| Message ID | 20220128171804.569796-37-brijesh.singh@amd.com (mailing list archive) |
|---|---|
| State | Deferred, archived |
| Headers | show |
| Series | Add AMD Secure Nested Paging (SEV-SNP) Guest Support | expand |
On Fri, Jan 28, 2022 at 11:17:57AM -0600, Brijesh Singh wrote: > From: Michael Roth <michael.roth@amd.com> > > The run-time kernel will need to access the Confidential Computing > blob very early in boot to access the CPUID table it points to. At > that stage of boot it will be relying on the identity-mapped page table > set up by boot/compressed kernel, so make sure the blob and the CPUID > table it points to are mapped in advance. > > Signed-off-by: Michael Roth <michael.roth@amd.com> > Signed-off-by: Brijesh Singh <brijesh.singh@amd.com> > --- > arch/x86/boot/compressed/ident_map_64.c | 3 ++- > arch/x86/boot/compressed/misc.h | 2 ++ > arch/x86/boot/compressed/sev.c | 22 ++++++++++++++++++++++ > 3 files changed, 26 insertions(+), 1 deletion(-) Do this ontop: --- diff --git a/arch/x86/boot/compressed/sev.c b/arch/x86/boot/compressed/sev.c index faf432684870..a5a9210d73b6 100644 --- a/arch/x86/boot/compressed/sev.c +++ b/arch/x86/boot/compressed/sev.c @@ -500,7 +500,7 @@ bool snp_init(struct boot_params *bp) void sev_prep_identity_maps(unsigned long top_level_pgt) { /* - * The ConfidentialComputing blob is used very early in uncompressed + * The Confidential Computing blob is used very early in uncompressed * kernel to find the in-memory cpuid table to handle cpuid * instructions. Make sure an identity-mapping exists so it can be * accessed after switchover. @@ -509,11 +509,10 @@ void sev_prep_identity_maps(unsigned long top_level_pgt) unsigned long cc_info_pa = boot_params->cc_blob_address; struct cc_blob_sev_info *cc_info; - kernel_add_identity_map(cc_info_pa, - cc_info_pa + sizeof(*cc_info)); + kernel_add_identity_map(cc_info_pa, cc_info_pa + sizeof(*cc_info)); + cc_info = (struct cc_blob_sev_info *)cc_info_pa; - kernel_add_identity_map((unsigned long)cc_info->cpuid_phys, - (unsigned long)cc_info->cpuid_phys + cc_info->cpuid_len); + kernel_add_identity_map(cc_info->cpuid_phys, cc_info->cpuid_phys + cc_info->cpuid_len); } sev_verify_cbit(top_level_pgt);
diff --git a/arch/x86/boot/compressed/ident_map_64.c b/arch/x86/boot/compressed/ident_map_64.c index 7975680f521f..e4b093a0862d 100644 --- a/arch/x86/boot/compressed/ident_map_64.c +++ b/arch/x86/boot/compressed/ident_map_64.c @@ -163,8 +163,9 @@ void initialize_identity_maps(void *rmode) cmdline = get_cmd_line_ptr(); kernel_add_identity_map(cmdline, cmdline + COMMAND_LINE_SIZE); + sev_prep_identity_maps(top_level_pgt); + /* Load the new page-table. */ - sev_verify_cbit(top_level_pgt); write_cr3(top_level_pgt); } diff --git a/arch/x86/boot/compressed/misc.h b/arch/x86/boot/compressed/misc.h index cfa0663bf931..72eda6c26c11 100644 --- a/arch/x86/boot/compressed/misc.h +++ b/arch/x86/boot/compressed/misc.h @@ -127,6 +127,7 @@ void sev_es_shutdown_ghcb(void); extern bool sev_es_check_ghcb_fault(unsigned long address); void snp_set_page_private(unsigned long paddr); void snp_set_page_shared(unsigned long paddr); +void sev_prep_identity_maps(unsigned long top_level_pgt); #else static inline void sev_enable(struct boot_params *bp) { } static inline void sev_es_shutdown_ghcb(void) { } @@ -136,6 +137,7 @@ static inline bool sev_es_check_ghcb_fault(unsigned long address) } static inline void snp_set_page_private(unsigned long paddr) { } static inline void snp_set_page_shared(unsigned long paddr) { } +static inline void sev_prep_identity_maps(unsigned long top_level_pgt) { } #endif /* acpi.c */ diff --git a/arch/x86/boot/compressed/sev.c b/arch/x86/boot/compressed/sev.c index e1596bfc13e6..faf432684870 100644 --- a/arch/x86/boot/compressed/sev.c +++ b/arch/x86/boot/compressed/sev.c @@ -496,3 +496,25 @@ bool snp_init(struct boot_params *bp) */ return true; } + +void sev_prep_identity_maps(unsigned long top_level_pgt) +{ + /* + * The ConfidentialComputing blob is used very early in uncompressed + * kernel to find the in-memory cpuid table to handle cpuid + * instructions. Make sure an identity-mapping exists so it can be + * accessed after switchover. + */ + if (sev_snp_enabled()) { + unsigned long cc_info_pa = boot_params->cc_blob_address; + struct cc_blob_sev_info *cc_info; + + kernel_add_identity_map(cc_info_pa, + cc_info_pa + sizeof(*cc_info)); + cc_info = (struct cc_blob_sev_info *)cc_info_pa; + kernel_add_identity_map((unsigned long)cc_info->cpuid_phys, + (unsigned long)cc_info->cpuid_phys + cc_info->cpuid_len); + } + + sev_verify_cbit(top_level_pgt); +}