From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751379AbdBWVew (ORCPT ); Thu, 23 Feb 2017 16:34:52 -0500 Received: from mail-bn3nam01on0085.outbound.protection.outlook.com ([104.47.33.85]:9297 "EHLO NAM01-BN3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751279AbdBWVep (ORCPT ); Thu, 23 Feb 2017 16:34:45 -0500 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Thomas.Lendacky@amd.com; Subject: Re: [RFC PATCH v4 14/28] Add support to access boot related data in the clear To: Borislav Petkov References: <20170216154158.19244.66630.stgit@tlendack-t1.amdoffice.net> <20170216154508.19244.58580.stgit@tlendack-t1.amdoffice.net> <20170221150625.lohyskz5bjuey7fa@pd.tnic> CC: , , , , , , , , , Rik van Riel , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , Toshimitsu Kani , Arnd Bergmann , Jonathan Corbet , Matt Fleming , "Michael S. Tsirkin" , Joerg Roedel , Konrad Rzeszutek Wilk , Paolo Bonzini , Brijesh Singh , Ingo Molnar , Alexander Potapenko , Andy Lutomirski , "H. Peter Anvin" , Andrey Ryabinin , Thomas Gleixner , Larry Woodman , Dmitry Vyukov From: Tom Lendacky Message-ID: <031277bf-25ad-3d41-d189-1ad6b4d27c93@amd.com> Date: Thu, 23 Feb 2017 15:34:30 -0600 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.7.1 MIME-Version: 1.0 In-Reply-To: <20170221150625.lohyskz5bjuey7fa@pd.tnic> Content-Type: text/plain; charset="utf-8"; format=flowed Content-Transfer-Encoding: 7bit X-Originating-IP: [165.204.77.1] X-ClientProxiedBy: DM5PR20CA0030.namprd20.prod.outlook.com (10.171.161.144) To DM5PR12MB1147.namprd12.prod.outlook.com (10.168.236.142) X-MS-Office365-Filtering-Correlation-Id: abfa809c-f369-4c41-f65c-08d45c33c58b X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(48565401081);SRVR:DM5PR12MB1147; X-Microsoft-Exchange-Diagnostics: 1;DM5PR12MB1147;3:7vYjMc67A1LXqKeymW3ShgOf5oMGN1LjVE6rrylSJYWjnYWviHMZ0ebJggB+9jDjjqiELVMNLJT/OZuloROi0kEk5EQ+iQIyTraR8Var/YuuT3hBjeBHM3C3mECJB5uHHGFwRhZLQ52gXsuEuOCij0ffXkfFCtGUIxLEACDqy8acKxqvsbTyxSp40RJX9CbuYQDL+wu0oUqyypejZVtIfmD2fxlA/5P8RGQvjdFWHMEmb2t7qLPi58aRBM+2twN7WUTOXv7nfW2BfPpWBwNG8RCAizxAKW7tcdFgsb1M5qQ=;25:ohHMXjxysP6bcDvScKJ6+f9ttqlNWzqZwPZzrR9GY+vEFtE+mP2baUGMgVknnsC7o5mAHweQa3S9+/5iydHEZD8EYO/hOmrrbwHR38kHB15IKv8ZLuRpvgw+EKjucGt0kP6yFOhqpFOgOQJ6J+TCHiqgmzhMXVve0rNQ/J4z/5/X/zoL+zQhK4thT6rieHeEhkx0hz921m9L0HeB9Lpa7O6D5tpSRkqd6TPEMfdmziT6AebnIPbjx9ME5s8HLW26In1zY/lIx5Qj7govaIXkHMHabk7y/4n5eCfmyz837J/WQI7hNLxw2oZjSxxsAHgSq+X0RrpGUTVqM5sOKPYkhZ+nJflY9cGtXsThJgDwhPQc6mAVy6DG4UgRFVegZsdc/ACYw3mPjLLaaXn+0CtKCplc1ZpL5qyGAnFImSZlm5LK8NphU2+xxZMVXpjw8B7SwhXFAxMdK56vWUF0uLzTqA== X-Microsoft-Exchange-Diagnostics: 1;DM5PR12MB1147;31:rzj091DIkghEE6iC9UnNhoEUKKUZD6tELIs4IX+3t8x2PyEIZcfEwv2MNCZ4YxysdYh/RaS2LlAjm4e1ROLepWri6j1Iyg2NR3wP7QnBuHipD0fU0klG71ILu6Q14+TAV34BNSTMoDKJeBqlpZ/ZxZ451SweTgqccHZUYbcrMNyRK+lGMLk5HgeURSfJK7p0sfiUQYcfVa7re334ECPJ/AUASF0N2boYFJK7d2xq38v+gksy/v300dpF2TRPtaI3;20:mUz9TRcah+VeSz97Hw5BX1fdCy5lqZUUukqr8GQe6bvZBmelvuhBcJgUywFNuGaU7jgm+O24G2h9JLp7EpvAhXaLZUQTGWQHXrxW7nyZjjbOidgNhJisUhcocLtXY+0L5ciG9cS2d0kPW3va3sVwlZr7630152N74YFjoDbiNMgmBxLDDfX+cjYKsTBZkP6VXqrzULcUDF5dHUlo+FXJ2Fr9IgjexA4Ca9HccA4vWIKsanBuVEdLbtM0Scuej+5eIHYi+Ox11fTjOV3/2bSXlRw4PqDc8J8P3W0DsvQCLK//06fwhpn038tIWfijP0KArup/K1NLMy2AMq869Dd7w/Cm1iCsWITlsgnVPOnDNQdfldWCl6q5H0byE2QV/+Z9VF1vrixrJ+V2NeFOtiZrDtN8DJhnK+t3uzENqH4ADhKq58PjTd+5z5UNeL7Wz0kzzJ5alxUQVBAnibVS/GmSWGLoROWVbB7QTsKFQO7r1booN65bzkz/vEYTTHuZqp6v X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(767451399110); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(6041248)(20161123555025)(20161123562025)(20161123564025)(20161123558025)(20161123560025)(6072148);SRVR:DM5PR12MB1147;BCL:0;PCL:0;RULEID:;SRVR:DM5PR12MB1147; X-Microsoft-Exchange-Diagnostics: 1;DM5PR12MB1147;4:eywRtJNusd9IsldUoAetVy3a8l/Dk9CHW/LChiBlajXcy41IW3PlTkYjrV1OwoR2kI4RD/mGQHoFbLJEAydkpUcz7d4L+h4xY762wWtiCCiEfnMOps+hQmom9WECIqhlW80W1XkbmJpfbTooI762T8tC+AdALMloZCTvdI8apoACUrabAEVqoXlI8jWGGzfVLBhrmGfK3CWfMY/YMf6XSM+AUAp22uRyCkYazNqOvcDrkp3uBzGzZtKgEZL6vSWjJvNYoQfLhSM7R/Wzye/8wQcly2xbOwFk1GcHKqVESBnqcIHyPntkE17Vmy3OzeOxJDwssxagVtMFJyQm0citjV7WzcoBUYb+ejsQjpbcELpS7CprOQLJLHzK1t+mEJ3V7Dcr0wI4LGX3yQ2hZA5GFguzu1K13R78AXeBKpNiq5sr0th5Hzfuq2+i0w4gBP/G38xysfsFmLr1h55hQB3M7F0bSQElZ+XCXYSE3tBdEeGgwZgSsNukN4JNi/MAPo43XgqXaJvrSWamwbnyDe4NcAzx/vFh1HKvsRryxl8t7MO/jw2zuDwiQCyGDq8xqjVZ0F1alwrECPsNeWa6B9vFUdM0HJKtFrTtNnHE78mnH4LrBVu83BxyzKbCkbBZAn+W55jnhmn6UXWpF994dnTWUTKvRWACE4Ub1n3QdnwvKxs= X-Forefront-PRVS: 02272225C5 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(4630300001)(6049001)(6009001)(7916002)(39450400003)(39840400002)(39850400002)(39410400002)(39860400002)(199003)(377454003)(189002)(24454002)(65806001)(23676002)(50986999)(47776003)(68736007)(230700001)(7736002)(81166006)(8676002)(54906002)(189998001)(92566002)(3846002)(6486002)(54356999)(83506001)(76176999)(25786008)(90366009)(81156014)(65956001)(31686004)(101416001)(36756003)(77096006)(64126003)(66066001)(2950100002)(7416002)(4326007)(575784001)(5660300001)(65826007)(110136004)(31696002)(6916009)(97736004)(53546006)(86362001)(105586002)(50466002)(4001350100001)(6666003)(305945005)(42186005)(2906002)(33646002)(38730400002)(6246003)(6116002)(53936002)(106356001)(229853002)(217873001);DIR:OUT;SFP:1101;SCL:1;SRVR:DM5PR12MB1147;H:[10.236.64.179];FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtETTVQUjEyTUIxMTQ3OzIzOmNIUGRMVys1Nm91MU9jaHVnN1ZxeEE5S0R0?= =?utf-8?B?UTQwYlcrcUVvYTFsM1ZNcFFSQ01FTjNFN1hXRUwwc1ZheEx5Q20veWNOMldj?= =?utf-8?B?NGMxSUE3NDlrOElLN3p4WU5CZkdzeWdKY2Fnc1RyZHR1aUtaZTZwbm0rUHBC?= =?utf-8?B?NldPM0h4L3NPNkNQZTl0ci9MNEhxUkRRei9DQXd3emZ3QU9XRm5Xc0NUKzBG?= =?utf-8?B?RGJpaHlsMXFJUFlNbG9td2JSUWtOUTByNEl2MVdxNUl2ZS92ZDhUWElMSGJ2?= =?utf-8?B?dEJleXB1MEhwQVNDSUcycmEycVV4YU8yU3NLcEkzK2I1NVFBQnhYWkZlV0hv?= =?utf-8?B?MWljellnVlR3R1dqR3QxUXVMZUdwL01DZUc0cmVUMDZiTTUxcFRMUHdvN2hX?= =?utf-8?B?SkcyMUptNHJEZE5HSzEycmdmQ05OcStpZjQxOVVQbnVYS2ZCN3k5Ry96MU9n?= =?utf-8?B?Z2p3R2liZ3ZUd0prVExtOFcrb2RwWCsvTXZ6MEN2MUdBeWMzanJQMnlSUWF5?= =?utf-8?B?MURQMVovTm80WjFUTTFDb3J6bkYvTWVDK1g5emxVRlcxN29qYVp6ZWF2aDUx?= =?utf-8?B?RHZQWXYyZTRFaXpvOGQxdjFOU0hiaVBPUlFaYi9KZUJvVmUzUTdMV0xHS3Vx?= =?utf-8?B?MHZva0g2Z3BQUXI0em05S3FNYWJQcS9YZzdtdVFLeFJ5ZS9sc2hSMWZHZklr?= =?utf-8?B?R29XS1c2c3JnczRzeDJvSFcwSG5HcU5mRzNlRHY5NGNpQTM2T1ZZalJoYlky?= =?utf-8?B?RHRmRHJGOGNkTklYUnAwOUdLcDNoTkRQNjNWaDEwRE54NnZJUU1WNDYrRjRy?= =?utf-8?B?aXVMeFRrd1ZiUW1iQTVUSVd3aEV5WlpvbnQvZmxudVVmdEhobnhZby9zZUVY?= =?utf-8?B?T3hidW03d0l1ZHNIK0srWE9oTWRzUFFpd0thMDNDZUpvV2ZnUFRmWk92Zjkx?= =?utf-8?B?YnJ1U0UrRDZnRnkybmFnTjJJS3g5Qjl1dmtxeFRqT0lXc25WTGpDRkRZNkEz?= =?utf-8?B?YlRsSGVkMU5UK0doOW1GQ0dEN04zemZFMFhvNFVKTkdRdEdWQ28rd294VjAw?= =?utf-8?B?QXlkT3Y4RzFWT0ZWN0F6azcyclBCSEhYeXlJbG1CNnZnTFZLTlgyUVJTbHJu?= =?utf-8?B?dmVmTU1MalZYZGRoZkI4NUFUaVJrbDVYUHhqU3BlOW1sM01DY3hkb3I3Wm82?= =?utf-8?B?YWwxeHk3a2d6azBIS01TVml2WkVpSkFVemlYbVI0RlRobGhNekQrYTBib0tt?= =?utf-8?B?UGN2YWxHOHZnN3F5dTNnYzhnQzVFeENDTWlPSGFrZFZYdWxROXFpZVRTem5X?= =?utf-8?B?RVF6YjRJdGpQK1h2Rk12QzF1OVd4UGxHWjFlNGtpdnhVdk5xb25vZzdLRGZu?= =?utf-8?B?d1MzSTFMZGlUbTZlLzFrK3pyQURkRjZyQjdLTGlwTTNaTk02SVF0STkrc1BN?= =?utf-8?B?VjJhbHJuazdsOHNTOHZWQzI3TndmQjNaanV1aytCVmt2UkJqaXlsRmovRW5t?= =?utf-8?B?cTh5YzhMTUJvYkRqSitvZDFXanF4TjZjak1LRTVSOTZyeUk3aHZWZjQ4bHoy?= =?utf-8?B?dUhlY0QycllyQ0pGellENjdPYzFPaHFqK0RVdURuQTRDY0J3RTh4Vm1tZ1F6?= =?utf-8?B?b3pEb2RjSVhqbnJIWlk0TWhzUFZzYVExSW5kMC9ObEdKUldNeFFISGNOejhU?= =?utf-8?B?ekpkTDVod01vbkVUZXJubkFrS05OMk1Wc3I3dk9RRTUwNjM2TFhCeUVMVzJ6?= =?utf-8?B?blpRaUJ1Y2V1bGdUdGE0anQvMTZIQWF6UEhudjJaUWRzWlRkZkNSUlU2cytp?= =?utf-8?B?M3puTGtRaG1qWDdJUHdIc2dKUmxETjVnaE40cUVyaUNUL3lFMUFEc3orWWdK?= =?utf-8?B?R290SDRta2hORmUrYXhTb1E5ZFFZMkt6VFBRRVh3cjZHM2ErZG4xdnZsU3lw?= =?utf-8?B?Z2RJRnFHanNnRmNxQnJaWC9lclpyczFSbGJlQ2Q2cmpsQnloTllNUzg2TTZj?= =?utf-8?B?TDdUNVhxM1ZtV013Sy9jWmY0QVhySGVSeFNFOFdjcGovYjByZkU1WC82ajU4?= =?utf-8?B?TkZXd3M4L3dmZ2h2NkJnRmdiSkcwUDN0ZmxIa205K1dJUVFCL0FNWWtEOHV3?= =?utf-8?Q?TawzmqFbWHk4rsUELK8twa4RF/9wlCSRns/XifDyLVuh?= X-Microsoft-Exchange-Diagnostics: 1;DM5PR12MB1147;6:18rvpJLjIn4WigLSEN7JtpRfVBdiLoWR04zHAvWazR4TyyxFoSnf63d7cGHMayQKn8B98XwZxrb5qAWD4UY2ZU99m74EO1B+aSR6McZ6RCnUGkg28qD+luKppR9RxDnGkGxhtfpdpjnvnamRzxqW610RWuHSowXAKW6vQbGgRC49R7i8zpRkxCkYRkVCeONrxiESApWxIj2zUcxP+s5qOFppU+4czwLf5+Q/OL8zD6j1OUWl5x8fYZGxZ82om/j7Hi8ddDc4d+iuBfqDXvDk4dy+KY4WFDatDeqr5jNlCf636cAE/6sQK4wN5KTV/CN00AHKJoeos+mwJT8IEd+wDnaLLgkfwKwj0wgM2yi4esv3/dgKLrefOXYtMpXEEyTH6irR0oNfO5GWZbf0hC0HD6GtvURefBZ82Hz7fsOHLsw=;5:5uyITbegcklNBvCs1imDSuN9QZ/Ixvran3Mk+/H+b5XeDo8TcBuw2KpxRXcHbdJEiH7ryZ0XZVTBPxSysqO5fCZtGbUMxI/okg5r46JazGLP2/r+JkL2TeLSDaUqIluzzcf9IYh50eCjO8uF0oeg8A==;24:CYZSdYbDRVHaFnw/2Vr1H6Apq6vOao5ysbsRv5J1x4gW8Swh0+vy9UaPN1BCvwFEGxNANiIcSYGelq9CMEYMuU4E9a0nY7YO5aZhJ6hvUWM= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;DM5PR12MB1147;7:gHdPQIZ6rmgVDR7PgbsBCYlXlVxdFNPVRiwfcZfBPt6F5rZSlFqdKc+tL+n/eXAY1Y4yyAtujQV/CDWG33JZx094lePgd0i1Bl/qJOCH2aGF0RNpAOVX3ZOd+jHYDteDOsg/60D5dD/uxmiIji/3HCnz4wx7kGMgMJRVX+5IMmbAuFnp6CTosb9vOPbiiMLTCnEvZ29vP4JZxbBPcENkqFl4ZykG4ETyJNkMIgsbI3sOHV+t/o17CIJq1ar+nkzIOPfch4JsPatbE5TENk3Lfg6ILyRgL1ECnE/wlxctphqMR3vIKGQjIXgrXxd4TcJuKn9gWScfHylEka9pA6nDyg==;20:wLH3x4HMqzUv7cEwRwR3K7eE80yOSrJZQuL8rW/KKcnvwJVXS6vuiQjLb3b9hBnUNKpv9oE2z1qGwuZbs4RNFDE/ReqQyYd9vw65N8T0zZ6fue/lGE/WG7zeVsTFYZ8m/qCPqiEd9tAItxNJrtQWGxfgkYLst/5WVKLXmk+IfMJ0jA0KK+3j9fapwCX1McWZWwzL6RoVgojsQWypJi+8YFnnil++B05BxZW50gEAUn7UK9wzLHDUhR9ffWF+D7EO X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 Feb 2017 21:34:38.3976 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR12MB1147 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 2/21/2017 9:06 AM, Borislav Petkov wrote: > On Thu, Feb 16, 2017 at 09:45:09AM -0600, Tom Lendacky wrote: >> Boot data (such as EFI related data) is not encrypted when the system is >> booted and needs to be mapped decrypted. Add support to apply the proper >> attributes to the EFI page tables and to the early_memremap and memremap >> APIs to identify the type of data being accessed so that the proper >> encryption attribute can be applied. > > So this doesn't even begin to explain *why* we need this. The emphasis > being on *why*. > > Lemme guess? kexec? And because of efi_reuse_config? Hmm... maybe I'm missing something here. This doesn't have anything to do with kexec or efi_reuse_config. This has to do with the fact that when a system boots the setup data and the EFI data are not encrypted. Since it's not encrypted we need to be sure that any early_memremap() and memremap() calls remove the encryption mask from the resulting pagetable entry that is created so the data can be accessed properly. > > If so, then that whole ad-hoc caching in parse_setup_data() needs to go. > Especially if efi_reuse_config() already sees those addresses so while > we're there, we could save them somewhere or whatnot. But not doing the > whole thing again in parse_setup_data(). > >> Signed-off-by: Tom Lendacky >> --- >> arch/x86/include/asm/io.h | 3 + >> arch/x86/include/asm/setup.h | 8 +++ >> arch/x86/kernel/setup.c | 33 ++++++++++++ >> arch/x86/mm/ioremap.c | 111 ++++++++++++++++++++++++++++++++++++++++ >> arch/x86/platform/efi/efi_64.c | 16 ++++-- >> kernel/memremap.c | 11 ++++ >> mm/early_ioremap.c | 18 +++++- >> 7 files changed, 192 insertions(+), 8 deletions(-) >> >> diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h >> index 7afb0e2..833f7cc 100644 >> --- a/arch/x86/include/asm/io.h >> +++ b/arch/x86/include/asm/io.h >> @@ -381,4 +381,7 @@ extern int __must_check arch_phys_wc_add(unsigned long base, >> #define arch_io_reserve_memtype_wc arch_io_reserve_memtype_wc >> #endif >> >> +extern bool arch_memremap_do_ram_remap(resource_size_t offset, size_t size); >> +#define arch_memremap_do_ram_remap arch_memremap_do_ram_remap >> + >> #endif /* _ASM_X86_IO_H */ >> diff --git a/arch/x86/include/asm/setup.h b/arch/x86/include/asm/setup.h >> index ac1d5da..99998d9 100644 >> --- a/arch/x86/include/asm/setup.h >> +++ b/arch/x86/include/asm/setup.h >> @@ -63,6 +63,14 @@ static inline void x86_ce4100_early_setup(void) { } >> #include >> #include >> >> +struct setup_data_attrs { >> + u64 paddr; >> + unsigned long size; >> +}; >> + >> +extern struct setup_data_attrs setup_data_list[]; >> +extern unsigned int setup_data_list_count; >> + >> /* >> * This is set up by the setup-routine at boot-time >> */ >> diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c >> index bd5b9a7..d2234bf 100644 >> --- a/arch/x86/kernel/setup.c >> +++ b/arch/x86/kernel/setup.c >> @@ -148,6 +148,9 @@ int default_check_phys_apicid_present(int phys_apicid) >> >> struct boot_params boot_params; >> >> +struct setup_data_attrs setup_data_list[32]; >> +unsigned int setup_data_list_count; >> + >> /* >> * Machine setup.. >> */ >> @@ -419,6 +422,32 @@ static void __init reserve_initrd(void) >> } >> #endif /* CONFIG_BLK_DEV_INITRD */ >> >> +static void __init update_setup_data_list(u64 pa_data, unsigned long size) >> +{ >> + unsigned int i; >> + >> + for (i = 0; i < setup_data_list_count; i++) { >> + if (setup_data_list[i].paddr != pa_data) >> + continue; >> + >> + setup_data_list[i].size = size; >> + break; >> + } >> +} >> + >> +static void __init add_to_setup_data_list(u64 pa_data, unsigned long size) >> +{ >> + if (!sme_active()) >> + return; >> + >> + if (!WARN(setup_data_list_count == ARRAY_SIZE(setup_data_list), >> + "exceeded maximum setup data list slots")) { >> + setup_data_list[setup_data_list_count].paddr = pa_data; >> + setup_data_list[setup_data_list_count].size = size; >> + setup_data_list_count++; >> + } >> +} >> + >> static void __init parse_setup_data(void) >> { >> struct setup_data *data; >> @@ -428,12 +457,16 @@ static void __init parse_setup_data(void) >> while (pa_data) { >> u32 data_len, data_type; >> >> + add_to_setup_data_list(pa_data, sizeof(*data)); >> + >> data = early_memremap(pa_data, sizeof(*data)); >> data_len = data->len + sizeof(struct setup_data); >> data_type = data->type; >> pa_next = data->next; >> early_memunmap(data, sizeof(*data)); >> >> + update_setup_data_list(pa_data, data_len); >> + >> switch (data_type) { >> case SETUP_E820_EXT: >> e820__memory_setup_extended(pa_data, data_len); >> diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c >> index 2385e70..b0ff6bc 100644 >> --- a/arch/x86/mm/ioremap.c >> +++ b/arch/x86/mm/ioremap.c >> @@ -13,6 +13,7 @@ >> #include >> #include >> #include >> +#include >> >> #include >> #include >> @@ -21,6 +22,7 @@ >> #include >> #include >> #include >> +#include >> >> #include "physaddr.h" >> >> @@ -419,6 +421,115 @@ void unxlate_dev_mem_ptr(phys_addr_t phys, void *addr) >> iounmap((void __iomem *)((unsigned long)addr & PAGE_MASK)); >> } >> >> +/* >> + * Examine the physical address to determine if it is boot data. Check >> + * it against the boot params structure and EFI tables. >> + */ >> +static bool memremap_is_setup_data(resource_size_t phys_addr, >> + unsigned long size) >> +{ >> + unsigned int i; >> + u64 paddr; >> + >> + for (i = 0; i < setup_data_list_count; i++) { >> + if (phys_addr < setup_data_list[i].paddr) >> + continue; >> + >> + if (phys_addr >= (setup_data_list[i].paddr + >> + setup_data_list[i].size)) >> + continue; >> + >> + /* Address is within setup data range */ >> + return true; >> + } >> + >> + paddr = boot_params.efi_info.efi_memmap_hi; >> + paddr <<= 32; >> + paddr |= boot_params.efi_info.efi_memmap; >> + if (phys_addr == paddr) >> + return true; >> + >> + paddr = boot_params.efi_info.efi_systab_hi; >> + paddr <<= 32; >> + paddr |= boot_params.efi_info.efi_systab; >> + if (phys_addr == paddr) >> + return true; >> + >> + if (efi_table_address_match(phys_addr)) >> + return true; >> + >> + return false; >> +} >> + >> +/* >> + * This function determines if an address should be mapped encrypted. >> + * Boot setup data, EFI data and E820 areas are checked in making this >> + * determination. >> + */ >> +static bool memremap_should_map_encrypted(resource_size_t phys_addr, >> + unsigned long size) >> +{ >> + /* >> + * SME is not active, return true: >> + * - For early_memremap_pgprot_adjust(), returning true or false >> + * results in the same protection value >> + * - For arch_memremap_do_ram_remap(), returning true will allow >> + * the RAM remap to occur instead of falling back to ioremap() >> + */ >> + if (!sme_active()) >> + return true; >> + >> + /* Check if the address is part of the setup data */ >> + if (memremap_is_setup_data(phys_addr, size)) >> + return false; >> + >> + /* Check if the address is part of EFI boot/runtime data */ >> + switch (efi_mem_type(phys_addr)) { > > arch/x86/built-in.o: In function `memremap_should_map_encrypted': > /home/boris/kernel/alt-linux/arch/x86/mm/ioremap.c:487: undefined reference to `efi_mem_type' > make: *** [vmlinux] Error 1 > > That's a !CONFIG_EFI .config. Missed that, I'll fix it. > >> + case EFI_BOOT_SERVICES_DATA: >> + case EFI_RUNTIME_SERVICES_DATA: >> + return false; >> + default: >> + break; >> + } >> + >> + /* Check if the address is outside kernel usable area */ >> + switch (e820__get_entry_type(phys_addr, phys_addr + size - 1)) { >> + case E820_TYPE_RESERVED: >> + case E820_TYPE_ACPI: >> + case E820_TYPE_NVS: >> + case E820_TYPE_UNUSABLE: >> + return false; >> + default: >> + break; >> + } >> + >> + return true; >> +} >> + >> +/* >> + * Architecure function to determine if RAM remap is allowed. >> + */ >> +bool arch_memremap_do_ram_remap(resource_size_t phys_addr, unsigned long size) >> +{ >> + return memremap_should_map_encrypted(phys_addr, size); >> +} >> + >> +/* >> + * Architecure override of __weak function to adjust the protection attributes >> + * used when remapping memory. >> + */ >> +pgprot_t __init early_memremap_pgprot_adjust(resource_size_t phys_addr, >> + unsigned long size, >> + pgprot_t prot) >> +{ >> + if (memremap_should_map_encrypted(phys_addr, size)) >> + prot = pgprot_encrypted(prot); >> + else >> + prot = pgprot_decrypted(prot); >> + >> + return prot; >> +} >> + >> #ifdef CONFIG_ARCH_USE_MEMREMAP_PROT >> /* Remap memory with encryption */ >> void __init *early_memremap_encrypted(resource_size_t phys_addr, >> diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c >> index 2ee7694..2d8674d 100644 >> --- a/arch/x86/platform/efi/efi_64.c >> +++ b/arch/x86/platform/efi/efi_64.c >> @@ -243,7 +243,7 @@ void efi_sync_low_kernel_mappings(void) >> >> int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages) >> { >> - unsigned long pfn, text; >> + unsigned long pfn, text, pf; >> struct page *page; >> unsigned npages; >> pgd_t *pgd; >> @@ -251,7 +251,13 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages) >> if (efi_enabled(EFI_OLD_MEMMAP)) >> return 0; >> >> - efi_scratch.efi_pgt = (pgd_t *)__pa(efi_pgd); >> + /* >> + * Since the PGD is encrypted, set the encryption mask so that when >> + * this value is loaded into cr3 the PGD will be decrypted during >> + * the pagetable walk. >> + */ >> + efi_scratch.efi_pgt = (pgd_t *)__sme_pa(efi_pgd); >> + >> pgd = efi_pgd; >> >> /* >> @@ -261,7 +267,8 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages) >> * phys_efi_set_virtual_address_map(). >> */ >> pfn = pa_memmap >> PAGE_SHIFT; >> - if (kernel_map_pages_in_pgd(pgd, pfn, pa_memmap, num_pages, _PAGE_NX | _PAGE_RW)) { >> + pf = _PAGE_NX | _PAGE_RW | _PAGE_ENC; >> + if (kernel_map_pages_in_pgd(pgd, pfn, pa_memmap, num_pages, pf)) { >> pr_err("Error ident-mapping new memmap (0x%lx)!\n", pa_memmap); >> return 1; >> } >> @@ -304,7 +311,8 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages) >> text = __pa(_text); >> pfn = text >> PAGE_SHIFT; >> >> - if (kernel_map_pages_in_pgd(pgd, pfn, text, npages, _PAGE_RW)) { >> + pf = _PAGE_RW | _PAGE_ENC; >> + if (kernel_map_pages_in_pgd(pgd, pfn, text, npages, pf)) { >> pr_err("Failed to map kernel text 1:1\n"); >> return 1; >> } > > Those changes should be in a separate patch IMHO. I can break out the mapping changes from the EFI pagetable changes. Thanks, Tom >