From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754540AbdJPPj3 (ORCPT ); Mon, 16 Oct 2017 11:39:29 -0400 Received: from mail-cys01nam02on0072.outbound.protection.outlook.com ([104.47.37.72]:39104 "EHLO NAM02-CY1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753610AbdJPPer (ORCPT ); Mon, 16 Oct 2017 11:34:47 -0400 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; From: Brijesh Singh To: x86@kernel.org Cc: bp@alien8.de, Tom Lendacky , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , Borislav Petkov , Andy Lutomirski , linux-kernel@vger.kernel.org, Brijesh Singh Subject: [Part1 PATCH v6 02/17] x86/mm: Add Secure Encrypted Virtualization (SEV) support Date: Mon, 16 Oct 2017 10:34:08 -0500 Message-Id: <20171016153423.2980-3-brijesh.singh@amd.com> X-Mailer: git-send-email 2.9.5 In-Reply-To: <20171016153423.2980-1-brijesh.singh@amd.com> References: <20171016153423.2980-1-brijesh.singh@amd.com> MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [165.204.78.1] X-ClientProxiedBy: BN6PR16CA0015.namprd16.prod.outlook.com (10.172.212.153) To SN1PR12MB0158.namprd12.prod.outlook.com (10.162.3.145) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 81ae41b8-1581-4060-e350-08d514ab6c9c X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(2017030254152)(48565401081)(2017052603199)(201703131423075)(201703031133081)(201702281549075);SRVR:SN1PR12MB0158; X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0158;3:8TrqUlq3LfxOGBFNsfeC4zR2TGUlFqMC5aOTZgVphqgJ6js4A7OjzZikzy1XNjRfgePEKbgxSSiUUvpY5jzCLZvoGcEpBoVfVXPOd9FekBVHRGJ7VJGKa464Pi3A+derxAE6nmAqTLO4dtrJC74HT1n7PmzxfM/dK7JVeRO5ZPkjyHCi1ZD0uzaAUDpkCmQAVcKyzJrAzRfqb62TKnO9tjZBh6JjJ9KJmL0+NgDfrzjjC4zHEeuZUVW0y6Wft3ZG;25:OANobbnQywXhz3+3poiJ4yI0KHPLI9nkEVqLUct2G+CzgwTuOnYFpMICdaJ4fFOyBs3RORilRPWG23PypxZh1ZtK6HGgwpuv77rr7IQudqr4RqoH5rdYIf2P28ltl2bWR9jgmVaIFATbx/3r71sOVbNqbEB+adEvd/6kQU376iILOjeNkGWc+txnikWcHojJ8lZRa369eH4Uim1DBNIrPRSwi0uTdB0Lspuw5EH0SKCaRFnA1Nk9trvhZLOlOjCiEbfNbVUDyxCIQBZZRxq14qU1iUdtt4hxV+nwoTv0iUxcRJqKcO/WVj95DH3gbxo8Or827OSCPoMWpyjkmZEy4g==;31:AZhsX+jg9NO+4N+46bLyOLihQdJmbJO0GZ4PHHeNKHr6glAFuHVEc8SPBqYAf1/tSsp2SbYjM6K+qW+QSzxC/bf/7mwEux7sc9lzV/gkSKnEK4y+RYRkq/Qnv39zmx35r9Zsi9mCOXdu0jRTBVP5bDrdfoOmFEYiUCAcvcF6fr2uKAR2fhhNZa6jSzzwooK64nTKwv8c2jjIZl3hq9qAsoNFstlE+8uWwKkdbuskWwI= X-MS-TrafficTypeDiagnostic: SN1PR12MB0158: X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0158;20:KZU26xc6CftgQUUtLkgCP+xAY8ou/Yb3JgXaE5s5BidWSZ615PJcCeQDysgWyXdW9KPveQyGn7/cplxua45M/lForGxXuJAAhQxq3kni8XQngbGsp4XV3r/NWjQvDbqx6cuGkevxcPSrmh0HNU+8OE89Wq/eEUX/I/1Vc4XY4WW3JQ0GrOXrtHurkRzLprG2npn2AANltgdUg9FhdRn2UaVRhZqcq8QXyW66SE0AmLgPicqkQcGO6pOe+kq1S6H+7HcRCOPahu8/RzYloIyw27B+MBDRzkSa4dv2SNNidtlrdpJTVY/bJtkK+I+Iqcs1DJa499HzpqEufD91A6SfzGtA268VIVhUq6SlTadIKvLRi4ORIYddmpnvEjrayRfmSJHxzocU/pJ71JOxqVCjNB9EHd2IoqCnMuRD0RTtViQktrl/7zd4kWB4abUrE9S58Piq0RzFBgRMOtinbj2/HnPfAKb/Y+Lui5weaj/e0/v4NGzFSSWdcypajM5TXLQT;4:pIzZfJqz1sMl1QCEEoz/BETOVll9gJsEW5qoulHSOiWVKiSpGiBXTzmWfBRpXVlSbAG4oW+Ugn3aWIfpFQ7Gtuum+zJV85o7XHCfl5zkUgkOGlysZK19m4/VQWDGorUg3ZFDsT0cu2bFzx36ivLYAKMXi7rZz4WypAH87sa8Ax6UJa8AnSuvQ8bH0PiaE2vXaF3DeKRGUwzTjY+w08L27JfOif/tQqtpkR1K2PfkNq9V99uiE9LO2UfPH7vw1HwR1/RecgCh3oVemGmg+taFLoQPiKw2ciwZxJBK8/WwJeWWtkE/t++kOw6Jm5Kl2oKO90SyAETZflVh69g0qMNICA== X-Exchange-Antispam-Report-Test: UriScan:(9452136761055)(767451399110); X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(8121501046)(5005006)(93006095)(93001095)(100000703101)(100105400095)(3002001)(10201501046)(6055026)(6041248)(20161123562025)(20161123558100)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123555025)(20161123564025)(20161123560025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:SN1PR12MB0158;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:SN1PR12MB0158; X-Forefront-PRVS: 0462918D61 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(6009001)(346002)(376002)(199003)(189002)(54906003)(1076002)(316002)(5660300001)(16586007)(68736007)(2906002)(4326008)(16526018)(7736002)(47776003)(305945005)(6666003)(53936002)(86362001)(33646002)(2950100002)(6916009)(66066001)(189998001)(97736004)(76176999)(106356001)(101416001)(8676002)(53416004)(105586002)(36756003)(3846002)(6486002)(6116002)(8936002)(50226002)(81166006)(81156014)(25786009)(48376002)(478600001)(50986999)(2351001)(5003940100001)(2361001)(50466002)(309714004);DIR:OUT;SFP:1101;SCL:1;SRVR:SN1PR12MB0158;H:ubuntu-010236106000.amd.com;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;SN1PR12MB0158;23:FFYew+oHOXajNIqRR9JgbtGqyHSYgFLLC3wG8Wni5?= =?us-ascii?Q?bYXZ08x+b2N4B3Q8pNtRL4c8PYhXf/4g0HzPXWEBGV8Y5DV784wKc2S2kvkl?= =?us-ascii?Q?Miyl/3uI6mJdVbLsxBvETuyChrd6pvwuLqeerR7y9h2Re5ydVg5eoCC20+nO?= =?us-ascii?Q?BKjcqgAc2fnMalvZws5hfXDx45MmZ59cb0vuqAXVsMU1m6L4IV6kZ8GBLG4o?= =?us-ascii?Q?thQx+/20tXOZlt0RHDoCMHqmtwTpVMoaw4LY6FqHHHLgrJrDaoeBtE+WCfGP?= =?us-ascii?Q?8BDxOE/X031iXHZZQklAyx/mVIIlheufYy1bo1AKvdYbZNZGwZyBWhYSPs97?= =?us-ascii?Q?xkn6p2M8bVdT0ltinCiym5FF8Qkm3V5xqICuxOzPbGfV7QArHkNG/K6bzNa9?= =?us-ascii?Q?NVXZtTqfh+Ix1JMBiJb6/YhxeboaJSAU2CKVGVmQz7bfEJjqiZ4sc8ZGV6ed?= =?us-ascii?Q?BTnRHMLooZzftvmznQmlMR1WlwJBNtDc4lQ7H9rpDiwr/CPLOzPTnBQU/nuk?= =?us-ascii?Q?5Fhzk95dcr1L9xOGDKuaHguoTsb7c/2vfzft/GqQIsiH59TGomUCDO0eQZom?= =?us-ascii?Q?ChM3XkKol9j6wV6vM3cicQriz0grYhF2QikvJqD4Pl3gTLo4dheujLEMO7T1?= =?us-ascii?Q?l+zudv4zwSmbvSMnjh1auWlBhztq75l9s5z09XE11dQTpsB/wrmmQWb96SIN?= =?us-ascii?Q?8qwFCnKd4czZUXH5Ktf9jZq+UeMQsxhwhBTAy2lDe6MjYrl3+XolAsDyPP3H?= =?us-ascii?Q?Lku0uIygi4zX4rqrgaJmootXbrgb/cWq0XK5lvf6CB2FUQ1J/99tuBHe1mFN?= =?us-ascii?Q?B5goCmEQloQsoAT9fmkBHYfR3NohK1UeonZZT7noZybodJVHydtmthu2Fzf1?= =?us-ascii?Q?wGfgaL0tPRuOMjpO2kj2xm9vuelrw6jFyrM/Mvp7kfam0g/ysJWaG5XK08yc?= =?us-ascii?Q?mpEWK1hV34EpnnWj8tknpKAj4qKxC5DQWw+tKa8vq6b31hk71SPhjyz1BCgw?= =?us-ascii?Q?mH+Z4PPmSjxiIxyorNS0BZNXQm7cFmf0bqAG33hq0QgsMsHVuz27p8Q4bQbv?= =?us-ascii?Q?a9yDOc5Q4/vF1H1UvSIiuv17LmcZBj3wa9DdLHZFpRdnoYF0m9twpVhzG5tr?= =?us-ascii?Q?zeQkHvcNjJBWIpTRUWhcopIwFbw9kli?= X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0158;6:tXpmRDizXDgKQPTdR448CM8Ip7L11cd9ycAfQK2O+B97Bo5j8yd60+MeA0ZhRldFFkVRu0wTHoPATY7esijA1kUWKLo2bJ98qtzNwbFqIkLHuDorYuJkwRSuFolAl938uy+yPlw0/W5BS4IRFgxyjtQOKbqgD6DRiC7KyxdXJkDT+r7yj4tQ08B8kG6pn2JaNp8aGMIdK5fNzo/pAvs8hmS+bwxqORku4ixSmGCOs38o25Nen+jnOcJXPnGCnfmOTVIDslCkyy6p3cwCnKZTX6nBa7OHERpjCAUm7vuHnU9/2iEvXQcnD3SRv++6KzSfBBafpPKPPnKZ0xv5waPvGw==;5:QBxMms7QngiI4e9Yvh/XRWGkwTZTjSbTymy+Onic4AxckwS9ZQZOlKrn/M+axFrTIFGBj75X9H7U5sTmDYtbOmAYqziqjiahXcehCP6XuNVtblTLeEyROXyhhI9vmP421r9wX5FlzQm5yQK61Rktxw==;24:x7MEt01h/8PqFY+LEUaxVNZshgw3VUFPphDRPJkwBbFrrUq1Asex0BMUFmE7XUQ6yopjxm4eX/CxtFklf6TwXYCJGytHuctSpYNj+LYwg0U=;7:1BUbYorDdPMVVEDOU3SWA9wf9ldbDLF0kUh8HgxPO+z9hclbHl/HyhOcCETr3ncG+PR20CD7ImMT+1BSUalAvW12wB9/t+/vAwE9coHdhP2RdL0viICSB0SunUOAsLpvF6vdugC7LFwWBdzwJKgo3ovnF8h3nb/4pkHLIIF8xDzFQiYuNaLsGWSUMVQiOjf1lz1lgdAtB7mM2yuwScxp0Vh3A9rY6B9YY5J/tJmTjms= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0158;20:sYwWo5w0lTWhX4c85rrMZCTU57AzvqoqVCn5lJj4kSIeS2YtE/49btVK0uOkaAi8d0DeiNeLlKeWwNh5a1prSqUZHtm2NZxryMu1YRSYy+JwafzYR5d5tGS+Hg0+6sTSN0E0kJhO+Bb7rzFUfzZ8cwOG0wlTIzKO+IV7haipy9/VFuXEBF22Fp5rKV2nn8qGk3v0ZDQl07euFjcMjG+vW0SeaevZXLBeqa2ny8sARniR64mPktRBivyuYeaAED3z X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Oct 2017 15:34:42.8696 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN1PR12MB0158 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Tom Lendacky Provide support for Secure Encrypted Virtualization (SEV). This initial support defines a flag that is used by the kernel to determine if it is running with SEV active. Cc: Thomas Gleixner Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: Borislav Petkov Cc: Andy Lutomirski Cc: linux-kernel@vger.kernel.org Cc: x86@kernel.org Signed-off-by: Tom Lendacky Signed-off-by: Brijesh Singh Reviewed-by: Borislav Petkov --- arch/x86/include/asm/mem_encrypt.h | 6 ++++++ arch/x86/mm/mem_encrypt.c | 26 ++++++++++++++++++++++++++ include/linux/mem_encrypt.h | 7 +++++-- 3 files changed, 37 insertions(+), 2 deletions(-) diff --git a/arch/x86/include/asm/mem_encrypt.h b/arch/x86/include/asm/mem_encrypt.h index 6a77c63540f7..2b024741bce9 100644 --- a/arch/x86/include/asm/mem_encrypt.h +++ b/arch/x86/include/asm/mem_encrypt.h @@ -47,6 +47,9 @@ void __init mem_encrypt_init(void); void swiotlb_set_mem_attributes(void *vaddr, unsigned long size); +bool sme_active(void); +bool sev_active(void); + #else /* !CONFIG_AMD_MEM_ENCRYPT */ #define sme_me_mask 0ULL @@ -64,6 +67,9 @@ static inline void __init sme_early_init(void) { } static inline void __init sme_encrypt_kernel(void) { } static inline void __init sme_enable(struct boot_params *bp) { } +static inline bool sme_active(void) { return false; } +static inline bool sev_active(void) { return false; } + #endif /* CONFIG_AMD_MEM_ENCRYPT */ /* diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c index 16c5f37933a2..af7f733f6f31 100644 --- a/arch/x86/mm/mem_encrypt.c +++ b/arch/x86/mm/mem_encrypt.c @@ -42,6 +42,8 @@ static char sme_cmdline_off[] __initdata = "off"; u64 sme_me_mask __section(.data) = 0; EXPORT_SYMBOL_GPL(sme_me_mask); +static bool sev_enabled __section(.data) = false; + /* Buffer used for early in-place encryption by BSP, no locking needed */ static char sme_early_buffer[PAGE_SIZE] __aligned(PAGE_SIZE); @@ -192,6 +194,30 @@ void __init sme_early_init(void) protection_map[i] = pgprot_encrypted(protection_map[i]); } +/* + * SME and SEV are very similar but they are not the same, so there are + * times that the kernel will need to distinguish between SME and SEV. The + * sme_active() and sev_active() functions are used for this. When a + * distinction isn't needed, the mem_encrypt_active() function can be used. + * + * The trampoline code is a good example for this requirement. Before + * paging is activated, SME will access all memory as decrypted, but SEV + * will access all memory as encrypted. So, when APs are being brought + * up under SME the trampoline area cannot be encrypted, whereas under SEV + * the trampoline area must be encrypted. + */ +bool sme_active(void) +{ + return sme_me_mask && !sev_enabled; +} +EXPORT_SYMBOL_GPL(sme_active); + +bool sev_active(void) +{ + return sme_me_mask && sev_enabled; +} +EXPORT_SYMBOL_GPL(sev_active); + /* Architecture __weak replacement functions */ void __init mem_encrypt_init(void) { diff --git a/include/linux/mem_encrypt.h b/include/linux/mem_encrypt.h index 265a9cd21cb4..b310a9c18113 100644 --- a/include/linux/mem_encrypt.h +++ b/include/linux/mem_encrypt.h @@ -23,11 +23,14 @@ #define sme_me_mask 0ULL +static inline bool sme_active(void) { return false; } +static inline bool sev_active(void) { return false; } + #endif /* CONFIG_ARCH_HAS_MEM_ENCRYPT */ -static inline bool sme_active(void) +static inline bool mem_encrypt_active(void) { - return !!sme_me_mask; + return sme_me_mask; } static inline u64 sme_get_me_mask(void) -- 2.9.5