From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S966065AbcIVRrc (ORCPT ); Thu, 22 Sep 2016 13:47:32 -0400 Received: from mail-dm3nam03on0062.outbound.protection.outlook.com ([104.47.41.62]:60224 "EHLO NAM03-DM3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1032131AbcIVRrU (ORCPT ); Thu, 22 Sep 2016 13:47:20 -0400 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Thomas.Lendacky@amd.com; Subject: Re: [RFC PATCH v1 09/28] x86/efi: Access EFI data as encrypted when SEV is active To: Borislav Petkov , Brijesh Singh References: <147190820782.9523.4967724730957229273.stgit@brijesh-build-machine> <147190832511.9523.10850626471583956499.stgit@brijesh-build-machine> <20160922143545.3kl7khff6vqk7b2t@pd.tnic> CC: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , From: Tom Lendacky Message-ID: <443d06f5-2db5-5107-296f-94fabd209407@amd.com> Date: Thu, 22 Sep 2016 12:46:59 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <20160922143545.3kl7khff6vqk7b2t@pd.tnic> Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-Originating-IP: [165.204.77.1] X-ClientProxiedBy: BY2PR11CA0018.namprd11.prod.outlook.com (10.163.150.28) To BN6PR12MB1139.namprd12.prod.outlook.com (10.168.226.141) X-MS-Office365-Filtering-Correlation-Id: d47ff6c9-89cb-42b9-bc51-08d3e3107e55 X-Microsoft-Exchange-Diagnostics: 1;BN6PR12MB1139;2:Hucc47F7d7ezns+fcSkD3WBnBso3HbISx/oBEaRUOgcBM4VEb39t0E6fShnpfgMDTQ+w9V/oRLuS42IB7rWDumo4qHtx+OBpQ+UT3eRRNjPxTMECf5SC2HjwmxbDSg+bEHXIBxataT+afJ3ZgFD9sttiTd+3twyV2R0rGRS/N7H7kiHdiABwgUFU8QwHiwRF;3:XizJ+g1DhNfU0s+Bfy0YJLvsXnRzvRRWkrHc4LZkLZbqGCTmhRfyJAfbhFRsQHhZLu8+RZHHGFCyAy8g/rc+AaOs+UNkNRayTVtm8YC36A0sr3hcwWRSCS/7u9uB6fbG;25:lfT2c6GvEiCf7AWtnqqnU+SHIrNvX4wGaCGRsCHpZehWns8I9WamRS65gFoHy0taEfQFyKfYeNZANNTZVG87lnIJbN7nW+tshB6taXr5NTH43RZLtEe4VvUexd+JQTmiKQevviqv7Yk4hNaOKXzyM+KHouB/euzQoGlTypEP9vgkSuvho4Br6l8EVE4fbPxSELfn/OXwgvas/bqeUsN812TpuaCJ/9hiK9/ZDWIGtQl80XUrahWr4GQDjQ64V0gwkYQyUvaIaF9zDho3FHQ7iSyczztuAsiyPTUDSUojmrnaJI/oF1g13JhIjzyUnHvsOOvbO9tssFeH+4j5Ybr4jaHhf1frFVP8TenHowXEJsm3EIiNevytCgGIf0E02WmQGTQf4Xg00mruwMydJpN3h9U5o27QOsOmGYzFq0iKekM= X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BN6PR12MB1139; X-Microsoft-Exchange-Diagnostics: 1;BN6PR12MB1139;31:Rr5TIP3xkEeAEmLhKHQhTWjok3v+3rzPJ9+Pw93peC9P3mXqK8VITZKfzlLx2w7X/WTCj+XF6RBCdbqt4/H3wTx7pLhfqvG9JT0RcaPja/L9ccI35NUQTSFrP2TYoPQAFmzMMw7+2ne6toj6gPPCb3yyBbZ/WrLAmtH6IpYb/Q1arrmF+F2UkQoXkq7YTpAINjHUimKDeW5mU5mURy66pRIT1yYOZ/R5mFKY388dcww=;20:N3Eico4nFicKVyxwnEc0rHn8hUftDne+KoMavJqfHvY8kmglZWFRBCd6OrdAb+Z01GP/GpXBV9hEMvTHdVKaQ4YYFlI6oVKY0wxvR8MmNlkX3eIQwLw2EGxnEFe8xRHUG7OKtpsc9W+I6Pb/E7saLoatZ3dmOIAewSudG4gA74kM4JqqmRsI3ewHo16MSj37yr0MZIExU/KzWdeFngxTa5ACMSMpSciHc5nqPu0oAM5h7z3lyx/k5seccMOnBK1h8tTRxIoLkRYEvs2d0S60OV++OfFz508B+6ywUjUcFjzxmWrKCzXpBYxHF3bB2T8UtZWHiVyj4tTi/Q96GCXlgjTZrtRxjEtqH2W3qGNd4lzzgwLeiuzJ2SynelkkzqAmDWSCx+alyIgidzIPfnxPsW/X2Tx9ZUSRLxf5eOqKPlw27DdNaY4B5SqPrx/wC+5PEJQElhJ9dkmWUrUk6yUR3yA4siEomuB37yxMslh/Erp847gEDTkpAvJePr5rA934 X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(767451399110)(42068640409301); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040176)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(6055026);SRVR:BN6PR12MB1139;BCL:0;PCL:0;RULEID:;SRVR:BN6PR12MB1139; X-Microsoft-Exchange-Diagnostics: 1;BN6PR12MB1139;4:Jq/ZdaLSRa/cCEn85w+/+BgqOnb02xWQG7Azj34NCYEfKz/tYvxzhqQsK1nrGSoLksZkt2vSx5RJIJTL1SfcA68rPGydnE33m/ZJIimYNybQ6VP48z/EdOv/DkBIEBjX+Lf1Md1orq3ZoCm3jceTFgMNi2pS76BToHFG0/2rEARuxdnd8epXbTFh4H+XB76KD1RP276rkLHr3vvV1xPYonySxUybYnujF+Up1XwW37FT3GHHG+Bugmy25cU1Gfz+MtsMjuph0uEBwg4ovCf0XUwGYOfsVAZPNzY8y4wlLSPAl45WjQoazDbowBKBSFDs1imw7JjsJUpnYZYjUBVnDm8P1M8CLHcoPfa7UX21p5QKNpVg5T+79uUEuxpVwKUTiBAnBaU1DsuzyaOuXvb7g+mNY/V7asF4A0T78GWJ0vqdFZQaswd/d2R7+u+1rXMkQkay35vyaQKn8edEWIaD07hn7yXG/9+VgzHehPoTrEg= X-Forefront-PRVS: 0073BFEF03 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(4630300001)(6049001)(6009001)(7916002)(199003)(377454003)(24454002)(189002)(6116002)(64126003)(31696002)(50466002)(2906002)(86362001)(586003)(7736002)(7846002)(65956001)(23676002)(68736007)(36756003)(66066001)(47776003)(106356001)(105586002)(8676002)(65806001)(305945005)(101416001)(81166006)(42186005)(31686004)(81156014)(15975445007)(92566002)(77096005)(4326007)(3846002)(2950100001)(19580405001)(97736004)(76176999)(189998001)(5001770100001)(7416002)(50986999)(54356999)(230700001)(83506001)(33646002)(7406005)(65826007)(5660300001)(4001350100001)(19580395003)(217873001);DIR:OUT;SFP:1101;SCL:1;SRVR:BN6PR12MB1139;H:[10.236.18.82];FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtCTjZQUjEyTUIxMTM5OzIzOkoxcTIzVkt1bnUwb1FGZWFzL2NKVjVmUTFC?= =?utf-8?B?Vmt0RE13YnlkV05SbVpqOXZkV3pnLzBBMFNxcjh1alBrN01IdE5WdjBxbGNa?= =?utf-8?B?NkMvUUQyUDJkYVRiWWp0NlV6Q280U0I4WllrSnRIOUVDRTVUaTdCalFQTnhh?= =?utf-8?B?eC9LNFJwWWRmbWNMaWRlODdEUStaOStXVC9XNmZOWHFmVmlucW15RHE1T2Qv?= =?utf-8?B?Y09VUG41TitZNVd4VC9aaDhKbTlaL0UzK1lacW1TYkFGZjg2NjBVbmhyOTF6?= =?utf-8?B?K0sxNVgvazRGc1oyRmNIUFV3OTBTanJsNnFCbXBPajdXcE4zYldxN0t3Y0lB?= =?utf-8?B?bzlQV0VqbEwzV3NGQ001Z00zcTdSNXltWnFacFhXUVBvRTFxRE84ZUhIekxM?= =?utf-8?B?emlyN0pUTDRkV2dtUWZ6NzRBR3JpK3VXVG93MFZJTkhJb080cFhweUVLMFRC?= =?utf-8?B?aFZMUVUzVHJacVlVL0dveDVVVy90ZkFoNDZZQlc5dGhjTFkycHltdEtGZWEw?= =?utf-8?B?dFM4UHgwQVNtNm9QK0xnM3dDcEdGLy9XRDYxZEhXbFVxR3dSL0VSN09Ha0RL?= =?utf-8?B?d0NhVWtVeWM0SkIvYlJYM0VYcjdIS0xsMGs2ZTRMMW95eGlGUEZqbW1ncEVq?= =?utf-8?B?cGZYQzdJckNVL1NTZDFPT2F0am5EUlZzU2RnRWtwMTJIZzNwN25oYWFPbmVo?= =?utf-8?B?RlYxSFpBVWZjcm5vcjY3OTJMQmExZmdQcXBHc0QzWVAzZ3hyU2czNDJwNzUw?= =?utf-8?B?VHBGSHBxL1RTelZUdkRMTDdtRks5OFlDVTF3UHVVMVhmWHkyMVhON0RVUy9R?= =?utf-8?B?NGRNY3pocldyeVhJQmxnWjVyRFA2RlZKSEgzRlhRVzRUTUoxY1VORmY5VS8z?= =?utf-8?B?dlNqV0lYdUFFNk8wSGJVOU04VkMzS1h2cmdDb04yTXhkaXp0dG14OEpWb2Zr?= =?utf-8?B?ZGtzNEtrUTFob2Rha0ttN1FWWXMvUFVjbmU5NThYakJENEVZSEhJWWNzN3pj?= =?utf-8?B?ZmpJZUdtMnYzNGF5RlN6QkRmTUlPV2hobDJCeHk0cEh4L2sxM0xGOXBnQUZ2?= =?utf-8?B?ekhLV0tBOW03UUlaU0hXMzcrOWozMnk1RGk0dm51UFIwZS9kai9hL3Q4RGZP?= =?utf-8?B?ZWlVNVNKVkZJS2kyVllEdzF0Qmxrb091c3Q5cGk1VGRyRUd3NTdLYVlDK0dI?= =?utf-8?B?aUVZajQ1U3BQdXVWaytkL1pmeVFTVDZ0MXkySlA1Z3N0bzcrTGZXSHJGT2dh?= =?utf-8?B?QlZRbnFDZEs4NHN1VHhpTDRodzBoRGg2TmpPdUdDV2l5THRseVVGbzNQdTVq?= =?utf-8?B?RkpBS0ozNmtFRit2Sm4wbzdoVW5BUFEvdnJGcnFYSi9NSVZEQ3Q2Nmh4c0kz?= =?utf-8?B?eVRyakJqOGcvcDVNMkFhdHk0UnpLRHpXMFBhUTdvRVAvOVJraG5IOTFNZ3lN?= =?utf-8?B?bGcxS1VuN2huc1V3azZoaVorWVFGcWpWWmpxVXdTNjVzR2RJRW5rQkdPRk50?= =?utf-8?B?OU5lUU52RUpqcGNsZ3V5THFXVnE4bmU4YmV0TUUxZ1pLQ2xlRmNFZk16LzRB?= =?utf-8?B?dHo0cGthQ1V1VWdKN0pOVythYUV6WnRnWThickFzYmNqSDFzNWt0SUFpVklx?= =?utf-8?B?YTJwbmt6Wkt6N3loWGxDdFdieXJseFN6NTZLejZnSDVKZzNHaE0wYVRzUW82?= =?utf-8?B?MG1DbWEySGl5SEIzTStGcHkxMStZL2o0SHNxWXRHcUNGUDFiQmg2ck5iSWJ6?= =?utf-8?B?eFFiYWdoMFhDNHEvdzltNHNJT2JGN3lLa1paTWJHdkgvanR6WHVtSHlZWVFl?= =?utf-8?B?b1Z6WnhUNXBmS051S09CbW9CcjVLSHVmR0N2bjVGSVRPcmszVjZHNTVLbkVn?= =?utf-8?Q?OJJQ06WVD+Jxy2bAXoT4gm68VfDB9PGQ?= X-Microsoft-Exchange-Diagnostics: 1;BN6PR12MB1139;6:648F6oGbO6NYGA2uLTzl8x67D2YcyzxWvYxA9JqT9Hl5ZrjaFWlF24JUpneizxCLQBlWzYvDBOu97xn3O992cZxQOt/SFcCcyKEnvG1ggWt7pOoY1sbjn1P9i0lrQizLRfaZacFcbJt2p4GYzsGxPtvGtU83W85ifqHofW+Es09UuA49FnnUrLpVHdQYuS5crjo90FTOpGlsJMl/xIRshtX+e3pQjW9bqn3ke+nO8o7455Wk0nA5MzNaDvWF64/dFlGVurnE2gzkXzZrpA8sBvN1iUbfC63WMTepD0Wij/1ii4wqmMQpQBCZnTZa8zz/5fqYetfUu8dr5VuiH76Mmg==;5:19+I7pP+nJSynaDGFQ9qsudo4AZNKPRYTsq93pzpC1pDtoKKm+qQPXh0wTlEvx+4syw6cgn7XM1UQHiYvfEGQkYshMPcpOzoJHCd5yj1AsujoVptiIWN/QjpFHcJX8B1s+DoWTUgNBDwAJ7dc/R1fQ==;24:OHfY93LMOrrkaNHxABZ0S5pLozsmACurfMXMTG7bjPaX7KVG1Q8viJh9TT0IrOJZupi2x52hXaNKLUfJ4qPr+yrPqDt8Y2QvkUus2V7Wdbg=;7:0QIYATi7GnziDiivAJrd2UrVgARUlVTrVsk/h2oYKPu1nyvc5BW8WPk2MU7ABxaU/uSqwlBhlIfuPmpwHcfaYHLmtbZsditxLsQjKCQCrWKKYOLk+4nka3Ra37df7lH50axlN5pWdauJzrHfiucDCJfp+YiDAqxQ1QrbycQFQ21qeLuk3WwWBAiXYhavm//9hMCfz4OoQ/a4bkgTPMY/q2HJhmb0STEV1I7KjXNM77zQgXjztjWcjsETDIkzVhWBBhE5wvyva+cH9rO4LdMpaEO18rjptIWigrmcW+ludw+tYiH/lmnN9MYSrjogO7c8 SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;BN6PR12MB1139;20:qwcYFP/vgjNlUEC1EE5WIuUo+CJUBENIcxA5sLjb+nApdiNoLucGvVFu1JEKBokDXHkhYn9tV5D6elmdnYWwrLw7s/mxf2Ia0KjwcN84I/vUdppvSTL9QyFxpZwySl0LnGlxudPIgRMX9z4BWEynl1qcMyKo8uFBZNsvUmbCz8lBLuOmlHBLM2Hy9LSypX1I/z3w+WgtQp/FE7a9uhWqpoVKEoAJLQMaP/T4/ZgksdCGJ7zavtWllMtyFNnT3C79 X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Sep 2016 17:47:11.3246 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR12MB1139 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 09/22/2016 09:35 AM, Borislav Petkov wrote: > On Mon, Aug 22, 2016 at 07:25:25PM -0400, Brijesh Singh wrote: >> From: Tom Lendacky >> >> EFI data is encrypted when the kernel is run under SEV. Update the >> page table references to be sure the EFI memory areas are accessed >> encrypted. >> >> Signed-off-by: Tom Lendacky >> --- >> arch/x86/platform/efi/efi_64.c | 14 ++++++++++++-- >> 1 file changed, 12 insertions(+), 2 deletions(-) >> >> diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c >> index 0871ea4..98363f3 100644 >> --- a/arch/x86/platform/efi/efi_64.c >> +++ b/arch/x86/platform/efi/efi_64.c >> @@ -213,7 +213,7 @@ void efi_sync_low_kernel_mappings(void) >> >> int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages) >> { >> - unsigned long pfn, text; >> + unsigned long pfn, text, flags; >> efi_memory_desc_t *md; >> struct page *page; >> unsigned npages; >> @@ -230,6 +230,10 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages) >> efi_scratch.efi_pgt = (pgd_t *)__sme_pa(efi_pgd); >> pgd = efi_pgd; >> >> + flags = _PAGE_NX | _PAGE_RW; >> + if (sev_active) >> + flags |= _PAGE_ENC; > > So this is confusing me. There's this patch which says EFI data is > accessed in the clear: > > https://lkml.kernel.org/r/20160822223738.29880.6909.stgit@tlendack-t1.amdoffice.net > > but now here it is encrypted when SEV is enabled. > > Do you mean, it is encrypted here because we're in the guest kernel? Yes, the idea is that the SEV guest will be running encrypted from the start, including the BIOS/UEFI, and so all of the EFI related data will be encrypted. Thanks, Tom > > Thanks. >