From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755541AbdDRVO2 (ORCPT ); Tue, 18 Apr 2017 17:14:28 -0400 Received: from mail-by2nam01on0060.outbound.protection.outlook.com ([104.47.34.60]:39680 "EHLO NAM01-BY2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1754819AbdDRVOV (ORCPT ); Tue, 18 Apr 2017 17:14:21 -0400 Authentication-Results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=amd.com; From: Tom Lendacky Subject: [PATCH v5 01/32] x86: Documentation for AMD Secure Memory Encryption (SME) To: , , , , , , , , , CC: Rik van Riel , Radim =?utf-8?b?S3LEjW3DocWZ?= , Toshimitsu Kani , Arnd Bergmann , Jonathan Corbet , Matt Fleming , "Michael S. Tsirkin" , Joerg Roedel , Konrad Rzeszutek Wilk , Paolo Bonzini , Larry Woodman , Brijesh Singh , Ingo Molnar , Borislav Petkov , Andy Lutomirski , "H. Peter Anvin" , Andrey Ryabinin , Alexander Potapenko , Dave Young , Thomas Gleixner , Dmitry Vyukov Date: Tue, 18 Apr 2017 16:14:11 -0500 Message-ID: <20170418211411.9689.14957.stgit@tlendack-t1.amdoffice.net> In-Reply-To: <20170418211400.9689.10175.stgit@tlendack-t1.amdoffice.net> References: <20170418211400.9689.10175.stgit@tlendack-t1.amdoffice.net> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-Originating-IP: [165.204.77.1] X-ClientProxiedBy: MWHPR10CA0012.namprd10.prod.outlook.com (10.172.48.22) To MWHPR12MB1151.namprd12.prod.outlook.com (10.169.204.15) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 33100ba3-6820-4543-3289-08d4869fdeaf X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(48565401081)(201703131423075)(201703031133081);SRVR:MWHPR12MB1151; X-Microsoft-Exchange-Diagnostics: 1;MWHPR12MB1151;3:bhmU52EPXKaTxXk5OYD/NUoOmNaxr3S2y8ZXMl7CR0WRq1Pdb8e45z4f/t54sTFZBHUI0ORUIul0GrwznKUu8oRnAGao9FS/i/o4keCOVJZiBE9P5OWs+2WSkOAA/1/WADS2tC2omYdy1Wn2SIqseWLfPYM+hSryR987+pw20Q/aJQZj/MzCRz+s+RjfdwNjwkE12NAOx+q/Vo5FxrP3KCC2TUr1k6d+pbHetYli9g7epKTpDmteEH6wYLurYXYlEeUaLCkhI/5d6tx0AV4Jo+SkJnskAxaDcIoVYeDxPnWicA9xJfJEH/JB1C98tyM86ZLMMKiFC0cVPJtyP/scB5A3pkn5jKeTVEsgYSdYOQw=;25:RMDp+O33nC2k16KhLgJ8kJ0/MQyX7CQlityUAkyP6EvUKrnj9mu9uRZyCHFBTogQ3mQOoqeOW+NysdhZvlJpX58T+Fbe7hAb8afXsUpK3J3UEBE3NJSbuaWzlCjkwcC5RoPJvbBjZenMOTj8EAS+6OwCZkIaL3OwVUVms7F7TKC7HIlEXnnp2GcwCcm1CjTaU749iSLQfcYtDhlXaNXUNpX1lz9nZ6Cg7GcXiiFLkd6NabRiHUFZPDNyVqEPpisu4m/JphDHL72PB6hBOhzMdVJWdSGgpED1Lrkk4gu14OHqsBFaLqV2WHELI/zN6dI2axjK+XfZupADfpCsDuQTy/6mtcb5QlY9AfR7uLTbkE2SQZI5XePtUhiayIOjBVxB7M/+pUYQET20agJb9dw5CuJ2K5U6gBbfUZrs3RAiJRxwb1uWJ5CN9lQuKWrmjqzet48NlyYdwe/Ooindxd6ecg== X-Microsoft-Exchange-Diagnostics: 1;MWHPR12MB1151;31:KM9ksDHWT724v2D54CV1dIE6gxreveqgMfJF8EXxEkthU2LzWV2LoDkIZZVFis6wJgEatLf/ijo2cV5cScxDy9kERHYTCMuhWtFB6oi442n3f7Syph2XERrS3lg0zw770dFMZoBEhad0ZrXDgP8cpJoMshaRyNMtfXkTNIV/Tr1u203X5XKL2GLYNrsoy4UB2B3XyIskOFK+snCqmm/ILrDsMaywH/RmngiaATFi5aI=;20:lLXcccHwKM8/bbj+6eZYYuZEl/Qk7288OHlKDjM+uHL0Iod27g/+C+cnbdIF6A00zF85uSXjHl5LMJ85ZIn66udG+nKupKW9Go2oLi9sKQPSnOum44tvSgT8N2jLeCFiNPeJeT5a9bADWdfQs20qcdYo/RNXMMQQvbUArlRdUTtWsk8f6Vn6jZ/FKAmIpwLLO9Xh9taqb3xOMjEuzudMqxpl9+1fbpEmT1y+GdvjdYevChkmZ3Pfo+cP7m3k/Codj1cnx5ITJusOTJKA9BnIhh4f823WOkYNad9KMf7p1gCfGFuSxILu3/OQXZ4FlNTFtdj3VNfkILxx7u2hjLo2TRrt6iuRkoHKidV3PlcNnWj0ZRLAxzRg6dJ1L3at0EE7O1gfilfQ2zr/niIHoH26hhrpPdJUxBv+RRHdruFr/ljOHtyDTbiBlAe/0KNi2QiWWHHEz9rUK8VvaRiCYlXQrBMMFXJlM086D+lNKZHdNqXoLqGFaKIxJWySlspP0cvt X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(20558992708506)(767451399110); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040450)(601004)(2401047)(8121501046)(5005006)(93006095)(93001095)(10201501046)(3002001)(6055026)(6041248)(20161123560025)(20161123555025)(20161123564025)(20161123562025)(201703131423075)(201702281528075)(201703061421075)(6072148);SRVR:MWHPR12MB1151;BCL:0;PCL:0;RULEID:;SRVR:MWHPR12MB1151; X-Microsoft-Exchange-Diagnostics: 1;MWHPR12MB1151;4:+82sEomrGvWAnBas3G+V+a+RaXKyHJK4KhHaSm/hQRaT76Oyu9wJe4oZJ6bHOey9oDYeaI01LKE2u/qaPnPhXmqjptXUPDyO8PonL8sjti2BXy7r9Btl4lw02c0FVjImS7axgkprtM1Dn4kqcLr7xPNWM8U1ibJlpV0C6gtz7aobOg1Bm8ZduX8oR/rvxV/jl1Cop8H7oPGn0E3GdFJRZfYzxTBRRBj9PnFurbLYFfzA2fM+J/XlFb1vyqPXgAZXCksKmPKPgjP9qRLDVOSzzepHUWSjAAjo6nf1fLX0AspskBfr/SA6w7ZoxqVZiIGyrsM8ofnWPgPsrWjIEPIGzB6jmEseHzMzKoYYoL3V37/4NSNcwfuKpM6MiSDnlkCgiSftmoOwPYpi3ipLGPPlzxA5qMGgJx5WQ4NT5wt2xNGqx0/ImGiDAbCNJCymJHCGxHF9PO2c7IcSXgmmGjW9Z3R6cKmfQRMJ+3wHAO4Oeb5AfjrJEcuAsruNwv1FhTw2yS3XDd2SQ4HIMyA2kqSNPshwckH5jN2fASpc9ukPTTZZIQahgzfxHNZAijMaO7KicMnPNbnRMbopuR6HB9R0565xWL3tG/rbNwSPecL7UCobXwTPOYAiRax2rKj3loESxLO69q4ZBMG/bKt0U4ITrGyiBDNEHKfpKHnCDMvRpElT74D+auF5gPDpiOXtD3QYBJInRHigf1VxYCkqOC3tAG4u8xyI1RPLvtY2Kd5ckMNmz8C5c4WpDjkWEPwWze2w3EItfIRDtBd1NXP+5gtVOI5C5WFVLN3sno+7OC8xbnQokk1BuPfNF3FCSG4PmvoK X-Forefront-PRVS: 028166BF91 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(4630300001)(6009001)(39450400003)(39410400002)(39860400002)(39840400002)(39400400002)(39850400002)(38730400002)(9686003)(6506006)(25786009)(55016002)(54906002)(97746001)(50986999)(4326008)(50466002)(76176999)(53416004)(42186005)(53936002)(23676002)(7736002)(54356999)(2950100002)(6666003)(103116003)(305945005)(4001350100001)(7416002)(2906002)(83506001)(189998001)(230700001)(7406005)(3846002)(1076002)(6116002)(33646002)(66066001)(47776003)(5660300001)(8676002)(81166006)(2201001)(86362001)(71626007)(921003)(1121003);DIR:OUT;SFP:1101;SCL:1;SRVR:MWHPR12MB1151;H:tlendack-t1.amdoffice.net;FPR:;SPF:None;MLV:sfv;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtNV0hQUjEyTUIxMTUxOzIzOi9ldU9ZNTVyM2xmRnl0WVVjWEhmK0M4VGxN?= =?utf-8?B?OXI3R3FXdXJOeDZrU3MrY3ViY09PQmt2MjNiUHgyYVQwcUVEY3dyaGlRUDRQ?= =?utf-8?B?ZWpDSEpZd1JDSHVSTm82L2hJSlBCdEc3UzdweERDajBWMHZKVmVWM1I5aXRU?= =?utf-8?B?OTZ3TExRb05mODlBdlliT2o1MHJBMlFoZ1Q1NUVmMllFSHRxMGJNbTJ6b0Z6?= =?utf-8?B?ejdKQ00wZ2hKOTdNTXB4YTdSMUZPMDBIRmNoMVZvN3N3eHFHTmNtRFJBWUo0?= =?utf-8?B?NG1UTFNoeUtpaEd3bndWdXk1Qk5UNkNrOUwvWGMzeEdia1ZYMzVQQUVPQ3Bq?= =?utf-8?B?UTNjQm5SZWVTRWowaXFPT1gzSUg2VEdXNDZOTHVYcDFlNFNISnFnRUh5UmlD?= =?utf-8?B?WkZCVmFpMUdjOXVBL1BWeHhpMEdnSVYzS1ljdzFVNThxcEdBUDJQOXg1Q201?= =?utf-8?B?cDY3dGpaaWliMDdSMTl6YXdzcEQzQ0l6YW16cmR3Yk9EaTdvbTFILzFrdENa?= =?utf-8?B?YVU5clZzQkxVVFVoYUxJczkwb3dMcHdiT2dpZVo3R3ZNMWlVa3dUcWRwZjVE?= =?utf-8?B?dk9sWGwwcjNQQTQ2QlpXQjZETnN0czA5QXU4UCtyZVJRQlFEY09tTnBBWnI3?= =?utf-8?B?VDlSWEZxWDV5RnpIWHRTdEI2MGh2SC9KdFBWT1hSS3ZlZDRHUnUwTTBYclZK?= =?utf-8?B?SzgzSUpwRXZkQVc2elU1bktVajJVek9hQ0oxY0VjeWIrc2ZSaHlaLzZJNkY2?= =?utf-8?B?NWJPUDdaWXFpVGMvRVJvNTdPdUZOaXByTzZ3M1FIaUlJTXJjcWRmTWRXM1Na?= =?utf-8?B?ejZUaGVETEJoV1hMdU1zckxXbG54ZTNmMlNtZC9RY2RITzRnd2ttb1JYTktT?= =?utf-8?B?QjdhQkVoMnpLR3VrNk5zQmdlWlNTZjRIUEg4Z0thdTgxWnlzL3hsTDNTT3dY?= =?utf-8?B?QWkzZVlJbkg1dFdXbFRiQjRub1NxSmhwcWwzei8zMjhnRnd2Nng4TjJXeFVZ?= =?utf-8?B?aE9KUytCa0F6aGxZeWZLSjZMcHBvSTFzcFovbTVwaHFyeExIZlZkUzk5U0g5?= =?utf-8?B?OXF2MG9rT0pLWSs2NzFwa1pHTVErZDdHUnFGRUVxYk9VSWFTRk0rUnkvSmJB?= =?utf-8?B?R1JLVEFEREJKQmRkNFBNSzh2eDJPTk1DV1N0ZEdaYW4xNFk5SWtXbHNPbERx?= =?utf-8?B?TnkwMUNwUHVaZ1dWK1ZNMXVESEVDaVFONEtNUmxXR0J5OFpocWZuSDc1RDdx?= =?utf-8?B?VEg5SVozWDZrSlBFd0duaEY1WU5TVWlZZW1sVERONFZFQjhWRVlZYnB0Zy9W?= =?utf-8?B?d2IyeGorMFF1L1p4S29QclZ1N0VHSCtFcm92a0l5OTQ2aGhZb1htRWd4emRV?= =?utf-8?B?SFE4UHg0YkdwczBJUTVmblVLcGNUclNRZCtKUDV6U2hnL3JyeUluNUFsZWRN?= =?utf-8?B?ZHFHSFdyS0RhOFRzRDFaTis1UmpvcVZ6eFUwdXFkc0pES2x3SXViUlI4VGRB?= =?utf-8?B?ZWs4Si9aRkl5WEJtcjNGUWxOaldQQXhrOXpMdm5XWjYvVklWZzhocVFERHU0?= =?utf-8?B?UWdoMkZEUUVNR2ZqL2VYN1JVWWtnTGwxOTloOS9sU3RBaWZEaCtGTUhzSlJs?= =?utf-8?B?QWlONlpLVjc5NkgwSE1MeHExbUNZRG1vYVVyVHAxVVBBSzQ3WmpEM2RBPT0=?= X-Microsoft-Exchange-Diagnostics: 1;MWHPR12MB1151;6:bQwF7xSjUpJChqZaHgini3BCgcoYG/NiGQApzzaRoj5NyF2xjg9wVy4HuW9f+8Z+3sBDAlZmg2uqVdMiOoPp1JbEnsrXPKHzpG4Ik7/G+uQR/o042UeDLGLXqDllKezxMuc0GTVTHjOJRBTiSEI4RIQL1RyyDg+Ci3scqe8sEkPQl2kqb7Rs6KMPEhmG90Vw5f8IcOZiWEkyg+8bv6KKlB9esYayC4DzLBojUtAS62auvtcWtlJcbowI57UAgS4khEf4EP31wcIlPkMeqeIOdXfdwV5amrgiJbZtMrDcsIGf5u94XptqX6vBSaC4tk/RmaG/9fSehoXT5HJtbNVMDbOHJwGadp9a5cUVp0ksgZrs2C8cbRt88a8YuEq65PudVFM68ql4cIwWsT6z0M8nMtfsXDsVL1ZJzci5sMYMdXVClN3RhB57g0Gs9oGNHb9nWInO7cnwY3g2HLXE/2P32eBCWFU/nhcsiny+fEeHV1DBMmGVicu/RQCtDI/G3xcXDZ66+RjrJtFK/se/5R2INdC3EIfQm1oFFnOyRYQCIiI=;5:KOafbWpyCsWHHWKQRwN+NP3qR38MnyaBxb5fMAbXMuIJTH2bfrA56G7woL59T/XIIqN703nhnQYBj43Carj1t8JAG8jDIZUo6Add02PmB11RRvL9N46gXaH+iNTcnMvAR9y5tub4cbX+x4MNHvraTQ==;24:Lnn7B4Qb8i5ZTISUNqvS87Vu2i4fVow8bsfhXYtgaTBwmuHDQUyMNo755+XW4Ze/Wq58QL4LFQouUM3VBtnBCaTtWSIQU4k/y92R/mv79EM= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;MWHPR12MB1151;7:Zbdvax2/fHjRc4PHuMMuhNW6bWew5eUEn2uphKsUKTVP5kAwVNLNbcr2v8+HGApCtgqfhiT4X/q4dqXezQLioStCmui7V6idaQHtoS3kCTH5JEBMSJWlw4h8Ko+Fmcv/lyHDMusK2xptnq8VOFzYdbuSCZFZOMdMoV+UBTmVCczlX8f/iVuq5pE8si+aPkDx3cAH5vAhlJz59QgMiSfZAwmHBDxjlPoxPGw+KpCasdrX0RTxOKHZK/3264q/EpDLoMUNXqs3nruHEwbavbeovj0vLZFswMqSGTQVZB/pwTYXiUBUjgtgF8/QaUz8h4WxEb1sqpNK13SJWIQr3lIY+g==;20:qGGkC4U6Bkryz5jiuQEkKu/P5xNwVGhwnL8IRJiWODMsnNc36juhcbzdBWxe+A3yo3/RyU4yfTenOaholkfVBdsnvhMJpEsmU4Tlk6embfXvG24BCyakETh5eAXW3hexUxkWnCKutdEo+sKWhfzvV6p4l62+w6WKp/IdzNkYm6iAzsQiB0MnZ4jTUe2ZNhHhNdCqsVMih/YQCitlqbjlVRDft4+zTYECeACx68wtIOMzvPgQrdqtnfLsMWwYShE3 X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 Apr 2017 21:14:14.1672 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR12MB1151 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Create a Documentation entry to describe the AMD Secure Memory Encryption (SME) feature and add documentation for the mem_encrypt= kernel parameter. Signed-off-by: Tom Lendacky --- Documentation/admin-guide/kernel-parameters.txt | 11 ++++ Documentation/x86/amd-memory-encryption.txt | 60 +++++++++++++++++++++++ 2 files changed, 71 insertions(+) create mode 100644 Documentation/x86/amd-memory-encryption.txt diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index 3dd6d5d..84c5787 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -2165,6 +2165,17 @@ memory contents and reserves bad memory regions that are detected. + mem_encrypt= [X86-64] AMD Secure Memory Encryption (SME) control + Valid arguments: on, off + Default (depends on kernel configuration option): + on (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=y) + off (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=n) + mem_encrypt=on: Activate SME + mem_encrypt=off: Do not activate SME + + Refer to Documentation/x86/amd-memory-encryption.txt + for details on when memory encryption can be activated. + mem_sleep_default= [SUSPEND] Default system suspend mode: s2idle - Suspend-To-Idle shallow - Power-On Suspend or equivalent (if supported) diff --git a/Documentation/x86/amd-memory-encryption.txt b/Documentation/x86/amd-memory-encryption.txt new file mode 100644 index 0000000..0b72ff2 --- /dev/null +++ b/Documentation/x86/amd-memory-encryption.txt @@ -0,0 +1,60 @@ +Secure Memory Encryption (SME) is a feature found on AMD processors. + +SME provides the ability to mark individual pages of memory as encrypted using +the standard x86 page tables. A page that is marked encrypted will be +automatically decrypted when read from DRAM and encrypted when written to +DRAM. SME can therefore be used to protect the contents of DRAM from physical +attacks on the system. + +A page is encrypted when a page table entry has the encryption bit set (see +below on how to determine its position). The encryption bit can be specified +in the cr3 register, allowing the PGD table to be encrypted. Each successive +level of page tables can also be encrypted. + +Support for SME can be determined through the CPUID instruction. The CPUID +function 0x8000001f reports information related to SME: + + 0x8000001f[eax]: + Bit[0] indicates support for SME + 0x8000001f[ebx]: + Bits[5:0] pagetable bit number used to activate memory + encryption + Bits[11:6] reduction in physical address space, in bits, when + memory encryption is enabled (this only affects + system physical addresses, not guest physical + addresses) + +If support for SME is present, MSR 0xc00100010 (MSR_K8_SYSCFG) can be used to +determine if SME is enabled and/or to enable memory encryption: + + 0xc0010010: + Bit[23] 0 = memory encryption features are disabled + 1 = memory encryption features are enabled + +Linux relies on BIOS to set this bit if BIOS has determined that the reduction +in the physical address space as a result of enabling memory encryption (see +CPUID information above) will not conflict with the address space resource +requirements for the system. If this bit is not set upon Linux startup then +Linux itself will not set it and memory encryption will not be possible. + +The state of SME in the Linux kernel can be documented as follows: + - Supported: + The CPU supports SME (determined through CPUID instruction). + + - Enabled: + Supported and bit 23 of MSR_K8_SYSCFG is set. + + - Active: + Supported, Enabled and the Linux kernel is actively applying + the encryption bit to page table entries (the SME mask in the + kernel is non-zero). + +SME can also be enabled and activated in the BIOS. If SME is enabled and +activated in the BIOS, then all memory accesses will be encrypted and it will +not be necessary to activate the Linux memory encryption support. If the BIOS +merely enables SME (sets bit 23 of the MSR_K8_SYSCFG), then Linux can activate +memory encryption by default (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=y) or +by supplying mem_encrypt=on on the kernel command line. However, if BIOS does +not enable SME, then Linux will not be able to activate memory encryption, even +if configured to do so by default or the mem_encrypt=on command line parameter +is specified.