From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751735AbdIPMiP (ORCPT ); Sat, 16 Sep 2017 08:38:15 -0400 Received: from mail-dm3nam03on0057.outbound.protection.outlook.com ([104.47.41.57]:43351 "EHLO NAM03-DM3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751342AbdIPMfA (ORCPT ); Sat, 16 Sep 2017 08:35:00 -0400 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; From: Brijesh Singh To: linux-kernel@vger.kernel.org, x86@kernel.org, kvm@vger.kernel.org Cc: Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , Borislav Petkov , Andy Lutomirski , Tom Lendacky , Matt Fleming , Ard Biesheuvel , linux-efi@vger.kernel.org, Brijesh Singh Subject: [Part1 PATCH v4 07/17] x86/efi: Access EFI data as encrypted when SEV is active Date: Sat, 16 Sep 2017 07:34:08 -0500 Message-Id: <20170916123418.37807-8-brijesh.singh@amd.com> X-Mailer: git-send-email 2.9.5 In-Reply-To: <20170916123418.37807-1-brijesh.singh@amd.com> References: <20170916123418.37807-1-brijesh.singh@amd.com> MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [165.204.78.1] X-ClientProxiedBy: DM3PR12CA0051.namprd12.prod.outlook.com (10.161.151.19) To CY1PR12MB0152.namprd12.prod.outlook.com (10.161.173.22) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 67435b11-33fb-4148-608c-08d4fcff5118 X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(22001)(300000502095)(300135100095)(2017030254152)(48565401081)(300000503095)(300135400095)(2017052603199)(201703131423075)(201703031133081)(201702281549075)(300000504095)(300135200095)(300000505095)(300135600095)(300000506095)(300135500095);SRVR:CY1PR12MB0152; X-Microsoft-Exchange-Diagnostics: 1;CY1PR12MB0152;3:51LrDzN6AuhNpHDGe8NBKo37Qky/dfXs5RBENYvMgG0qabcvSZxxHxm/bkBi1UdOPbXX0KuqazOYqplXhawHvCCewIehd1h4M9Ux9Z79T9to/sLxBfD70hEjFgDe97PyVLr9YdNa/D63gH/k0RFfGvTK05GwnkfMRXNF6fbtIIMKTwJLgTsNTDuKbbHbfgkUYc3t51FKjC08XA5a/GmSBCmbhLsKTWaLo1AelOpzxVdcN4h9FMnKK37NNGHss1Mn;25:9HGzHs/lSuBsPj0X7mHwjNryoA/b1f/TPiW7OQE1Tku98Qt7m4kTqJXVhqKDfw42WIZeQFiEfkrFaGnDOqFqepgl/fEVk4ybv0qaEIo8MagsUwJDgD2ubYo5qMLcELLYZTuRqXJk7Q5FtcqBGihssctw7qDfR0DR+HNTnLKkR6DLcqogZPpHYafvEooLAQYyBkfxIQN7IIJE5/lQAB2yUp+JW37ZTZt6uvlcDBnbpYqn5gJZT0mKmV8xtmQdkS3ki9a160eFkLTq+Vd1+wPhoezuDalXHYSRyoaGWJQdA9UFjqINK7uEC3DOXTE58mIalT5ghSy20Vh4JS81qJOc6w==;31:iBo0wXgCET6SsMkVoZ1fg5DHfkerXUaiBtJikmoxf+NVZwsVM69cxKB5AzM6t2DAMXvdBOwamurcC/Ax/DsGHBBkhyzfHNL4vrIuZx9ihaKaqxytCb0C6o1PGBAwuQPgDOfJKQaENsTOsnlvSrU38AN3/YhkdEkRrL6B3kzzXs5bkC7pxNqTGnwPLPKASJMqIsCSnILvYK0A24k9TpxdmuBe3UFAgwoL/Ntg257oMEM= X-MS-TrafficTypeDiagnostic: CY1PR12MB0152: X-Microsoft-Exchange-Diagnostics: 1;CY1PR12MB0152;20:ADkBscViBY0vdRIvvZz6IurwOCsv23DvJMB80NKy2nHo7uozG3+Iq8X/2IHkV+KGg3G4bTsHE/FYlLD2nQpb7A3lPlTWwev3UA/JtEas6+msbUjay2Yw0KFw/bazr9bfX3hN+m0i8rV5ZUVR2iusUVSR+Pwe7yFJPJjkbiHbEPoSXhJEKjnGrnXfhUL0qfpG0XSt4SJmkATVdt3aWpxs3UO0x1eHvIk2m0zBFzLDqpWvlLhJWYutMu7KUu7Ba/+M1WS2B2srqnA8gMk5Ie1TUxFZAEPlU3tU8YSjpEYn+RtChG9f0fPSes0DstMrgDXL0JgNykQHu5lgCeE8BOHm7/vvELtpQfIEBK6KQkgirwMGHQrcb45Wai9xPvXSx/LWpxNKXTh9R1qi8HH+9DaAqpT5fhy2x9RHn8eM+B0TdB1x8qA4QTAxNmwsw+UdhZoB8gv10/bibEDUZkl3oQmdfj9WxQqrE2IvGjYwhFRdiWFynk9W5lqi6EM40CRbSHJr;4:t6F5ZXLFSxqth8asnguPeFPyYy0ZPCS0t7B160pz3sNcu3c+E751Kr0Q0Cunz5CA6BQmcmLkGw3L2MoO7fCsHhLxzYz7bWeaZt+ULCO9p8+q5IY94Bg6735tsB628QwJscaOPRldnkcEfdksghMbxm96an+8IoQUxqMFPd02oFAkAtEYpvs4w2Pb13qdswQlWWZ15FzNDBYPy83VU6zLPNmzlrOnpn+gVKuam9lDDX5LxIkHCL+snPMI72r12trOHNHGNDASOtSZMf2UmUsm0RAvwNJNnEBTJsUjN/xTo33hXbHUxtpma7cNko4z+1Rx X-Exchange-Antispam-Report-Test: UriScan:(9452136761055)(767451399110); X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(8121501046)(5005006)(100000703101)(100105400095)(93006095)(93001095)(3002001)(10201501046)(6055026)(6041248)(20161123564025)(20161123562025)(20161123558100)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123560025)(20161123555025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:CY1PR12MB0152;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:CY1PR12MB0152; X-Forefront-PRVS: 0432A04947 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(6009001)(346002)(376002)(199003)(189002)(6486002)(53416004)(81156014)(7416002)(48376002)(81166006)(50466002)(6666003)(5003940100001)(7736002)(54906002)(316002)(16586007)(8676002)(97736004)(2906002)(305945005)(53936002)(5660300001)(86362001)(478600001)(16526017)(1076002)(106356001)(110136004)(3846002)(4326008)(50226002)(68736007)(25786009)(6116002)(33646002)(105586002)(101416001)(50986999)(47776003)(2950100002)(8936002)(66066001)(36756003)(189998001)(76176999);DIR:OUT;SFP:1101;SCL:1;SRVR:CY1PR12MB0152;H:ubuntu-010236106000.amd.com;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;CY1PR12MB0152;23:lAN+kurGfWc4jAJanzC6jqC99ablINfTmy3rCXbfJ?= =?us-ascii?Q?4Kv0G2npXOoBLHpYLK76iieTSdSVbwgfpOPGCjbdy8zB1PeLrXqwuL1W6pGy?= =?us-ascii?Q?x+1ikBRQxpcx6yCfS5p+szHOrKH2E4wsPwuIvcWGTaI7X8VLqzsU5n5esAJ1?= =?us-ascii?Q?Rb/MEaRYNXSLHZOYax2e7nf4mneoOn1tMvGP6Y7SoiJP8ID9IizLvEJPmUiR?= =?us-ascii?Q?WAM0B542PilpVG+Z2cRqRRcj0Se+W5UMh3/Yc0AwDbkXMGFo3/68tYArK1PZ?= =?us-ascii?Q?CSQEy7hIDiHTCW3SJ1j5nvtlOxpq8PZEPldjJr0Qk3tfrsvvZMSr/MyvbH5V?= =?us-ascii?Q?h2dISQZJ2ktWDPNVmFBX8PBPvee6QE8uo5uGNhBRT74zRML3bFZyhEX0/PsJ?= =?us-ascii?Q?f8gj+humVzA8Y8uV9bweREFiJjDz7gdvqB3n4qgGd6PA5J3GM6U4/n5lJaAo?= =?us-ascii?Q?oH2F6c5sEw845qz0JGx89RCPlMJGRLsHXjmzqCKBP1aD1F/tiOxGBwTF89F4?= =?us-ascii?Q?Necy2R3GuADhl3r7YxMmcj8Z8NOHgcXXd3VwFXzpWESXrKYWdYPLhu1r38db?= =?us-ascii?Q?8CtVmR+Dw67lcMlgxRRgeewrS0NHu6wezg0w3BkV6yoQFK7wcEyeRAOIus5Q?= =?us-ascii?Q?cZ9P09pI2KI0doDaBRwu+gmDrKbuXP5J2kgJW/WRxD3+nf9eCoAq+JKoD/AU?= =?us-ascii?Q?BFZ4RdGfDPbOXcAiPZYwdhGG91PLP/r5eg62wysh59UHHb9EeEaXFtkoL9g/?= =?us-ascii?Q?Nn7GATIcZTmhVphXBN0RgIMQ0tTmWeGP5ouKHHUtmyt9CyRj2KUVI/tUZdlf?= =?us-ascii?Q?5yHaCPma2oaOLDZwpHQ+5K81N3fUlj3mDQtCV3QC6dIaEsSLn15PSYRJM5OV?= =?us-ascii?Q?3GiDX3VuComMvvYm+vsjjIi7J2B5ABKMsRY7kdn/JuXAtkugy1udKv2mK+fl?= =?us-ascii?Q?az3aIHx6TSZ/KfnpooJdot4uvXvN5mHQwhRIzAo9rYSK8mKhn+Gg6+rgf4VL?= =?us-ascii?Q?oMMKsUHeoWFNgOb/OJZBWPMD+J2OxBbFt+Korf4OfxNvmnQzQTw0HsRr3LzL?= =?us-ascii?Q?R0+w0mjQeX4ztkR95wYHSe4acS85wiGuMdLpN1t5XOLhKzrDw=3D=3D?= X-Microsoft-Exchange-Diagnostics: 1;CY1PR12MB0152;6:0Z8jRhinA+7QapgeIaFUVhHu250wLYnjq1BFFBpImDZSkEIO5aL7HuJC0hSRLFaPq2xRVnd+toA4X73E00mTxUhafQGC2Rvl22bPNTe97gmtRpKkGu/VKEwVkZu8VvlXpGLnmpBFTkYeF0FgxCeouy3HUZA1SJr2q8NRTuDpfcgyTxwdhAST+zLEYmIZfeeLnznxKk2UdHrFFKCL/4irrXQDymbonE2O4twbOHYB8gy5DGZxRUCHGprHSy5TtVyxeYc9sv3rfl18PDADzp72veVmUYizfOfihjEpc6OQlvqqhEU3uzXAF7jOipHMZ7jJgJ/GBF60tSlucD/fFsgkaA==;5:1sX+kLXda36K2EJ1dPpIkmetJhEvuRaK+CMN4Z8N7b33O2FzwMFkc0UbjuaAA/EuYegCvBji4pCJjg7okutH3cgqXy/WJuHLqPyAVgiRxbNnn5D+Jaq1Y33h1kSygh7iQein/AaH0Wm4tGESrEQJxA==;24:C8fKAuJFWMuGJJRM6ggfQ92cBnImaSymdv9vyhFDSE9dEh+YXkPJj+kWpeCf0QGsJcDgvtIZbeJsub7SMtD++IzQ9mJPRGkeosF5hKsjyvs=;7:R8EuPd9TYJQVjPOdJeNx4XK2Nlc1m13JZ4dW4KRnpPhh1DvFieTxYVlKFmJEZ+aVNvEcE0ZCAEDo8WNmWAojOsfn7PYw5gJJuJ/8JhvC0BFMiyONFAWdKj5jnY4xqzM1RLHVzvbPsRbWq2UEJV869yAHvxCxxmg0IsF+emTArrdCesnJ6KvzXGyfYwwKNNobSp1ZXy/kKOifG6LYSE7M8fJFYfSAjddzgq76pl0CagI= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;CY1PR12MB0152;20:w5qE2MBz/z4O+taovVOO4Lv2dlmxmb3Tq8EGXK3q2Ez+lnBjFUgE2cWMchtFnr2b2IYqfirB7TwKxnrmkewuER0L1MofAsx6KSoRNoaaWwpN6AYtm2l8ELKzBinlKURMkSaYJQllru4OOA6JO08LSRArLgm2kobUJ1ETLjG9tYqGSHuYJxbeCRbHKXwxgfsx8OQGHECTo/CdWMw5x6Z5duS2Xf6/jZDjihaJO1V1r4xtfNBJaOvtLTC5zu1oRb6J X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Sep 2017 12:34:46.7557 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR12MB0152 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Tom Lendacky EFI data is encrypted when the kernel is run under SEV. Update the page table references to be sure the EFI memory areas are accessed encrypted. Cc: Thomas Gleixner Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: Borislav Petkov Cc: Andy Lutomirski Cc: Matt Fleming Cc: Ard Biesheuvel Cc: linux-efi@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: x86@kernel.org Signed-off-by: Tom Lendacky Signed-off-by: Brijesh Singh --- arch/x86/platform/efi/efi_64.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c index 12e83888e5b9..5469c9319f43 100644 --- a/arch/x86/platform/efi/efi_64.c +++ b/arch/x86/platform/efi/efi_64.c @@ -32,6 +32,7 @@ #include #include #include +#include #include #include @@ -369,7 +370,11 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages) * as trim_bios_range() will reserve the first page and isolate it away * from memory allocators anyway. */ - if (kernel_map_pages_in_pgd(pgd, 0x0, 0x0, 1, _PAGE_RW)) { + pf = _PAGE_RW; + if (sev_active()) + pf |= _PAGE_ENC; + + if (kernel_map_pages_in_pgd(pgd, 0x0, 0x0, 1, pf)) { pr_err("Failed to create 1:1 mapping for the first page!\n"); return 1; } @@ -412,6 +417,9 @@ static void __init __map_region(efi_memory_desc_t *md, u64 va) if (!(md->attribute & EFI_MEMORY_WB)) flags |= _PAGE_PCD; + if (sev_active()) + flags |= _PAGE_ENC; + pfn = md->phys_addr >> PAGE_SHIFT; if (kernel_map_pages_in_pgd(pgd, pfn, va, md->num_pages, flags)) pr_warn("Error mapping PA 0x%llx -> VA 0x%llx!\n", @@ -538,6 +546,9 @@ static int __init efi_update_mem_attr(struct mm_struct *mm, efi_memory_desc_t *m if (!(md->attribute & EFI_MEMORY_RO)) pf |= _PAGE_RW; + if (sev_active()) + pf |= _PAGE_ENC; + return efi_update_mappings(md, pf); } @@ -589,6 +600,9 @@ void __init efi_runtime_update_mappings(void) (md->type != EFI_RUNTIME_SERVICES_CODE)) pf |= _PAGE_RW; + if (sev_active()) + pf |= _PAGE_ENC; + efi_update_mappings(md, pf); } } -- 2.9.5