From patchwork Thu Sep 28 16:20:12 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Brijesh Singh X-Patchwork-Id: 9976369 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 7C61360365 for ; Thu, 28 Sep 2017 16:20:43 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6F305296C1 for ; Thu, 28 Sep 2017 16:20:43 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 5BB16295DC; Thu, 28 Sep 2017 16:20:43 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A4379296C6 for ; Thu, 28 Sep 2017 16:20:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751822AbdI1QU3 (ORCPT ); Thu, 28 Sep 2017 12:20:29 -0400 Received: from mail-by2nam01on0071.outbound.protection.outlook.com ([104.47.34.71]:32544 "EHLO NAM01-BY2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751403AbdI1QU1 (ORCPT ); Thu, 28 Sep 2017 12:20:27 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amdcloud.onmicrosoft.com; s=selector1-amd-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=oEaEiajfG+cXnRougPDGcOQve3cVRbGocKngd8lb4lw=; b=YAPGai7ky9jal5/3clutXdVc7BZ1jN7Aqy48uO3cY7Zb2F0TgOl7Cc6+X8t5KCCyWBT/Y9Q9c9aWfq0Fcvqwuf6LpOWEOEN+TpMB//1EJ0htBVLxTAAA5fzUEmmrheIdQlrzLVTR8Z6kPJb+MwiAT9sACvjRQ7I+g+iJUITV1a4= Received: from ubuntu-010236106000.amd.com (165.204.78.1) by BY2PR12MB0148.namprd12.prod.outlook.com (10.162.82.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.77.7; Thu, 28 Sep 2017 16:20:23 +0000 From: Brijesh Singh To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, x86@kernel.org Cc: Tom Lendacky , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , Borislav Petkov , Andy Lutomirski , Laura Abbott , "Kirill A. Shutemov" , Matt Fleming , Brijesh Singh Subject: [Part1 PATCH v5.1 05/17] x86/mm: Use encrypted access of boot related data with SEV Date: Thu, 28 Sep 2017 11:20:12 -0500 Message-Id: <20170928162012.76376-1-brijesh.singh@amd.com> X-Mailer: git-send-email 2.9.5 In-Reply-To: <20170927151329.70011-6-brijesh.singh@amd.com> References: <20170927151329.70011-6-brijesh.singh@amd.com> MIME-Version: 1.0 X-Originating-IP: [165.204.78.1] X-ClientProxiedBy: MWHPR2201CA0068.namprd22.prod.outlook.com (10.174.103.21) To BY2PR12MB0148.namprd12.prod.outlook.com (10.162.82.21) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 094df36f-e3a4-45dd-a508-08d5068cd2d2 X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254152)(48565401081)(2017052603199)(201703131423075)(201703031133081)(201702281549075); SRVR:BY2PR12MB0148; X-Microsoft-Exchange-Diagnostics: 1; BY2PR12MB0148; 3:xUUUfYuIqZDXUYZo5g//wCE6+bN4MNbYBQdNxVJwfFvd2ckTHlwDoXaU5FJsuBQPNKNdOxSPk52TlqkBPZLtrFQnhDA9MiGggKp2/NhkDyTFXYWn9VEmB8o79rkJJ9xBjrCBngcI0X93AnM0kqZHkbVh45G9il/fPIfdOoW4k5lTCtD7BppUpS8FVNucPuLOGNlr4dGpow7e5BeBoiVgUzQG7gaUBUo2AEJDFbPA+lkgh0B+ffCI5uZw7Sis6u3O; 25:GSNJd/6x+zDVL9UugQrHGs5sCyuoRaGuqKEhBPwQkyt/eoarHgRQUkxqoP7rsMVhFGFhsdnvi7kY4oOBogXzETTXQvtOEN2gIwrDuZ6Ki3Oh6gxApzeHMlXp9OOPMTsZ8ZoeWJvvTagNcXGgEx2wWL9XViJ+c7sE+H8mH9STdaOTqsSj5zp0jMjWDViTgpxB8uvTKNNP582aHlHiCvwkAnmhKxx3CiEZBRnvZr0QwuRESCZu+UnGbxaDRhwDdRN214aB5DJoBbuTXTqm1DeiitqMpMGVMNVkU+87HPOOmCkGhSjCUX4yEzqKKdeOmpmlhbHp7aVwhpZ1R8QJhqJLfA==; 31:T5aSfA0+x2W4uvW+4083UkpkBkjUCAdmRF0WYkHmqD7tOn/7eKcGjBlT3Rq6fvMI4OQfMSbVlRujsqrHXL4Wy/woL/Lg1BevebIhNTlhsD6ptGrVBLyVgNw+QBwOVGrsSvInXrtaoq/tbEhJzngsGW5Xmxb32PHvB58b8GMmsSlKPGRG8ElHqmv1WMsQIqp/2cpxwAo6r0K6FkGLyQtryUuVsrU2MnKDCoFn6JwGKQw= X-MS-TrafficTypeDiagnostic: BY2PR12MB0148: Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; X-Microsoft-Exchange-Diagnostics: 1; BY2PR12MB0148; 20:skRKWY6UPgXBnqSfb8sqUF3bJFggpRvW0D783uMzr5vnjeCm3VwZypTtjX6nwyZ0m7XtAoIttZxjCI5S+xEjL3YvQ5M4E0QuOZKVQx9K4HWGwK41E6mliZp5QPabStCjzo4uAkJd1yAmNr1ffjSfk/90kS2KnHGJ1eCfWnE6hri0zZjc0mOq7NUCRunHFILGEthW4Y7PyhoHZYTIOK/2hZiWVvsGdq3/pn1rAb9ZjhrXsSjKf7Nyxf1Iqu1ege7gd6SVjAu0kP8bGDo3o0dtbt5pFXQql+SXp2ZKzM4iWwX3YUQt07y37bRghZu7zw4BdypiHPJSQRoBPfhidXHkFoFxTfAwg36qoLHJMaWAIkEwPhzkGLJTNrR/90hfdzQnJk4vpEtco5IcrPhe1//nNYjC+yUepOvFrIoOCF8XjfeJAwhPQQjmqwI9CG7eqUH3pjYLBmp/dh+yI71iHF7TB+S9Wm3cj55Gv+X8S8oTAp/NEztaX2RsEYDT4usNMKkK; 4:u1UaRG/FZckros1MEzqZa9RnLWGK3xWPV5C3EAo/QZs0dE/km9m4JpRPLfSDzM2SOfRD8cgH3nfax+aVUFMtDwh0t14fojJFw5g1/sRTZE84hTx98OaDX0B1ewfzCkWX/IqvXY0yp7WJ+kMfH9SOI/AixC8Wj1SHG1XwJC4EwA4P8KsaWXBf5HWGkdaicpm2CLaJRxY6R0P2o6OfZXZSgxSBGM8GHXqCDh2PHhFmc1WW5OzcVaDZIkOcc8ghJ/M1lFxJdg4pOoKLh/rSyFgbU2i5u9pbVEBjllZcYxGM/QyU8a0A4w70rVUFg2hbHJHK1YyFI9+gxWfneI3vFf28Pg3QffsCemyKQ8llRMqMPqk= X-Exchange-Antispam-Report-Test: UriScan:(9452136761055)(767451399110)(228905959029699); X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(8121501046)(5005006)(93006095)(93001095)(3002001)(100000703101)(100105400095)(10201501046)(6055026)(6041248)(20161123560025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123558100)(20161123555025)(20161123562025)(20161123564025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:BY2PR12MB0148; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:BY2PR12MB0148; X-Forefront-PRVS: 0444EB1997 X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(6009001)(376002)(39860400002)(346002)(189002)(199003)(7416002)(2906002)(6666003)(101416001)(86362001)(25786009)(575784001)(6116002)(53416004)(68736007)(76176999)(189998001)(3846002)(478600001)(4326008)(50986999)(5660300001)(7736002)(1076002)(105586002)(106356001)(66066001)(6486002)(5003940100001)(50226002)(47776003)(48376002)(97736004)(2950100002)(316002)(8936002)(36756003)(50466002)(16526017)(16586007)(8676002)(81166006)(81156014)(54906003)(53936002)(305945005)(33646002); DIR:OUT; SFP:1101; SCL:1; SRVR:BY2PR12MB0148; H:ubuntu-010236106000.amd.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; Received-SPF: None (protection.outlook.com: amd.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BY2PR12MB0148; 23:FETg5QZEl4P02wAKv2Gk7FrMwmZ7xx2ElnAFG0/Ve?= =?us-ascii?Q?ldIg6RVVaXZWAeQJDuDlLVrkESEAKV9IFjAtDJoHZ+Voer1Dqe8BemQdSM/R?= =?us-ascii?Q?k9O+5CaoMF3Jsrf7MN9Dw05TXA0vU1sI6kgJmduQ7Dlkp54rCDyvBPEaTRGO?= =?us-ascii?Q?OsBFiFSR7VYaxbBoodbsljIemaG6uYEqLvCqODXP42rXw2fcrSzbXt6ZlzJP?= =?us-ascii?Q?07/yVuJGnsxsc81I0qH3P1Aub4Xg5Bpm5dluubOX2hCgYMG2p4ibRRt0nm+/?= =?us-ascii?Q?5txtim1Ms1vIsOq7VwuM6LWhdT+fsXOXdW3IvLPLaHCf6elKa1Gl0xNuOyKL?= =?us-ascii?Q?bBZrR+TUVUzCdk+4XPuPE9pHt4aFF0xpk/BCjQ37V7g88iFxu2NuyJ5vxPYM?= =?us-ascii?Q?2r8LY62B8JuXTcBtrDCnth/gQoPLS/UJgoHVSoksN5vdf6lXsPVnhSLuP8sM?= =?us-ascii?Q?452wCHCMMKtjV3UleocZpYXYMPupJBiwCFRvveCPn0Ih1irCf2n/K6CYTmk+?= =?us-ascii?Q?+G1xXK1gV3km92RAzKMsyA+/gcYciTh19w2HVfM4wxojHIk+MpFyo2DrZJjK?= =?us-ascii?Q?X7EvvqqO71c1oWgYHoqhwv7kosgjf9woG0AWyYVahcu+rKbpwJb3u6n3QEDz?= =?us-ascii?Q?eEqRpGbeW1+6SJdWiVPXSwU129GdJue37FeM4NPbGmfgvGq6wlrWEz3A4wg1?= =?us-ascii?Q?gOezeH7PPTBq1fW7YpncwEn2pRrWdro0Ov8tB2hbKmO1FGejAht6NWgJhYap?= =?us-ascii?Q?h57GcoRhGOrTCHzzvda2rbjiB6RrdHualkcD2GeWICujxdEZ/jIsvPkDflPZ?= =?us-ascii?Q?74cpVHelnrgJQ4bCT52nDd8Gxn9GxnVfAITUxvVWNLnOYfrad1ulO/Cj0Y1e?= =?us-ascii?Q?6beEB5VQVMhdhGpE/lERwQGhG3jempGKMA6+M7wcKhSXGbGzQifFaJmHyG+Y?= =?us-ascii?Q?0/ZqJmYJ/9fSkIjf9GCpCzuSiv3d/rkWvdIvvCc85dZWP+890XCUnegyC/yv?= =?us-ascii?Q?CQwo6TyDAbMOGCdkYRZSGx/dKwXyd8aaHD+jjDTS0NDGEdQ7JQAYzKf7NkX6?= =?us-ascii?Q?/b3AgfD4wPyaXFjRSDph8BPJeDrLvg+viAth9VM8a0JXlDnrNc7P9sH9xfSz?= =?us-ascii?Q?cQf6xzP7oOCEQ03d6O/w8BCDwmIqmbc?= X-Microsoft-Exchange-Diagnostics: 1; BY2PR12MB0148; 6:Ou97BFrdrBpj/NNqa7Qx5B+Ncy5GlyhOxksT3K1Oh+MxjNBQmQJpk7qWJgQn5zC4n0sFVfS7NGpPXyBDMryocJCxPLr9y6iIFisO3f3XSJYwtjeLySHoRh2mtDrtR03s+oTi/RQTxcxmAPif2+B+f/jaSf9KYrsReoN1o+MYaC18T1BJJgGMwzxB0h13nb1e8XizAX6m2PgN9CvCuLm/xplYuyfwrYBq1vKVnVoOpMN3dwTP4/QC2gJ1QPDzFzdYyZskBsvFxNVKF2riil3VyYl+PO1z44ifJqCCxtnaNgE8iC7sm0V4TsQM68Sxf3KBWvwmM2Xrkz/4vImGiGyFAA==; 5:e6bc+t4Tzp0v7F/+tYy7XPXUH5k/zaEEvE1tZkBFq8Jnf9P3CStOmlPVhMTwn21LQuKYXuzTBQcCTI7sh5lE6B8smomIZKgwmXHYvINdN7X07wK91qJL2TI4yNOk2Ub2Pzf+yyV0K1FJw+C10i4QWw==; 24:6nxKO5aYOzlbVRlqNwwC5sfFKghYWdV/x5TKSgb5EadX42POmOhuRI7OLsaPDboBAwjdTmLWcthDi7rvJiVPsEbSNRmSXVB0HxRTSzZpzIc=; 7:LWT1QuTQRHZHUYjGOd+G1hoDY6CQ5u78u7OZWcxE4YY+vsuewC2CpoLzePfwJvjmTDLPOhITdB0/iKrn6irHXINeTCOcoZj6Rw3ZYQgpw6Zb0hcn23HnsdkGQFgfiXHg6ctFVSVQ5+8yL3cTVU8W2JuOibdcUo836NeOrnlKEPw//+91I8rZaI0ycec4fWOTevzPKKxOrc18isoriyMfr3t5o7V26HNSBkDq5OBkpa4= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; BY2PR12MB0148; 20:HNOfXC3puovmzEUPxkTjkzyUb5e2+yc5ezs16+8x+A5IqFmqIReM11wyFOVQmimk75rMrNbUzPTuF6G1i1R+3RAlDIB0312x2ginMrzCX9HgJjtbEF93qUqdBYv7M/ma9rCUcAR2JtSSKFORK5M+OtheqPa6/D62XJx/nRAzkDO1UFKiUsUdy1uxQtj6cjtkfRU//Qew3iMNLx4YR8W7Z2tmZxo/Ha1AYyvuXuio7CbpsNob+SZdZ5d4j1WgnENh X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Sep 2017 16:20:23.1094 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY2PR12MB0148 Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Tom Lendacky When Secure Encrypted Virtualization (SEV) is active, boot data (such as EFI related data, setup data) is encrypted and needs to be accessed as such when mapped. Update the architecture override in early_memremap to keep the encryption attribute when mapping this data. Cc: Thomas Gleixner Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: Borislav Petkov Cc: Andy Lutomirski Cc: Laura Abbott Cc: "Kirill A. Shutemov" Cc: Matt Fleming Cc: linux-kernel@vger.kernel.org Cc: x86@kernel.org Signed-off-by: Tom Lendacky Signed-off-by: Brijesh Singh Reviewed-by: Borislav Petkov --- arch/x86/mm/ioremap.c | 44 ++++++++++++++++++++++++++++++-------------- 1 file changed, 30 insertions(+), 14 deletions(-) diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c index 34f0e1847dd6..52cc0f4ed494 100644 --- a/arch/x86/mm/ioremap.c +++ b/arch/x86/mm/ioremap.c @@ -422,6 +422,9 @@ void unxlate_dev_mem_ptr(phys_addr_t phys, void *addr) * areas should be mapped decrypted. And since the encryption key can * change across reboots, persistent memory should also be mapped * decrypted. + * + * If SEV is active, that implies that BIOS/UEFI also ran encrypted so + * only persistent memory should be mapped decrypted. */ static bool memremap_should_map_decrypted(resource_size_t phys_addr, unsigned long size) @@ -458,6 +461,11 @@ static bool memremap_should_map_decrypted(resource_size_t phys_addr, case E820_TYPE_ACPI: case E820_TYPE_NVS: case E820_TYPE_UNUSABLE: + /* For SEV, these areas are encrypted */ + if (sev_active()) + break; + /* Fallthrough */ + case E820_TYPE_PRAM: return true; default: @@ -581,7 +589,7 @@ static bool __init early_memremap_is_setup_data(resource_size_t phys_addr, bool arch_memremap_can_ram_remap(resource_size_t phys_addr, unsigned long size, unsigned long flags) { - if (!sme_active()) + if (!mem_encrypt_active()) return true; if (flags & MEMREMAP_ENC) @@ -590,12 +598,13 @@ bool arch_memremap_can_ram_remap(resource_size_t phys_addr, unsigned long size, if (flags & MEMREMAP_DEC) return false; - if (memremap_is_setup_data(phys_addr, size) || - memremap_is_efi_data(phys_addr, size) || - memremap_should_map_decrypted(phys_addr, size)) - return false; + if (sme_active()) { + if (memremap_is_setup_data(phys_addr, size) || + memremap_is_efi_data(phys_addr, size)) + return false; + } - return true; + return !memremap_should_map_decrypted(phys_addr, size); } /* @@ -608,17 +617,24 @@ pgprot_t __init early_memremap_pgprot_adjust(resource_size_t phys_addr, unsigned long size, pgprot_t prot) { - if (!sme_active()) + bool encrypted_prot; + + if (!mem_encrypt_active()) return prot; - if (early_memremap_is_setup_data(phys_addr, size) || - memremap_is_efi_data(phys_addr, size) || - memremap_should_map_decrypted(phys_addr, size)) - prot = pgprot_decrypted(prot); - else - prot = pgprot_encrypted(prot); + encrypted_prot = true; + + if (sme_active()) { + if (early_memremap_is_setup_data(phys_addr, size) || + memremap_is_efi_data(phys_addr, size)) + encrypted_prot = false; + } + + if (encrypted_prot && memremap_should_map_decrypted(phys_addr, size)) + encrypted_prot = false; - return prot; + return encrypted_prot ? pgprot_encrypted(prot) + : pgprot_decrypted(prot); } bool phys_mem_access_encrypted(unsigned long phys_addr, unsigned long size)