From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753462AbdI0PUo (ORCPT ); Wed, 27 Sep 2017 11:20:44 -0400 Received: from mail-by2nam03on0075.outbound.protection.outlook.com ([104.47.42.75]:3040 "EHLO NAM03-BY2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752034AbdI0PNt (ORCPT ); Wed, 27 Sep 2017 11:13:49 -0400 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; From: Brijesh Singh To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, x86@kernel.org Cc: Tom Lendacky , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , Borislav Petkov , Andy Lutomirski , Brijesh Singh Subject: [Part1 PATCH v5 02/17] x86/mm: Add Secure Encrypted Virtualization (SEV) support Date: Wed, 27 Sep 2017 10:13:14 -0500 Message-Id: <20170927151329.70011-3-brijesh.singh@amd.com> X-Mailer: git-send-email 2.9.5 In-Reply-To: <20170927151329.70011-1-brijesh.singh@amd.com> References: <20170927151329.70011-1-brijesh.singh@amd.com> MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [165.204.78.1] X-ClientProxiedBy: BN6PR04CA0033.namprd04.prod.outlook.com (10.174.93.150) To CY1PR12MB0152.namprd12.prod.outlook.com (10.161.173.22) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: b1528bb4-995f-478d-eac9-08d505ba5a25 X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(2017030254152)(48565401081)(2017052603199)(201703131423075)(201703031133081)(201702281549075);SRVR:CY1PR12MB0152; X-Microsoft-Exchange-Diagnostics: 1;CY1PR12MB0152;3:rsn2rtkrBEv+WhXL9dm/HB9KIfwgWn5GdV+e05HONDg8imxMBYuk0zmHrX6ijwBdzLvb5DzOPn6ZbH/MjfylOrJFek030OPuwiBdqYe299VO5oHH9A1NM556uEQYOo9JcwghInLyF1wTkomwmRACT3s6nR7shizhvOIOH9vh13ZGhVes/6NhewqWNWf7NftIcK+IiCU8orhKleU8ZQcTafj6mjxfEEMLx9EEiGiQBdI5IE5mm+3qbI2IusYOyImG;25:rslhNyLRFPkUM74T+JPtVerctyMvXARcJ5jrEPyjNIT3A/LqOcj7agpDaQk7vUZgDblM395CSGqNHE4S1xYsqnSp8Ikl167uPX4dD+e5ng9JBQ/a5PQOc0lxh8Cb2wff8GOXHGdL6ChYMPgS3okVtPL20fndoTsYo57gnPBd3/xYBsPdK3A+3DQuPis3f7S8eEJVhe2K62ir8peXYhZgAfqkgCnIi0u6ZNrNFQ5LaQZH21LCB/wW/d/QkD2EvkdXaDIZSdemN5BZtZjyycAX2aHlNJI2vuHaXPAI+w8ka5zEEDwh83W/bVwo4WkGGoKYWv+4bJ4JIz1FQHqOnV2tiQ==;31:lp+2NKG00dp9s8R8B16wsCTQxio4pGj56Z6TVGmAay2t811DhapkKjBPa6EWm5urbV+XKQ/npUpPqVixltPirAtmtjLeEGLezrjO3spDyxNGevDlwyw5Mg2WmgCGwdehAYdGBhwUKAjWdjdnxvAigzjIkCBngOa46BchCM4umbC5tWWVRVWHaAbzwL3aNPHoHrVnRrf2gSoN2OcO1Y2v7TxhFvKbqT3Hb8Qf3xLOgEc= X-MS-TrafficTypeDiagnostic: CY1PR12MB0152: X-Microsoft-Exchange-Diagnostics: 1;CY1PR12MB0152;20:JzRmU/NEavCJR2QwXch+H5T1La15Vs+B9yVAmY2GR4w+gZq3UyKIkycfD/Pqy0xvPxdbQV6J2Zp+N4hXw48Tbe3SO11Vb9nfe5vKRBzlIm+ZAYXC+lQLwMb+//nQ10cNhcSz5/P/zWaK1fR8mqtFEf+ZY5NPuCamsWtj+cJHtzuy855qRvECBgweHZ/Zs6M0wY8Zvl7ca45uPjBsU+3/dT0dzw/rdqR5QEBDFmENQ/Cvvmz+RweVMbDUfSo+Y7hbJ3yxGcoVVDNKOu5NuCi6asjs/9YPC6K+Zl5TeCy4u1xeYbWlchmkDbwz2zMpstZ6mb2vARSA2K7CpdzwgiWSBTK2UNlxBS9TKVVdM3E8bC8lVi/eSo61TDMMIlLMZv87Z+zoBj9rmq+yf9/ywTS100c0OKmpI7Bqkf/uBBS9JWrGqZdTpmyKpcQ31uUb5Wlf2kqKntamVHFEYpRO0/p53EigZdMLLrlCM/W9ANMiivIgCdWGBY72qKFaSGp3iFmo;4:aaX1AJMNZR/PmpOPwFu3/U+aAntPxaYNL74xt9PJRIKdrFKDLMMBfV/XsBE2bAmeIZ8Bq+uLfU1JC1Vn2npDHPlNB7EAR+X0gl3FvYVuFJxNJnLqN6QWRsxrXzFC444Z5zHvOOAiYMEOw2QnLGYMj3OJ7zPaXHV6t9PCY5OfkHuSh8f9e+DFiE26qEpQg1fndaHj2nbMYeB05ZNir7+La2TbT+D2ziGrLs2tTKXm3wKczUsnz+Tdgc0fCpA9vBVI75rO2jKgfdeiUBFtFRQ4KoBPuriS9KGibsW9MLb5saI8JUzYZ/CfYyo9ttsDSw364BY3r145y14C3PAzAIVtow== X-Exchange-Antispam-Report-Test: UriScan:(9452136761055)(767451399110); X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(8121501046)(5005006)(10201501046)(3002001)(93006095)(93001095)(100000703101)(100105400095)(6055026)(6041248)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123560025)(20161123555025)(20161123562025)(20161123564025)(20161123558100)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:CY1PR12MB0152;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:CY1PR12MB0152; X-Forefront-PRVS: 04433051BF X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(6009001)(346002)(376002)(39860400002)(199003)(189002)(3846002)(25786009)(6116002)(53416004)(106356001)(8936002)(4326008)(54906003)(1076002)(6486002)(50226002)(8676002)(305945005)(50466002)(5003940100001)(81156014)(48376002)(81166006)(6666003)(68736007)(36756003)(189998001)(7736002)(105586002)(97736004)(53936002)(2950100002)(101416001)(478600001)(16526017)(16586007)(76176999)(50986999)(316002)(47776003)(66066001)(86362001)(33646002)(5660300001)(2906002)(309714004);DIR:OUT;SFP:1101;SCL:1;SRVR:CY1PR12MB0152;H:ubuntu-010236106000.amd.com;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;CY1PR12MB0152;23:aA49R5kjj2PRkThG5iAON21eOYvopGo1tKVvJOj+E?= =?us-ascii?Q?qtF4i3lnBv3FyMrfCNH4bPvv1gQflubXJdTjHmfW+t/NOforFfysQTSI3gBz?= =?us-ascii?Q?l3MavgMyy93vLzAnqWOTZ2YQ+YIi81D3Wwi/QgcYqViy5KU1EBnkVIgIQYt0?= =?us-ascii?Q?FvmYQjoHbBpV1rsMlJKGluOs0+Pp8UP6ZkaEaOyq8PxpdKLcCTzyJl+4S8pj?= =?us-ascii?Q?Kjs0y8uW5UJuUiD4opXi0mBFCyZGAaIwhhPe3I7W4p8LBNprjXbLkcHn5P+k?= =?us-ascii?Q?lemxhIrxd+kIdFY8ThXQInERIltEiYxbDf1z5oBFyGXdou2fsnKjT4Nw4Sfn?= =?us-ascii?Q?+jqW2BCVSvdJY/lsmtarVs0H9jKyZo4SBH0zT5pxQcMeU6IUikzjjkwbqFVc?= =?us-ascii?Q?SCEomvXTpZ5Qxsdjw7H3qVQqaibR9W6t3kFl2GC5SRG5BdofgnMvJ6eG2mPm?= =?us-ascii?Q?VpfwkLcyUujd7Y60YAwtmn8eFlYECJreMDdOdROMIKIOohzvxnvSUci986rp?= =?us-ascii?Q?S2mxaixSgyk7D2Ylux9YtpbQjSJiBYgXxSUCmSfuPK6b9p5ltmdV+bRkujXT?= =?us-ascii?Q?rRu/0eSeShBYxBVDJ1p5Z0sx9o5Pxpr+1SChApplefsPE9f7Pu/8iMiI2qnz?= =?us-ascii?Q?l5Qhyfad8db4g6assOiWhrwdA1r19/Nr7+d3j8a+t1Y8wnrjUfcbDN0AwOXu?= =?us-ascii?Q?ZmZNDGzpt6+PBdJUmFUD1rd/fBOu0ysUqk9VzwuGftu4U73y5AcvlHUBM9s9?= =?us-ascii?Q?kD4U9CNNBzqWgNj0GupY0TocQy5JjsEY+WWJ2zaS0L/Z9XKLWfXefQzo0cMA?= =?us-ascii?Q?/a2BleHsouLgLqtVvVrpnGwQOEgzntU9CNuTiKBrro2dQ7ceid8kIyeREcXK?= =?us-ascii?Q?cxzvPb/UWfKjY3DacQ/JdUYTH19AT0gydrnxNQV0eTdiMIi9tkLuKU6ZY8/7?= =?us-ascii?Q?DUXJJSjsCu3ah4gZJfwbao+tMuHb64w73rMyD+SJHegwzDFx83CZMWwvXTqI?= =?us-ascii?Q?MOrkNrq2cYriK8t5rqsoALYhQbBl6RMGLnAqhjpOO71s3c1FfMOdbOSPQSvb?= =?us-ascii?Q?50M/Xp0KjTKFcpKpKcH+ajx9lDhRCQheV2wqhqqE4SDrlZ3eA6rp29T6cvt+?= =?us-ascii?Q?haY4ci4r4w=3D?= X-Microsoft-Exchange-Diagnostics: 1;CY1PR12MB0152;6:S8i4Beo5iK2M+5mJrA1X0wOpTxoJ3tnvCxhlil+YgaNter2QETWUfKNcO1c+Gov1yeS6GUqLgNrxPzsTfIGOiCuVMutz8XNRkffM/VoBueGOrh8JVS8Jq3iyiH288WyfO4lsN09orzhwuPtC0CqzJ+aW8FQGbv9S4pP5UJIVZ0mYdjADDk5XCDhNTO0L8a23wtVNTE6uDkUphPbYJRP1+UDSalYeieyNkpKOCUHbPZwe5dmkdhSlLuHGVYomX1pTMi+GuUkqhALKvUou+xFsxDY/OfeW2SjcCZ4mn57TpEUj6AJYuWFVebLmPL+//3BHDwOXILq07I+SCDRK3XO2vA==;5:yIc6UhKtgbCaTYIi9cg6HCCRqKP2WYP9nj9whVBkZS8hcQz6WDo+zK5L/IAGzlfsUKxLZexlJxWqZriSHUgvHxW9HQvq5N4iiDfP05KA8U3MONJfSTsPLP8WYheYmKf1dYd/PnSZVfC8dU8S29Y8Gg==;24:R/QjmCrT6dDwUDh05UqVLLV1Cq6AjRn2ShSdfixkdGG1K/lWJD4ZXNtXN4590+oMFydObFWx6ZWnssPNtni3etOmFwHAcJe1oXiQ4ZpQh9s=;7:hsL7H4ul397Nse/XKOKzN0C5aBgARmuepbQlpDir0cR2hoy5LSIu0Vi1ZnxrvqoI5tOzz/8PvNu0Nh2UPATwghQ/FXEp0nJlHQqUaP/0drJebR3p7QfSsFJ3yj6JMwYStp/hz6H8jYPv9Kw+uENERqoe0v/dQ0F0ZZA/SVoRYndx2UaqjmQ+ztVZftgPoiYlHlO6rcTeih3WCqdWuGnv3ulE7q/+q9oji/x7+prH3Sc= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;CY1PR12MB0152;20:27bE9/VUoTUsL8H6xcsEhn6YnGgJz/s1np9JtUpcLechQofftlrLrNSb9QF/NKQBj6OwrwQwI9NtxZu9K2viUAJe2zVQ+YBDhSpXfLcz7GZvy6qU1Hj/x3yp2Kc4Y3EtPvHeGcgS+RCiaK4EWx9fM6CTym8ayfsMrCfQBjgD3Id8eDXy+PC7mru58zf1yAX+OUJnh4PFMkV7zf91394WAieHlV/TmGsOpfWOS5D73KQOpxQq9C7Mjy+5DJMagQr2 X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Sep 2017 15:13:46.5876 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR12MB0152 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Tom Lendacky Provide support for Secure Encrypted Virtualization (SEV). This initial support defines a flag that is used by the kernel to determine if it is running with SEV active. Cc: Thomas Gleixner Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: Borislav Petkov Cc: Andy Lutomirski Cc: linux-kernel@vger.kernel.org Cc: x86@kernel.org Signed-off-by: Tom Lendacky Signed-off-by: Brijesh Singh --- arch/x86/include/asm/mem_encrypt.h | 6 ++++++ arch/x86/mm/mem_encrypt.c | 26 ++++++++++++++++++++++++++ include/linux/mem_encrypt.h | 7 +++++-- 3 files changed, 37 insertions(+), 2 deletions(-) diff --git a/arch/x86/include/asm/mem_encrypt.h b/arch/x86/include/asm/mem_encrypt.h index 6a77c63540f7..2b024741bce9 100644 --- a/arch/x86/include/asm/mem_encrypt.h +++ b/arch/x86/include/asm/mem_encrypt.h @@ -47,6 +47,9 @@ void __init mem_encrypt_init(void); void swiotlb_set_mem_attributes(void *vaddr, unsigned long size); +bool sme_active(void); +bool sev_active(void); + #else /* !CONFIG_AMD_MEM_ENCRYPT */ #define sme_me_mask 0ULL @@ -64,6 +67,9 @@ static inline void __init sme_early_init(void) { } static inline void __init sme_encrypt_kernel(void) { } static inline void __init sme_enable(struct boot_params *bp) { } +static inline bool sme_active(void) { return false; } +static inline bool sev_active(void) { return false; } + #endif /* CONFIG_AMD_MEM_ENCRYPT */ /* diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c index 3fcc8e01683b..5ad6ea61bd1a 100644 --- a/arch/x86/mm/mem_encrypt.c +++ b/arch/x86/mm/mem_encrypt.c @@ -40,6 +40,8 @@ static char sme_cmdline_off[] __initdata = "off"; u64 sme_me_mask __section(.data) = 0; EXPORT_SYMBOL_GPL(sme_me_mask); +static bool sev_enabled; + /* Buffer used for early in-place encryption by BSP, no locking needed */ static char sme_early_buffer[PAGE_SIZE] __aligned(PAGE_SIZE); @@ -190,6 +192,30 @@ void __init sme_early_init(void) protection_map[i] = pgprot_encrypted(protection_map[i]); } +/* + * SME and SEV are very similar but they are not the same, so there are + * times that the kernel will need to distinguish between SME and SEV. The + * sme_active() and sev_active() functions are used for this. When a + * distinction isn't needed, the mem_encrypt_active() function can be used. + * + * The trampoline code is a good example for this requirement. Before + * paging is activated, SME will access all memory as decrypted, but SEV + * will access all memory as encrypted. So, when APs are being brought + * up under SME the trampoline area cannot be encrypted, whereas under SEV + * the trampoline area must be encrypted. + */ +bool sme_active(void) +{ + return sme_me_mask && !sev_enabled; +} +EXPORT_SYMBOL_GPL(sme_active); + +bool sev_active(void) +{ + return sme_me_mask && sev_enabled; +} +EXPORT_SYMBOL_GPL(sev_active); + /* Architecture __weak replacement functions */ void __init mem_encrypt_init(void) { diff --git a/include/linux/mem_encrypt.h b/include/linux/mem_encrypt.h index 265a9cd21cb4..b310a9c18113 100644 --- a/include/linux/mem_encrypt.h +++ b/include/linux/mem_encrypt.h @@ -23,11 +23,14 @@ #define sme_me_mask 0ULL +static inline bool sme_active(void) { return false; } +static inline bool sev_active(void) { return false; } + #endif /* CONFIG_ARCH_HAS_MEM_ENCRYPT */ -static inline bool sme_active(void) +static inline bool mem_encrypt_active(void) { - return !!sme_me_mask; + return sme_me_mask; } static inline u64 sme_get_me_mask(void) -- 2.9.5