From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754287AbdJPPib (ORCPT ); Mon, 16 Oct 2017 11:38:31 -0400 Received: from mail-cys01nam02on0072.outbound.protection.outlook.com ([104.47.37.72]:39104 "EHLO NAM02-CY1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1754132AbdJPPfA (ORCPT ); Mon, 16 Oct 2017 11:35:00 -0400 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; From: Brijesh Singh To: x86@kernel.org Cc: bp@alien8.de, Tom Lendacky , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , Borislav Petkov , Andy Lutomirski , Matt Fleming , Ard Biesheuvel , linux-efi@vger.kernel.org, linux-kernel@vger.kernel.org, Brijesh Singh Subject: [Part1 PATCH v6 07/17] x86/efi: Access EFI data as encrypted when SEV is active Date: Mon, 16 Oct 2017 10:34:13 -0500 Message-Id: <20171016153423.2980-8-brijesh.singh@amd.com> X-Mailer: git-send-email 2.9.5 In-Reply-To: <20171016153423.2980-1-brijesh.singh@amd.com> References: <20171016153423.2980-1-brijesh.singh@amd.com> MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [165.204.78.1] X-ClientProxiedBy: BN6PR16CA0015.namprd16.prod.outlook.com (10.172.212.153) To SN1PR12MB0158.namprd12.prod.outlook.com (10.162.3.145) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 611b6dc8-239a-4a4b-6a3f-08d514ab715a X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(2017030254152)(48565401081)(2017052603199)(201703131423075)(201703031133081)(201702281549075);SRVR:SN1PR12MB0158; X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0158;3:BQb9s2+RCOHH3j9YL89dZP5Hl/qUv/MeVBOPHnBHLM1y+uryco3Mii8fBW1SHeFazqOF5ai3P/vCyqRqexKJSBA/Yu14zLld4iyjtLa6mKa+w4LzjV/cSPfODJ9nEtkZwwKDbtnQbj0XAFVhLZ1puM9ValE5/JbiHVsnCXSxmZN/0rNldrexbUe3sbATRBA2FjmqywwTzWv90Mz2VsEr0aambswYcfSMCFp1PJ/uF3NUee9PwjcODaS0TrmFM5cu;25:o4P4Sg8dLxwRrdtPCJ8k2x5ShiBCnDLasLEZtQbYTRl80MOF4Ykmbv3FGpsxIRw1iUgfQhByqn7JfSpVjDmz5XT7Bszv/E4xRxFbklfg3kuvyO4CfapX8v81Z/Xti15czEJ30r+XhY6cI6zaZw1ECkfALZWmWAkl24LwjeRLpwxlBJOvamU3TU9XL45teyEFPKC2PGpqHXzuFUrCQQ59MRRWe1tbl7uU+B7LeDzIGI8SMKYk1zo/UcoJQ7QlbFMXvj1kMFcd1kMC1LTPHBmE/ceYToykTxQd0jvbHxJyt6LqhRZ75xny9ZWtFXLxUMJSKdTyygjEtd5ZsGWlfg+Sxw==;31:0mwa0Se7jP6CoGlAxZgSwDQa7UQ6pR2Xdkqdr2siKjoDE5q/5PhpICReCwhIKqigREgxWg9W1Wf7uLcve3+y65EAFrZMb7kQBJMKevPrMJj7sPhk/vqlsJoW88tZ6jOiJ72HEK0/l6mfaAD9mPg+vGTdJro9//CLHI2y+4U09gGDXAm6B+vprgVPd7cnDWjeZ236SN3lsD39BJsZPRPqiaekCV1crjrLaSub6QmzcJg= X-MS-TrafficTypeDiagnostic: SN1PR12MB0158: X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0158;20:rqhP8n5MtCRycC+3rlwXLFllWR4lVICaqqd/zAlNuTBfV8g3UA5t+8bNzdO5xeeULcv5oxkuAGiJbSucTau4FTmZqzZgC8uQ37RJ8MdBrBzXv6RalxpWTY0HIAyBamFsRgxv+EvTQ45/CnkOD8f/4cd682culmTl2rmJUaa62pQftmzkLmuQvyI2sMpVyVdMulKhEelzTxMj3+GwQUtjk/su5Smvp0T6JPjFeSrKXg663QSJtlXy07IJ4rckixiajptlXz24Vcd7oZ6z2AFBG7TJJcbu6jHy9dfk9vP1t/nqfevKh9VkxdMr3pPH8EZdg5W4IU4VuH4ruOWBttmJ7EIAkNYKkzs69nQGtqosC5w+qzMrBxfkXtXGvyfpG48Ec6bn0dJFve+GOoFWcosrtPiF6K4MrMsTpVEZO6WklD2FFoq2JOjrrioEpWox26y7AcgtIOrgb8L0kJGHhHX03CUHexq9ipXj9XIgYfEUOk2LVsAZZhfSHc7rMI7jhGsY;4:4QGm/FFWKUNcw0eFsOYUVSl3QkjxkTq0Ow1iFOQAoMabfhOic+RT/nSuKrMv8mjd+7ZxKVnlUZmAJ6h3RxjnpC1q7ZFeHHOCB4//7C+5QCeiSdb2GJZhcJC5Sgc7vo24dvUdYQzy6Zb4q4+Alwi6wFK+iw4u/U7iGNS+v/HFhkBUrMSUz2uA0ZPqugENGILt6nS/f/5aa0W1FRAxqicfFS4eoJ4EbLek27BvmfFMyuEaOY9hXShjoUf/r3wP8LVQHw7SwTPF8O/HhTqHgGF/mWUJXEZfvVKu77OZkwJoOBEutYaBvJHtRyFS2PuCoBfT X-Exchange-Antispam-Report-Test: UriScan:(9452136761055)(767451399110); X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(8121501046)(5005006)(93006095)(93001095)(100000703101)(100105400095)(3002001)(10201501046)(6055026)(6041248)(20161123562025)(20161123558100)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123555025)(20161123564025)(20161123560025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:SN1PR12MB0158;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:SN1PR12MB0158; X-Forefront-PRVS: 0462918D61 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(6009001)(346002)(376002)(39860400002)(199003)(189002)(54906003)(7416002)(1076002)(316002)(5660300001)(16586007)(68736007)(2906002)(4326008)(16526018)(7736002)(47776003)(305945005)(6666003)(53936002)(86362001)(33646002)(2950100002)(6916009)(66066001)(189998001)(97736004)(76176999)(106356001)(101416001)(8676002)(53416004)(105586002)(36756003)(3846002)(6486002)(6116002)(8936002)(50226002)(81166006)(81156014)(25786009)(48376002)(478600001)(50986999)(2351001)(5003940100001)(2361001)(50466002);DIR:OUT;SFP:1101;SCL:1;SRVR:SN1PR12MB0158;H:ubuntu-010236106000.amd.com;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;SN1PR12MB0158;23:A9AgC1AgEF0KUKmecVFF5XMQbL4zjEMb1TGRayaiM?= =?us-ascii?Q?IrD2SiSfHDeNKwDadNzpV2Qk7ngyo539fqsoczBcG7s3GP4o4qRpXAT8PK3P?= =?us-ascii?Q?xNc6a8wv9QYfg7DsF6HuF3M36TYCGjLhQnx4ha7/Zo7zmeZ5gP7RurWJpUdt?= =?us-ascii?Q?KMhFZhGc+E3vZx6z3WydK+UaCPwN9wJn0JkFrKv+qypteSAsD0qjZOj4gfnq?= =?us-ascii?Q?W7o/xdbkrtafpUEz/PBfFuCnABcr9JQV2ie7x6XuwaESOFS39m13gm56/tMr?= =?us-ascii?Q?yYQBo2cIMn2y8mqjcBJmOND0lLgqZE4V7hc6KB/+Ti+ytuOeoIpdLGlQbYCp?= =?us-ascii?Q?yOrty9pS0nxFuSxoqs3s9K1AgBa0btIRMa9R07KbLRpAvuP9F5MxgP61BXU9?= =?us-ascii?Q?jzASvmHSKsKV/6tPSJgjOVDCpJQgtidAV2GNuc0/8qUJoE0Ucn2cE/STJsit?= =?us-ascii?Q?4ofzsXmWv85wlaSFzuzkDQDKIpHRJiNaQxD+d+rcJqoVS3483B6bCvzZkwh2?= =?us-ascii?Q?DtBOWYgJGLa5tzYxf1bKoQO+vQ0r+sww4TlwHnEMdhcTop6wuJk1YpMEtmt+?= =?us-ascii?Q?kPoLsc/eMKWVM6IUqjN8WnZwqtmYMV1ZLQPPom0eGxN+77gQCKNQRbGfU6oy?= =?us-ascii?Q?h2Y5U3GXG4YNxg9EaSqQE7w0flxFF89K+XuYfti8VviUhhdCE4Sqa87eZYNd?= =?us-ascii?Q?TuvHusDsC1zxtqsrteiwtPcG9gmHTFTaseSicoPmDOZbZmZZuSH5M3zjQbfn?= =?us-ascii?Q?B+sXPaSpX8sgaIJJ13yDA7USjD8lYq4lJO4b6Lr/dQ5SXMXQMmgJdf3skjp2?= =?us-ascii?Q?bZ7bQt7HMxMIEpNWC5CclyUq8ixJX5O+Db8OoFJt36bLuykq+y9KGUiLf/5s?= =?us-ascii?Q?pCY48Z/Di1fD1Ia1uAJ0oQNtid0d9GGYpRmDyQI+EOH4Mdk8XuaQnFMvBkRO?= =?us-ascii?Q?JDa4mIjN+cSZn4jEFy8SYevsNJJbI9EuPlFzNXAWedAK9OtQ5eA/3Qd3s7F0?= =?us-ascii?Q?WOaW/LCCWoEpoKgu1nnmfGM7hmXfuZ9T8GTB2Gj2YReu3OdlOZiBPCytlbu+?= =?us-ascii?Q?RUBOePkA8uQ1WwEDMyJFIr8fFmrQ113Oi835bKH7rPzrAV/4hllxj63Fc5aa?= =?us-ascii?Q?iUvVYbfMU0U7fSFT5ylhunws25Q05H6wKPO6oJ5TLyWy2ml60guJw=3D=3D?= X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0158;6:4Rmcst13eicR1hSdRP/DooDmtqSxqPV/ciGYF6KDIMC9he740xg+XoA5xW6XvxohTIWeJaPDkIx9a1bCks659Ik1BGxkifg7WuyWdfMJfsHU+7jxPC75KmHz7imfYmv4z8HUBKj9qTmtsk2nuK01hmCIS/FUM5fxdC7QtgjpQ6+WEW0zJvTjZBY56Jw5m9C1m+IMi5r/XH7ZRWNqJyzbFypUqZwSp3GrGSX1T4yxyRdZkxTPPn5h8P/kbzYwQ9smOD3wO9ErltMp5rHJoy6AdtZBx2BGuVjZeixJOFkiy/qsLaNDyxzTsDJK6o+wqRCfySSHYnVFssi8/oEqjaY2YQ==;5:X9tFypVH6M2rpW4riqbWngGZ29IgOqoZTogGqWWl7H8kwGFzTX4g4rRmbJM564U/MTHRomNWmhs7KJpXiK6gplnjUUYp9oBbYGH87vbsF6M8AU+qcNtZA5w1ugrL9XewGtpN2wT0z+Uj3Jl7NmYqGw==;24:azZAjZjTGQFPOQY8k32cP0IfUX6q84poUeu/Ll2UWMaElmHIZhNZ3FXU+vRctiYE2LnLqKhFJe6NvHv4W6ornZ4YUhbrbQ/EBGIl1XykBTQ=;7:BJxxYvFkqTsJP5IU8rNdWeLKRTHSTSqIk/UqvCWE8rsosRK421gfsnrn4INQfxxAfVGuKlVHjS6AXFqfnfXPWKek9Hig72nhenUaLFXTvo0ZRCTPmoxDYBiwf1KfQLgIuKAajmIMy8lASaMo1+kd080TL6584+BHFXNAj+qvtyjuIgoPrfQIimL3+5oI0oloyUvsbvWNWngjHN7DWDOQW3q5IFb5lrhc38SzawqbcOk= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0158;20:r0hXKa0FLffIq6WYhkN67ODaW6yfO08MKjMGKOlfma9rThcELl0JgGPRmPiK1NInvhBSRosKF63vljDmHnmmTd3QtowOFKNRnZNvMBqUjtggb3dWt6lPrYbTCj36fwyrxrlTDDjhdb6d+hkL6b233A1faYe27RIP8dLtTpF51Yl4fbU34y2TVFUBCIM4XK6kxoGRCNn4doQYXeW7wTnVB3U3e7iEesJ8ZRniZhDt46GxuCk8f7luhvAI/YPFpi4E X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Oct 2017 15:34:49.6507 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN1PR12MB0158 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Tom Lendacky EFI data is encrypted when the kernel is run under SEV. Update the page table references to be sure the EFI memory areas are accessed encrypted. Cc: Thomas Gleixner Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: Borislav Petkov Cc: Andy Lutomirski Cc: Matt Fleming Cc: Ard Biesheuvel Cc: linux-efi@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: x86@kernel.org Signed-off-by: Tom Lendacky Signed-off-by: Brijesh Singh Reviewed-by: Borislav Petkov --- arch/x86/platform/efi/efi_64.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c index 12e83888e5b9..5469c9319f43 100644 --- a/arch/x86/platform/efi/efi_64.c +++ b/arch/x86/platform/efi/efi_64.c @@ -32,6 +32,7 @@ #include #include #include +#include #include #include @@ -369,7 +370,11 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages) * as trim_bios_range() will reserve the first page and isolate it away * from memory allocators anyway. */ - if (kernel_map_pages_in_pgd(pgd, 0x0, 0x0, 1, _PAGE_RW)) { + pf = _PAGE_RW; + if (sev_active()) + pf |= _PAGE_ENC; + + if (kernel_map_pages_in_pgd(pgd, 0x0, 0x0, 1, pf)) { pr_err("Failed to create 1:1 mapping for the first page!\n"); return 1; } @@ -412,6 +417,9 @@ static void __init __map_region(efi_memory_desc_t *md, u64 va) if (!(md->attribute & EFI_MEMORY_WB)) flags |= _PAGE_PCD; + if (sev_active()) + flags |= _PAGE_ENC; + pfn = md->phys_addr >> PAGE_SHIFT; if (kernel_map_pages_in_pgd(pgd, pfn, va, md->num_pages, flags)) pr_warn("Error mapping PA 0x%llx -> VA 0x%llx!\n", @@ -538,6 +546,9 @@ static int __init efi_update_mem_attr(struct mm_struct *mm, efi_memory_desc_t *m if (!(md->attribute & EFI_MEMORY_RO)) pf |= _PAGE_RW; + if (sev_active()) + pf |= _PAGE_ENC; + return efi_update_mappings(md, pf); } @@ -589,6 +600,9 @@ void __init efi_runtime_update_mappings(void) (md->type != EFI_RUNTIME_SERVICES_CODE)) pf |= _PAGE_RW; + if (sev_active()) + pf |= _PAGE_ENC; + efi_update_mappings(md, pf); } } -- 2.9.5