From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932527AbdBPPn1 (ORCPT ); Thu, 16 Feb 2017 10:43:27 -0500 Received: from mail-sn1nam02on0053.outbound.protection.outlook.com ([104.47.36.53]:5267 "EHLO NAM02-SN1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S932277AbdBPPnV (ORCPT ); Thu, 16 Feb 2017 10:43:21 -0500 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Thomas.Lendacky@amd.com; From: Tom Lendacky Subject: [RFC PATCH v4 05/28] x86: Add Secure Memory Encryption (SME) support To: , , , , , , , , CC: Rik van Riel , Radim =?utf-8?b?S3LEjW3DocWZ?= , Toshimitsu Kani , Arnd Bergmann , Jonathan Corbet , Matt Fleming , "Michael S. Tsirkin" , Joerg Roedel , Konrad Rzeszutek Wilk , Paolo Bonzini , Brijesh Singh , Ingo Molnar , Alexander Potapenko , Andy Lutomirski , "H. Peter Anvin" , Borislav Petkov , Andrey Ryabinin , Thomas Gleixner , Larry Woodman , Dmitry Vyukov Date: Thu, 16 Feb 2017 09:43:07 -0600 Message-ID: <20170216154307.19244.72895.stgit@tlendack-t1.amdoffice.net> In-Reply-To: <20170216154158.19244.66630.stgit@tlendack-t1.amdoffice.net> References: <20170216154158.19244.66630.stgit@tlendack-t1.amdoffice.net> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-Originating-IP: [165.204.77.1] X-ClientProxiedBy: MWHPR07CA0007.namprd07.prod.outlook.com (10.172.94.17) To CY4PR12MB1143.namprd12.prod.outlook.com (10.168.164.135) X-MS-Office365-Filtering-Correlation-Id: b7f0a070-a13b-4340-7b6c-08d456828495 X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(48565401081);SRVR:CY4PR12MB1143; X-Microsoft-Exchange-Diagnostics: 1;CY4PR12MB1143;3:VqsHxb3IESDyLrq1tuvbIb39WV0xEVE0lsvJwEFyB17Afl/dmIaZGqf7aRjOrk6TpBPAiSG7Y+uzhLg26z/vrRMbVqSv0iFdTMgsftM/zU2uoBLwBzFL9yPYR8afLgPZpo5QkppUQXU3YlRinKhAfO4kkLvpN3QxoJUFpVX3PVpbB4ZJoWBs0AJS50+wqJfvxH3BekaDss2KyRHU0ntqsG/ECxcPdwVFvMfOsLI/9h3XpErwvjmdTowAiDIwdJHecA0U+tzS66puAI3L+MNgm44F/5Mctac0+BuuLu5OfN0=;25:0TyJ7wtucYbr9qqqWHkUsTCtd3Q9dSXGB7K9CcF68D50As4aYB+fV8RnDs8R8urVWi3jq38JqORIJsEE8eXHEsrzv1X2Z3+xSAVKQYeCdz5u+x+LcrWEYF1LdIueGPtoUbVSlvxQfBW5bfTHaF7SMpLSHeinn7/8Q3dHJRQm/jA3dPHtyHt1akQu22pf+kM8bBHjm63/ID41qB0MXQPxi6zTVlGQ65RANWo+PoSC8TgKR+eUlCaJrP1q2uePXvlycyH8K9dEqDaZXA6/VIyhf3vT+Ux0TxU3108WldxTkleyOexfxAq8ex4KJId0S5EEiXNWQ4xrIncYIsdIgYj5PImYaNdq9k5KwcQ9Pfk67qkPmtTZtF6sFcFNVytvzcneW0Iy8Zew3/PYLdTRDv/WVQ7SFkPgUgQAnlJzrmJ6enIJmfuV5SQufIpNl7lhZSX+EzVqCJSQPqWjuLMTO13B7w== X-Microsoft-Exchange-Diagnostics: 1;CY4PR12MB1143;31:pg4c15DGyyLmhAWMW9l/gtAqA+WzIbgbe69B4nL0DPOVV7xi+Q2yETiTNfszGpDfk/i8JZ+ZfuhEhbfo04OY3gdWwQKQOXYCbJwY2Tj5/ifwZN8iQE9zY2Vkf6nm4hlcut85baoIKqwe9jpiITMR0x6wX+j+2srxQuNgexTtegDLqWg56XLPjKbPOfzi1wh1RarY7x65h1bbHOHy68zdgBJTKWqnL+WRjNwfKPDQycUv8NWmYKwoFL3RsJvDItL9;20:OFRoUD12ubxjyqseAW37dQvTPPosaE/bom68HMXOZbH6ttsbGqOXdvdeIOI/EfQ5H99GRSB+VDAMBbmoDagitwKmF8QyNZ2h5SqhiDkSjU4mDCUe+/+XP0C/RMMGPcuXMtzzafEndCAYTPqArI/YwnRyFVOWLoJ9zgdFdXB+KkOkH3bhwMf/eHs6+pvZT1GzfSOfumb8wJpk8p0VHta+dlvAak/TBGY2ioJPZ47uwA6Q51WXJ9dzzyVWhMq4tGl5bEFMDfSa5n61yHeg32kuIvmzY4O9EG/vK4f89z4JrEAOQIGRqqksbDEqWch0n/4eVOqWIR8sTRdCUppB8QR0YgCABUp/wn9DUw5taZYvmSifpsfYtqJuwm4HIHRJu+/I3GZU+X9q+O7B7/EBgDl329SeaT0VDyqaUDVkCm6i9Fj4cjLOtnx7V/sz/IXore2PYsxRml3nuNt8jBUh1IfkDS0CZ9wkOC/cdB8LxRObrxfk+5ZzsvqRnTQKlmeTeRrl X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(767451399110); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040375)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(6041248)(20161123560025)(20161123555025)(20161123558025)(20161123562025)(20161123564025)(6072148);SRVR:CY4PR12MB1143;BCL:0;PCL:0;RULEID:;SRVR:CY4PR12MB1143; X-Microsoft-Exchange-Diagnostics: 1;CY4PR12MB1143;4:yCKjV+81YlDUdaEin34bZm3CBa9sOV3t/FoCxWsIxpmpuA/soCq0XkJvxH8CRN4q1QFSZx/DZNtOwJR9lP3GY2ystnhFxH9PNXD8UElzq4Zn5kyJMj6Ao/8GBWye8scTC+zr5uNSenDkpvihLzRgfCxtCAuYXxueYs9pPempHOQ7X9JTHyufUTKTsESU2OZtYruTFbYaw91EhnfpbIGHSJ7MCIxedZbIpuH1+u1LYjctgbu4c36W9sa1uSEnKaNdwye/eiyPFmebJjYt3DMBe9G0YDaQCtO5ubnsuZ5lmFWuqXZCZ+EeM1TlyPN/u/9TRlwotNtbZzeVhO+y+Dyg0ULxnpPsOGrtJRPVGfcZhaTElfSJOs2RSoMENXXSMvX3v3ARONAL1YzjCmOoo5fpbRRBj6d1AWrEtHAk6tM8PSGYoFAb1wGhlfV2vLD9n18xYFUNdK5FkjsfmmSiDb161MzqYLmfapS+Szcf5wFDBQgbMgWizBc+A/iLsy215y7cIXIYDjkQx9qu+FPifAFE7BmgqCQSKL9vPbsvJavuccxQiIYoFuh3RbmCyMovngpa55qim7uKSumaCVaWtAQbXp/dEUdOPKUsv28J4WZr8wpZ4Bz3sjZV0ox7tcxgWkdlMFaZsv0Ajzwka8rgSpB6DZCQXtn67VNXnOWSZhFNCHs= X-Forefront-PRVS: 0220D4B98D X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(4630300001)(6009001)(7916002)(39860400002)(39840400002)(39450400003)(39850400002)(39410400002)(199003)(189002)(101416001)(7736002)(83506001)(76176999)(2950100002)(50986999)(7416002)(103116003)(81156014)(81166006)(5660300001)(97746001)(389900003)(54906002)(55016002)(6666003)(33646002)(9686003)(8676002)(54356999)(305945005)(6116002)(2906002)(50466002)(92566002)(189998001)(25786008)(23676002)(47776003)(4001350100001)(66066001)(6506006)(38730400002)(42186005)(53936002)(69596002)(2201001)(230700001)(3846002)(86362001)(4326007)(1076002)(105586002)(53416004)(97736004)(106356001)(68736007)(2004002)(71626007)(217873001);DIR:OUT;SFP:1101;SCL:1;SRVR:CY4PR12MB1143;H:tlendack-t1.amdoffice.net;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtDWTRQUjEyTUIxMTQzOzIzOmc4NFRXbk5ZTCtGaHY0a0pWL0hxa2Nvc2E2?= =?utf-8?B?RVdISkh0VHB3ZnAzc3ViZjNyTmI0anN5WS81b2xuQlg3ZFhLeVQySkN3QzY0?= =?utf-8?B?K3JBMVhheXZnVW5Td0FPbENZRXRqWVRSL2ZCN281NDdkc0dSQ0xUVFI2S3JU?= =?utf-8?B?RVVWWUN6N0JucGFkNnErZkQ5cWI2cXIzYlYwcERmRDVQRWZVaEdkMEJ2eVNX?= =?utf-8?B?QzQzRi8vY044Q1dwelZzVUlrSmdzN0pTQkZxUmhHbEliaGtpRmRUU3BLWWNx?= =?utf-8?B?aFVpa2phaG56T0JNbTdvTHVCK0NUV3VlRjNEa0Y0Mno4YnRPWVpERWI0UGxx?= =?utf-8?B?U1JZdS8vejZDZ1pwVkp6dzVSV2dtVWRsU2x6WDhtVnhBcEV0NUg1R1dVeTlz?= =?utf-8?B?NVVEVWJtUEtzYVZDZTl6YStkS0k0OHdkWENQeUVDUUZJWitaSk4wSlljcTNp?= =?utf-8?B?TlpPVlZXK1hRR0hZMy83WG1WL1U2a1F3UUNsOUxNZUZleUdXaXdwYjJkYzBa?= =?utf-8?B?OHNhODQ2MzgxMTlpaWROWTdUYkpHUFJrdHQvSUFxRDdoYVJKU21DaW5jWmds?= =?utf-8?B?eW01T1NOR3dsb3FGNFRLekFaRXdJdTFrWVUvd25oWUNYK2VwL2ZyN0xnb2s0?= =?utf-8?B?VkZ3N1g5NXJpd2g2K25uZzhmVlYwNllhcStOcDIxTHpuNS9HamZUTWJWVFZ3?= =?utf-8?B?M1FPUWdHQStIbm5CUFhVeE1ROXlFQ3lpN1FFUFd6MnhUaHVtMXBTbTlOLzZM?= =?utf-8?B?Z1ZDK3JReWl6ZXo0UFp6WUNsSEtGTnQrNWMxY1R5RjdnTUs0Vm1VRmY0NjJM?= =?utf-8?B?WU50VW5Ud3B4djhCNW9sNTBSSW8xeDdjSUc1ZGUxeWFVd0U1ZXh1L2t0UU1r?= =?utf-8?B?SUMzSVVsRE9pUUVKbllQdHpLblhWblhwSmJIZGlmbHNuenFGcTlwNDc3QUZH?= =?utf-8?B?RGhjYVhiMExyNzFCVDlUeUE1THRrQmdOL2l5UnNxcFBhRDRzWTVickx4Z1Vt?= =?utf-8?B?YzJHaWQ3SUIxbjRjMjFmNlEvMmVpNUh5RlhHS1hDTHBrMWpyaUo3WFRLL01T?= =?utf-8?B?RnJDMXVNVTZSYUV6aTlieThGWlFINlgvSXhMeUtsd2hkTjNkajhhQnRFSkVs?= =?utf-8?B?bnJtUmxpQVNVZEYzMmdqOWZYQnZ3R1dDWWh5eHNoR05hNDRUeHFsaEEwa0RC?= =?utf-8?B?SkJWa3IwLzR2RFNacFVNY2VWbXVxYzRIUHAxemVFdExYTHFHeEZyZTdiTkMz?= =?utf-8?B?Vk9uVXZUbjJPS1FPSStPUkpqbmpQdUlxOWdPWktndUk0WDIyZHZYTW9Dc2o1?= =?utf-8?B?czhNcUVGNVRQMit3YW5CaEZseU8wSW43SCs4KzAyZ20zdWFLNlNTdm9SMGNN?= =?utf-8?B?UUw4bDNBbHNjWldZT0k2Q3BVTkh3VG9VZDU2bEVKTXRHNDY2TUdidDR1UjM1?= =?utf-8?B?SE1CNkViR2M4SGVleG5yTUg1emtFMWNQM244d1BXd3VkdWFaMjVQOVZYV1pn?= =?utf-8?B?SXhIdysvM3ZNdWd1MzdHZ29nSnlBQ2NmTUlGUXJ2bzVYd2xXT01lMWRFVWRo?= =?utf-8?B?T2RQU1lRQWlNbHEzbG83U084UHNqUmVvQWVoaGRFTXI4dTFKV3g1Q2hmNnMw?= =?utf-8?B?a3k3d2grTVgzZm9PR2I0RGhIbFk2cEMzb0FHQTYwaWdoOEUvOVArcEx5Tnc0?= =?utf-8?B?YVNVUzZvNEh1Z1dYa3E5b3ZrNkxoVnNDS20zZ3luY012VGVFek1OUEQ1Tnpw?= =?utf-8?B?MTBIUlZFeXptRlZHZmZRb3p0cGVML1cxMHFVZnFROTlPT3JBdzNkK1NLSFlx?= =?utf-8?B?UHpNYVhmNzNIaHhqWlNaM1ZaV1h0ZVBUdElTU1hGeWtST0wwYVREVlJjOVFS?= =?utf-8?B?UlFXa1pxVDkyd1NxRG44amUzcXZvd1JmSm0vSVFKdmVXZWdyRHp6WW1Wd29D?= =?utf-8?Q?TdulqUbMibRkPOA98vbqJTLIMB5vOM=3D?= X-Microsoft-Exchange-Diagnostics: 1;CY4PR12MB1143;6:styytnZFrUCr8fr+fl7BSgdYHjsHe18LtTt27QHQRYyWG9TaNgV7WFVnxsslAB3tF8urotx5zL7P4j7vN3hdeeS/ltzkRkid7ttHSepLgibwcSaqmv8+lf1TplQjxSdCgtIzj87WCFtvpUkDFMYtOJDSkh1l+fQGljNXulua+6NFCuLhHKy7IYukOFzc29qwroWVWAmaYPOYQrjY8SMFQJQdYGXaD5LFEsavMO80jAIgiNL8+fEymLeYl8KIobylju62uHsvkNN6XDtUY246WMe7CXQvEnKDoSkHvu2pUbATXgj5FsWQ4U8PTUrtJj1X2fuNo19TMVWnRl3h/81q7loJClT15PuIf30r6h6lETzBTCYFhAON2K/IybEX/mqJEmQv8Pxe+ciWIcnQAeevkTyc1QecZqqm8Jl2dBhJH1k=;5:Rc5x8/F+h++txy4kJr+xYmYNgwquIkMG1PjclNojawDok8YADgs5YLOYsOZmWAwauXpSqtRIifJVWzKc7YOpRUZeYQX6XF1eaE8LO9tPxxFWgIf86P9Am2eIG2QyhlsyX959ue//Lzwsm9fR2Spl5Q==;24:50OxqSrYQaSGAQkWU3SJcQ2j6dgqK2e2NeUgMm3Akx+r9RDyYPRjbUp4MQaeqVYIiMllFdnMH+SuHFBUPA14sBLPdAKvT3iBGNHAp4LK5zw= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;CY4PR12MB1143;7:9uBAOZI2g5/oLKg5j9eHCnN8SvWgDBiG0KOQNy/N+nc3oq8h8cJr8IrXbBvVE0CUVHYmJxpTqEstox7R/dPJ9wV51/TyZmstzeXIh1jJmM8eoJdep546oqr3e9ieeaMz7XJQltZP6lMO1ZWuG8gZk4RkTdhekls9E1VqtQaj74IRdLQwsCZobIwvoDVaR3YCA9Ygi+y1PcI1tyj6apcI2eX5PlyYS8faxXq1eZczVSXWP+ldsKBFux98gn/vmDxA1PiCu/PGjH4dQqvlhUQ0eLLdMD8TKyxuyVi06FT7tdo7d3CIEvY1Xzao+ekiBI0FBII8OThJe+CPiNH3KtEptw==;20:ICpRH+AriSY/nfcafHESPDnTzvCbNI8HFtWdo8i+Zol8r2kmJKr1uytY9w5EWSTbc7wIgxkLaFDjzN7xgeWMksrPal3AlxEo+M7t5/iCQXDJTVvSpfk5J3upLk5GnAeykc+bNcope0PqLgxopSghnxwPr1HyEc9Xb3ggoYnRcxG4LVrarRtYl2A9h96Ka8xgc7tSCOgNBkq0wlO0SwncQBWPDnDc4X6WG+OZVCgy2HKV8N1Dgf+T+jct8d6aGoDs X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Feb 2017 15:43:11.2258 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR12MB1143 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Add support for Secure Memory Encryption (SME). This initial support provides a Kconfig entry to build the SME support into the kernel and defines the memory encryption mask that will be used in subsequent patches to mark pages as encrypted. Signed-off-by: Tom Lendacky --- arch/x86/Kconfig | 22 +++++++++++++++++++ arch/x86/include/asm/mem_encrypt.h | 42 ++++++++++++++++++++++++++++++++++++ arch/x86/mm/Makefile | 1 + arch/x86/mm/mem_encrypt.c | 21 ++++++++++++++++++ include/linux/mem_encrypt.h | 37 ++++++++++++++++++++++++++++++++ 5 files changed, 123 insertions(+) create mode 100644 arch/x86/include/asm/mem_encrypt.h create mode 100644 arch/x86/mm/mem_encrypt.c create mode 100644 include/linux/mem_encrypt.h diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index f8fbfc5..a3b8c71 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -1395,6 +1395,28 @@ config X86_DIRECT_GBPAGES supports them), so don't confuse the user by printing that we have them enabled. +config AMD_MEM_ENCRYPT + bool "AMD Secure Memory Encryption (SME) support" + depends on X86_64 && CPU_SUP_AMD + ---help--- + Say yes to enable support for the encryption of system memory. + This requires an AMD processor that supports Secure Memory + Encryption (SME). + +config AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT + bool "Activate AMD Secure Memory Encryption (SME) by default" + default y + depends on AMD_MEM_ENCRYPT + ---help--- + Say yes to have system memory encrypted by default if running on + an AMD processor that supports Secure Memory Encryption (SME). + + If set to Y, then the encryption of system memory can be + deactivated with the mem_encrypt=off command line option. + + If set to N, then the encryption of system memory can be + activated with the mem_encrypt=on command line option. + # Common NUMA Features config NUMA bool "Numa Memory Allocation and Scheduler Support" diff --git a/arch/x86/include/asm/mem_encrypt.h b/arch/x86/include/asm/mem_encrypt.h new file mode 100644 index 0000000..ccc53b0 --- /dev/null +++ b/arch/x86/include/asm/mem_encrypt.h @@ -0,0 +1,42 @@ +/* + * AMD Memory Encryption Support + * + * Copyright (C) 2016 Advanced Micro Devices, Inc. + * + * Author: Tom Lendacky + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + */ + +#ifndef __X86_MEM_ENCRYPT_H__ +#define __X86_MEM_ENCRYPT_H__ + +#ifndef __ASSEMBLY__ + +#ifdef CONFIG_AMD_MEM_ENCRYPT + +extern unsigned long sme_me_mask; + +static inline bool sme_active(void) +{ + return (sme_me_mask) ? true : false; +} + +#else /* !CONFIG_AMD_MEM_ENCRYPT */ + +#ifndef sme_me_mask +#define sme_me_mask 0UL + +static inline bool sme_active(void) +{ + return false; +} +#endif + +#endif /* CONFIG_AMD_MEM_ENCRYPT */ + +#endif /* __ASSEMBLY__ */ + +#endif /* __X86_MEM_ENCRYPT_H__ */ diff --git a/arch/x86/mm/Makefile b/arch/x86/mm/Makefile index 96d2b84..44d4d21 100644 --- a/arch/x86/mm/Makefile +++ b/arch/x86/mm/Makefile @@ -39,3 +39,4 @@ obj-$(CONFIG_X86_INTEL_MPX) += mpx.o obj-$(CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS) += pkeys.o obj-$(CONFIG_RANDOMIZE_MEMORY) += kaslr.o +obj-$(CONFIG_AMD_MEM_ENCRYPT) += mem_encrypt.o diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c new file mode 100644 index 0000000..b99d469 --- /dev/null +++ b/arch/x86/mm/mem_encrypt.c @@ -0,0 +1,21 @@ +/* + * AMD Memory Encryption Support + * + * Copyright (C) 2016 Advanced Micro Devices, Inc. + * + * Author: Tom Lendacky + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + */ + +#include + +/* + * Since SME related variables are set early in the boot process they must + * reside in the .data section so as not to be zeroed out when the .bss + * section is later cleared. + */ +unsigned long sme_me_mask __section(.data) = 0; +EXPORT_SYMBOL_GPL(sme_me_mask); diff --git a/include/linux/mem_encrypt.h b/include/linux/mem_encrypt.h new file mode 100644 index 0000000..14a7b9f --- /dev/null +++ b/include/linux/mem_encrypt.h @@ -0,0 +1,37 @@ +/* + * AMD Memory Encryption Support + * + * Copyright (C) 2016 Advanced Micro Devices, Inc. + * + * Author: Tom Lendacky + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + */ + +#ifndef __MEM_ENCRYPT_H__ +#define __MEM_ENCRYPT_H__ + +#ifndef __ASSEMBLY__ + +#ifdef CONFIG_AMD_MEM_ENCRYPT + +#include + +#else /* !CONFIG_AMD_MEM_ENCRYPT */ + +#ifndef sme_me_mask +#define sme_me_mask 0UL + +static inline bool sme_active(void) +{ + return false; +} +#endif + +#endif /* CONFIG_AMD_MEM_ENCRYPT */ + +#endif /* __ASSEMBLY__ */ + +#endif /* __MEM_ENCRYPT_H__ */