From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751779AbdIPMjU (ORCPT ); Sat, 16 Sep 2017 08:39:20 -0400 Received: from mail-dm3nam03on0057.outbound.protection.outlook.com ([104.47.41.57]:43351 "EHLO NAM03-DM3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751185AbdIPMeu (ORCPT ); Sat, 16 Sep 2017 08:34:50 -0400 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; From: Brijesh Singh To: linux-kernel@vger.kernel.org, x86@kernel.org, kvm@vger.kernel.org Cc: Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , Borislav Petkov , Andy Lutomirski , Tom Lendacky , Brijesh Singh Subject: [Part1 PATCH v4 02/17] x86/mm: Add Secure Encrypted Virtualization (SEV) support Date: Sat, 16 Sep 2017 07:34:03 -0500 Message-Id: <20170916123418.37807-3-brijesh.singh@amd.com> X-Mailer: git-send-email 2.9.5 In-Reply-To: <20170916123418.37807-1-brijesh.singh@amd.com> References: <20170916123418.37807-1-brijesh.singh@amd.com> MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [165.204.78.1] X-ClientProxiedBy: DM3PR12CA0051.namprd12.prod.outlook.com (10.161.151.19) To CY1PR12MB0152.namprd12.prod.outlook.com (10.161.173.22) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 6294e9b5-615e-4810-b7e4-08d4fcff4e69 X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(22001)(300000502095)(300135100095)(2017030254152)(48565401081)(300000503095)(300135400095)(2017052603199)(201703131423075)(201703031133081)(201702281549075)(300000504095)(300135200095)(300000505095)(300135600095)(300000506095)(300135500095);SRVR:CY1PR12MB0152; X-Microsoft-Exchange-Diagnostics: 1;CY1PR12MB0152;3:eUss9rfOj2ynxR8KcnIo9U4T65uwGPc+WsfE7MxeFA9ScikHzcSjberqtTNJupVXzRAsFNRfUJqguzZkGjm11BUO9xe9JJqJeigOMJEPPGcDuU+tvasiWczjk/Dwxmk21z/2GlR4pB1DHQaWcnpzHLKgev/PK4M2GBWuAczRkJ5EsdN/JuUwr7saY9OL03wzSs7axt55RUDKrY/6IiVIax0UygIZ+KJyumYJzw5Ten6Ej6DboUUy5GSxmeiMQD9q;25:DytKz4E2VSEEvqsaeGX9Y0hl39sz/qPWs3GXzCcrFIh6Kt29M6QkZ3ykjJlsm+P04TNJfB+gyIF+78mPHBHAgysZQ3FRxha1xudNxcNWUx/pdVUw2ss5ZbqhNRE2VIK1GeGHGJ4qCNfclnQ0+i0VM7vIEAc0XNuRV/g/YBOL3mhkpsZhu5hdk0enKrFFfYIQiCRkuy+gXJwkCMUdD7pvvTyjqJlolUP5wHKXx7n6HraDnPgDp06VpYd1s9ITAjw42oea6kR6qAgDuxKa7HuyiNQdU+n6jkNzoc2eHj4lfpPjsS6PtewX65drahwgBCQqoJ783t+5XWXudcD8dGTqzw==;31:PS3LfJbaKgfzVu8g/h1l9JuB0RAgVGRo9NC2EmBB2ByzEMJpU5MOqPp6VLaLO/FuFeobHYOSf2IKh2/SpU0Yf+JsQGX2aNXyib5ezTO8T+XkksVJ+CDtPKuOEIPNZ4fkqpON40ekAHcgjidKhKAACwySdYs72y8972qGWhs1sr5uJaBT1Ozn3/DVpO5K3SqTbHIBS3oBxanguO7kaWt58GPbgAyt2EbUY4FX9ZUwHY0= X-MS-TrafficTypeDiagnostic: CY1PR12MB0152: X-Microsoft-Exchange-Diagnostics: 1;CY1PR12MB0152;20:u8fn4X5CZO1jtOK+E3bkOImSE4d0jt8215v9Xvvoesi4CR7M8eN0rMGSWWDDxEzNV/839Be1Ew4OF5DPj+2e8Q0gRDc14MU5kxcOG+rIAHiqd6T4Q1jTx34WVjJ6yphvfB4Zr8hssZadF6DM+J4g/o6x89qMSdTSMfS+2S78O78+SdpEtsvmll079sID0lU3J9tj2Fpc+y98FsLmdSFZOSdNunEI4r9MU1i3+PfPLHC2uehr2j1sZKSxcp6ZpM1PO/c+FRAdrJcQqUvmqfb50FLFHGivuIrY0skJpcgDZECf6lPbA+du+JNmxMXywPia79/P4Ob5JigRGjscmoYIsgV4ngourFGOu+jv5VGsYQR2kVC4YE095rRtOzan05NxQXCMTuuKx16uAclcDQHdCpPmjnPWH/M4WEjQuJs99XkC5Fm3HzVr8h4tb7awlZj0lHjbbernxa3Mp9rvZZZj+/k9MkvzJ5RoF7qfiI4b38+Gosd/Y9oI/mg72rJSYn71;4:5SR7GoYUA41fwf5X0B64Mxj7LdSaU6MV7hO7U8PsH/Hx/cR08Lc7GBLrfeQknJRbRuzIfYdHqQlITA4bNX1RNNPmgGScmMfuDVLs/nHD0FtAoi6UPxUkKrmJabWAtwYW5YUkMmzItcldZ7DZt5US9w91ZM14ORJR/w6KOUyQpwANSojgP2th3r+Qv+BR54r6GNxSK7zAtBINyQJ0rxrWn9kmIMrOUq9ll5k5yNUBycCnY++03j9d9xYFUL/m0mTD7fJ/m/U7iSwr+kFAmSjnC22iXiWqUlMLI+6g7oLl8omkKp5PM1rE3MAq8ZPHJafc6qbJxE1SrriBgkIteI1bqw== X-Exchange-Antispam-Report-Test: UriScan:(9452136761055)(767451399110); X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(8121501046)(5005006)(100000703101)(100105400095)(93006095)(93001095)(3002001)(10201501046)(6055026)(6041248)(20161123564025)(20161123562025)(20161123558100)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123560025)(20161123555025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:CY1PR12MB0152;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:CY1PR12MB0152; X-Forefront-PRVS: 0432A04947 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(6009001)(346002)(376002)(199003)(189002)(6486002)(53416004)(81156014)(48376002)(81166006)(50466002)(6666003)(5003940100001)(7736002)(54906002)(316002)(16586007)(8676002)(97736004)(2906002)(305945005)(53936002)(5660300001)(86362001)(478600001)(16526017)(1076002)(106356001)(110136004)(3846002)(4326008)(50226002)(68736007)(25786009)(6116002)(33646002)(105586002)(101416001)(50986999)(47776003)(2950100002)(8936002)(66066001)(36756003)(189998001)(76176999)(309714004);DIR:OUT;SFP:1101;SCL:1;SRVR:CY1PR12MB0152;H:ubuntu-010236106000.amd.com;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;CY1PR12MB0152;23:KBcn3yUdjkXySnEOprO4yPB+dDccgIMv4pA+erFuQ?= =?us-ascii?Q?iuFuEN28U5p7but0COb4vhLBjVEKkx8L2g+FtbIu876fwx3AV98JSiQQ9QRA?= =?us-ascii?Q?Ar/FwcLg1r3LFuOIpXC9xZgz7zb1lUKB/kWb99OpfZifs4H4OnHx7sR6KdL4?= =?us-ascii?Q?nkQp/PLgT/PI2FU+SX0KUzivrKZPPihQIqDaH+UCGHBckYhgz/HoYbPpMnoW?= =?us-ascii?Q?4ykJD08vgDb3CNPPyfdZ6TGJcDiZwR+E3QfSQFrT9JGvLQScSEy5r2vGeFQr?= =?us-ascii?Q?NjtPuws8TC2KM7cnUCaoYbo3DrFcAJRBHEFifK9YTrDLoQ6qq9gJGYEXHaQl?= =?us-ascii?Q?Ckezi5Cdg2TwZkoEQNS/so37KV1VyTy0AT9uGSLfNAJDsrN5vbQq02LjVbPF?= =?us-ascii?Q?q2UKip0PSSOmz2e7DwnUOMaqQ4KP7E8QbI1vwAHiS3voH/W4KBnuRV5//WsM?= =?us-ascii?Q?vdD5b33bfRBiv1DuOLIc3qPYRAAGbWy4NYToHcGj8BmjZM9wHNHLW3ilYARo?= =?us-ascii?Q?8ZrLSQcwmBMfIfFJww5Floe4TIzQ51s8/KPLqJ/x8ccYU+9QqgmdNrhpB1E7?= =?us-ascii?Q?4V6SrW7pEZMcj/kWiu6hO3uqxDx5o+4AuGEav1XbMUdXkidPJU6ov7zqP/4/?= =?us-ascii?Q?niZpREa9NGA6bQLCWx4jKQbmJ03DoYjEMNDnHPQtZMFTeL4u6LObEwE/vrBj?= =?us-ascii?Q?FaGiPFr4g0knWfOinQ0lafTkXnjUxYtEkHo+fhOQRPq+SpF3Re/8SLLdyIXX?= =?us-ascii?Q?dS4b6PS64UdKUSzSREAfa1teq6Mc5FslZxEdUXdQgi+fA0/l5/uno3qJNhVA?= =?us-ascii?Q?1R/Tl40ki7uK50ceNeMpHpW+vPGBEOanAP3M3nvV5iZM2wQCFn1XSeVqz+A/?= =?us-ascii?Q?n+Vb7TDLxXGygGHwPwfyAB7U+lS/EA3nKsmZ4tA7uIl3oqXM0IcPTmtJ4NKq?= =?us-ascii?Q?u1Y9vCIVAJt2+rGofBB+NxlPEtySvGuWQ1IfyiicTz+20sEL9pZj8RjW72zs?= =?us-ascii?Q?/nlEk7ev23bYWpZCgHPGirOkKQuG6u5X7Vs3LCAZpodTVyHxLcZCTRCYVwaO?= =?us-ascii?Q?CKcyPNCv5qTlyIR+nbjnv2F7IzWb3Heb6XVr73Y9J4Hws5ednwRMXWKEuHf/?= =?us-ascii?Q?zJ5rlju8fU=3D?= X-Microsoft-Exchange-Diagnostics: 1;CY1PR12MB0152;6:Jhts5vpd5Uyc1xqKRCO0NiG2g5gLiDe8Igbh8fl/OJBnEr3rNGFGQpB77gTHTpygmqFxIj2Cu369RB2klo1BI8BhNlCI4vbFsMyK5eBcN7Jm3rBz6RLjEWrq1eHeqf5rODN0JMx2YmI9JW8nqFHO3jzZr2i0Fqluhj07cHLdm6NThiLUlerM2VpXxqOg9vYsnJMgYi4YFjEvJ5DeYIiIl9qPSEnS5OxoJXRSJjR8DyShHlmbJjDuzLwE2RkZSbo0iyKieK7qDvFlBvDroZiYsncorcwBxjjic5lmKw4lV+0R3GTla0JZxKD+zi+2aFMgHHGBUhOI88PB3TWqwLEURw==;5:YtiMX0ojrw0hA1W0jUu4DfRqzGIhp4jwisnCuM7dKYQDk9aNYAk1DLEpo8pmlV0PAZRVsEdAq2ImFWCnKcYcx+sPY0Bpx2S5VkcSfpOgUrENwHu1GdIuU/9gw7M7G9Oq8SmUVT7gx0J18exPdLOOTA==;24:jtHuMBoQbzPSrQKJvMCmFprETUy/hA428ZiWOc7G/G1IXfPfLKtNLrg/bfCX2Ep8QS3ER0Sv3KpyOSDYVpiDVPhtYJ0RydMGbY5FjYnmXs8=;7:Vwyn/ok7P7iMiFaBdDt/nkubX729z/RoZWTBVlVKK/dGeFTypX7ZqkTNdpkYeZR689Ks2jqPB/OBONb1oAbOONeizVEfZ1TdseFtq81gh7/K85rOKOkpXUWs7gYETbmJczstQAYkjjUGB7qOu+qt8w94MPtqF2wT17KxAaJBLOdRkAAAu3p34iONwwQ0EUsk/EZcdJgIi76iqzqtb6RqGC7KmiGURiO8UmXUiL5HiTk= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;CY1PR12MB0152;20:XUfgsKqwUhn32bUM3oah2bp+BQ+1x4Touot+DP1qpZS6/gBk3tLjlIOavUM3Hs5Xcq9pFIxoA3aR4cxS5+3rXWRLnbjYg/mjFJOLWhWSoaQeFjl8N3wl7HmjPMMMg1XigbT+cQOof8l2hnkbk7pQ2HBWHrls1bOsxOnnRHCCdFXOWI4gLiFwLAHdyh2xiY7V33JttByBaBm4M9Kg0/PU3G0or8A0rDt9ubcZe71a/lNPjfnxpNCV+A6m0dQHXjOO X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Sep 2017 12:34:42.3649 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR12MB0152 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Tom Lendacky Provide support for Secure Encrypted Virtualization (SEV). This initial support defines a flag that is used by the kernel to determine if it is running with SEV active. Cc: Thomas Gleixner Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: Borislav Petkov Cc: Andy Lutomirski Cc: linux-kernel@vger.kernel.org Cc: x86@kernel.org Signed-off-by: Tom Lendacky Signed-off-by: Brijesh Singh --- arch/x86/include/asm/mem_encrypt.h | 6 ++++++ arch/x86/mm/mem_encrypt.c | 26 ++++++++++++++++++++++++++ include/linux/mem_encrypt.h | 12 ++++++++---- 3 files changed, 40 insertions(+), 4 deletions(-) diff --git a/arch/x86/include/asm/mem_encrypt.h b/arch/x86/include/asm/mem_encrypt.h index 6a77c63540f7..2b024741bce9 100644 --- a/arch/x86/include/asm/mem_encrypt.h +++ b/arch/x86/include/asm/mem_encrypt.h @@ -47,6 +47,9 @@ void __init mem_encrypt_init(void); void swiotlb_set_mem_attributes(void *vaddr, unsigned long size); +bool sme_active(void); +bool sev_active(void); + #else /* !CONFIG_AMD_MEM_ENCRYPT */ #define sme_me_mask 0ULL @@ -64,6 +67,9 @@ static inline void __init sme_early_init(void) { } static inline void __init sme_encrypt_kernel(void) { } static inline void __init sme_enable(struct boot_params *bp) { } +static inline bool sme_active(void) { return false; } +static inline bool sev_active(void) { return false; } + #endif /* CONFIG_AMD_MEM_ENCRYPT */ /* diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c index 3fcc8e01683b..4e6dcabe52fc 100644 --- a/arch/x86/mm/mem_encrypt.c +++ b/arch/x86/mm/mem_encrypt.c @@ -40,6 +40,8 @@ static char sme_cmdline_off[] __initdata = "off"; u64 sme_me_mask __section(.data) = 0; EXPORT_SYMBOL_GPL(sme_me_mask); +unsigned int sev_enabled __section(.data) = 0; + /* Buffer used for early in-place encryption by BSP, no locking needed */ static char sme_early_buffer[PAGE_SIZE] __aligned(PAGE_SIZE); @@ -190,6 +192,30 @@ void __init sme_early_init(void) protection_map[i] = pgprot_encrypted(protection_map[i]); } +/* + * SME and SEV are very similar but they are not the same, so there are + * times that the kernel will need to distinguish between SME and SEV. The + * sme_active() and sev_active() functions are used for this. When a + * distinction isn't needed, the mem_encrypt_active() function can be used. + * + * The trampoline code is a good example for this requirement. Before + * paging is activated, SME will access all memory as decrypted, but SEV + * will access all memory as encrypted. So, when APs are being brought + * up under SME the trampoline area cannot be encrypted, whereas under SEV + * the trampoline area must be encrypted. + */ +bool sme_active(void) +{ + return sme_me_mask && !sev_enabled; +} +EXPORT_SYMBOL_GPL(sme_active); + +bool sev_active(void) +{ + return sme_me_mask && sev_enabled; +} +EXPORT_SYMBOL_GPL(sev_active); + /* Architecture __weak replacement functions */ void __init mem_encrypt_init(void) { diff --git a/include/linux/mem_encrypt.h b/include/linux/mem_encrypt.h index 265a9cd21cb4..b55ba30a60a0 100644 --- a/include/linux/mem_encrypt.h +++ b/include/linux/mem_encrypt.h @@ -22,17 +22,21 @@ #else /* !CONFIG_ARCH_HAS_MEM_ENCRYPT */ #define sme_me_mask 0ULL +#define sev_enabled 0 + +static inline bool sme_active(void) { return false; } +static inline bool sev_active(void) { return false; } #endif /* CONFIG_ARCH_HAS_MEM_ENCRYPT */ -static inline bool sme_active(void) +static inline unsigned long sme_get_me_mask(void) { - return !!sme_me_mask; + return sme_me_mask; } -static inline u64 sme_get_me_mask(void) +static inline bool mem_encrypt_active(void) { - return sme_me_mask; + return !!sme_me_mask; } #ifdef CONFIG_AMD_MEM_ENCRYPT -- 2.9.5