the SNP CPUID/MSR bits.
464
+ */
465
+ static bool early_snp_init (struct boot_params * bp )
466
+ {
467
+ struct cc_blob_sev_info * cc_info ;
468
+
469
+ if (!bp )
470
+ return false;
471
+
472
+ cc_info = find_cc_blob (bp );
473
+ if (!cc_info )
474
+ return false;
475
+
476
+ /*
477
+ * If a SNP-specific Confidential Computing blob is present, then
478
+ * firmware/bootloader have indicated SNP support. Verifying this
479
+ * involves CPUID checks which will be more reliable if the SNP
480
+ * CPUID table is used. See comments over snp_setup_cpuid_table() for
481
+ * more details.
482
+ */
483
+ setup_cpuid_table (cc_info );
484
+
485
+ /*
486
+ * Pass run-time kernel a pointer to CC info via boot_params so EFI
487
+ * config table doesn't need to be searched again during early startup
488
+ * phase.
489
+ */
490
+ bp -> cc_blob_address = (u32 )(unsigned long )cc_info ;
491
+
492
+ return true;
493
+ }
494
+
416
495
/*
417
496
* sev_check_cpu_support - Check for SEV support in the CPU capabilities
418
497
*
@@ -463,7 +542,7 @@ void sev_enable(struct boot_params *bp)
463
542
bp -> cc_blob_address = 0 ;
464
543
465
544
/*
466
- * Do an initial SEV capability check before snp_init () which
545
+ * Do an initial SEV capability check before early_snp_init () which
467
546
* loads the CPUID page and the same checks afterwards are done
468
547
* without the hypervisor and are trustworthy.
469
548
*
@@ -478,7 +557,7 @@ void sev_enable(struct boot_params *bp)
478
557
* Setup/preliminary detection of SNP. This will be sanity-checked
479
558
* against CPUID/MSR values later.
480
559
*/
481
- snp = snp_init (bp );
560
+ snp = early_snp_init (bp );
482
561
483
562
/* Now repeat the checks with the SNP CPUID table. */
484
563
@@ -535,85 +614,6 @@ u64 sev_get_status(void)
535
614
return m .q ;
536
615
}
537
616
538
- /* Search for Confidential Computing blob in the EFI config table. */
539
- static struct cc_blob_sev_info * find_cc_blob_efi (struct boot_params * bp )
540
- {
541
- unsigned long cfg_table_pa ;
542
- unsigned int cfg_table_len ;
543
- int ret ;
544
-
545
- ret = efi_get_conf_table (bp , & cfg_table_pa , & cfg_table_len );
546
- if (ret )
547
- return NULL ;
548
-
549
- return (struct cc_blob_sev_info * )efi_find_vendor_table (bp , cfg_table_pa ,
550
- cfg_table_len ,
551
- EFI_CC_BLOB_GUID );
552
- }
553
-
554
- /*
555
- * Initial set up of SNP relies on information provided by the
556
- * Confidential Computing blob, which can be passed to the boot kernel
557
- * by firmware/bootloader in the following ways:
558
- *
559
- * - via an entry in the EFI config table
560
- * - via a setup_data structure, as defined by the Linux Boot Protocol
561
- *
562
- * Scan for the blob in that order.
563
- */
564
- static struct cc_blob_sev_info * find_cc_blob (struct boot_params * bp )
565
- {
566
- struct cc_blob_sev_info * cc_info ;
567
-
568
- cc_info = find_cc_blob_efi (bp );
569
- if (cc_info )
570
- goto found_cc_info ;
571
-
572
- cc_info = find_cc_blob_setup_data (bp );
573
- if (!cc_info )
574
- return NULL ;
575
-
576
- found_cc_info :
577
- if (cc_info -> magic != CC_BLOB_SEV_HDR_MAGIC )
578
- sev_es_terminate (SEV_TERM_SET_GEN , GHCB_SNP_UNSUPPORTED );
579
-
580
- return cc_info ;
581
- }
582
-
583
- /*
584
- * Indicate SNP based on presence of SNP-specific CC blob. Subsequent checks
585
- * will verify the SNP CPUID/MSR bits.
586
- */
587
- bool snp_init (struct boot_params * bp )
588
- {
589
- struct cc_blob_sev_info * cc_info ;
590
-
591
- if (!bp )
592
- return false;
593
-
594
- cc_info = find_cc_blob (bp );
595
- if (!cc_info )
596
- return false;
597
-
598
- /*
599
- * If a SNP-specific Confidential Computing blob is present, then
600
- * firmware/bootloader have indicated SNP support. Verifying this
601
- * involves CPUID checks which will be more reliable if the SNP
602
- * CPUID table is used. See comments over snp_setup_cpuid_table() for
603
- * more details.
604
- */
605
- setup_cpuid_table (cc_info );
606
-
607
- /*
608
- * Pass run-time kernel a pointer to CC info via boot_params so EFI
609
- * config table doesn't need to be searched again during early startup
610
- * phase.
611
- */
612
- bp -> cc_blob_address = (u32 )(unsigned long )cc_info ;
613
-
614
- return true;
615
- }
616
-
617
617
void sev_prep_identity_maps (unsigned long top_level_pgt )
618
618
{
619
619
/*
0 commit comments