From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751657AbdCABLF (ORCPT ); Tue, 28 Feb 2017 20:11:05 -0500 Received: from mail-sn1nam01on0047.outbound.protection.outlook.com ([104.47.32.47]:14800 "EHLO NAM01-SN1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751392AbdCABLB (ORCPT ); Tue, 28 Feb 2017 20:11:01 -0500 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Thomas.Lendacky@amd.com; Subject: Re: [RFC PATCH v4 21/28] x86: Check for memory encryption on the APs To: Borislav Petkov References: <20170216154158.19244.66630.stgit@tlendack-t1.amdoffice.net> <20170216154647.19244.18733.stgit@tlendack-t1.amdoffice.net> <20170227181701.2lynk4rm77yk4msf@pd.tnic> CC: , , , , , , , , , Rik van Riel , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , Toshimitsu Kani , Arnd Bergmann , "Jonathan Corbet" , Matt Fleming , "Michael S. Tsirkin" , Joerg Roedel , "Konrad Rzeszutek Wilk" , Paolo Bonzini , "Brijesh Singh" , Ingo Molnar , "Alexander Potapenko" , Andy Lutomirski , "H. Peter Anvin" , Andrey Ryabinin , "Thomas Gleixner" , Larry Woodman , "Dmitry Vyukov" From: Tom Lendacky Message-ID: <5f461d57-9232-1cb3-d4d9-9b8a39d00b12@amd.com> Date: Tue, 28 Feb 2017 17:28:48 -0600 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.7.1 MIME-Version: 1.0 In-Reply-To: <20170227181701.2lynk4rm77yk4msf@pd.tnic> Content-Type: text/plain; charset="utf-8"; format=flowed Content-Transfer-Encoding: 7bit X-Originating-IP: [165.204.77.1] X-ClientProxiedBy: YQXPR01CA0057.CANPRD01.PROD.OUTLOOK.COM (10.165.103.25) To CY4PR12MB1142.namprd12.prod.outlook.com (10.168.163.150) X-MS-Office365-Filtering-Correlation-Id: 6c60e9db-66dd-43d5-ca48-08d46031915c X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(48565401081);SRVR:CY4PR12MB1142; X-Microsoft-Exchange-Diagnostics: 1;CY4PR12MB1142;3:QAv+zPIGuewnsLLlOgNTgD7XmUHk29gLNG5QG3JtrDWlvMD/hve2z+sINahiV6m3b8QdWpGNGMOA50JycLjHZfFsH7sEZlA74UAGJ662VId6l5tengtxpYwuNhJ0ZPSfXHaZ5Oze20sApH+eFl4fSpuJx8yfKfJ/BNVhW8zoDuJ7KhLds0z2GllW7MRNyJXsoSYfWT0ovt4BgXJwWcjPIYa3+Bb4mLf14bB5Ma1TDwDvf/Qeqia0C4rFPasvDL4zy4WyEVkiJzN/jiQlG5EylcHVU1rWeHdokWL9YlkQltU=;25:kWXmr7tYOWJkJ6svgQ4IsvLrBfvN9hVduxro2VvSJhVXkUK2CRqZDq1OZV7tY8g8+5o49jmEvJOy52nTUYjpP/ZHMw91qDe+9xW0CBm8a0mvbUDJJff9i4HBa3VpIqR5kSnB7TcpPonHQBQsXcjR8epAPC2s5WTwgPQriBqCCe5rShIsFIkCQ1tqARIOQT+C7ykXY2no5WvFj2o3mPXvKJAxOTAiGNTcEoaRtZ5I/z/f+VzP3IE1kPYBMfzzjfJplh4+SDIG79/+cAwZkOEv84q/4fz1MfdIJ3nH3TAAbDW/j40zRueTI9DmVUB8DcltJBXwSUyGB7QS3pwdNb8HXHTILwuoAYLcLrO0ICRV9arRY+1A5NbZX33iWyKQHk5NMtilC0Z68GC+mZ+rodYMYakFATI2w/p5SmhM0rtCLfqsVckuseapAc+8N8akiNxJe6NAC/LvsY2wBn0JnfVRbg== X-Microsoft-Exchange-Diagnostics: 1;CY4PR12MB1142;31:tEdt67pqugCWaQnsdBbtgNxEwLem3JFuWC2XTU0QeoOiKqRJTXyFtEZWk1bakGL1jHHtFYtXN6CbyQduaJ31uBbkH9DIlcrsKBPwBu15DACnwHBh/yuk0sKqd8CxWjg08GY7TddE834Pt27X9jB3zXFSrLkdyS50UYvi2U8uCfI62smlQhz9Q1FcZAXWzmQb4Dmir6mwAu/YS3kYJxoDPaluUZVQU2kxdP1v7GScQr+IqpbYnDh2V3JvTHCFS/ss;20:LfkBh6bk2YPzVCuHVy2RP1+0ypgTYBpn3nrKyiPACI3VOxJzS2Y4GRmbFz2wa2byv4fRRoWZbfbgHA26ya2b5qFbfmTA5fBKw+/dxqqGsXUtpUpdzzjDnq+PxOD4M/ip9DFWzneXblvEHGIZQwaQ2iVtIdgsR0OLlgYtT98DwMwG5mtFG1GozdpYP6wcca2PFtuocTARS5r0gJ8h3nNcyfbD4DHKLilB11RemVF0H+VBBEzLw4kCoYtAQX+9OYFq9ZnZUA9zl8dzRwQkqi9me9Z7eMqOti0A3uwfwZoh8xYBE4CunTiuONEAFl+12eRndWSsYaHcXGGESnJn7DGG7FB5daz/tOZg2IW0OkP8thCLtQwLXYnZE4FyYAx/Zz2YDvYK5xPULptmU0AYsZZcnDVywTyeGLg3RjzKjlsOozOcsTKDzxxo9uArO+iSTR2N5E4JkUsJcq93GNFQDGEuROUb3Kx5Ur3IOnmME1Yjy9FN5b+mc3BM+xOMsHrHgv1f X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(767451399110); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(6041248)(20161123558025)(20161123564025)(20161123560025)(20161123562025)(20161123555025)(6072148);SRVR:CY4PR12MB1142;BCL:0;PCL:0;RULEID:;SRVR:CY4PR12MB1142; X-Microsoft-Exchange-Diagnostics: 1;CY4PR12MB1142;4:Zx0dPenUduf25AQiHE3S2CDFm4LmAyX+U2139OwXDgoYakeC+SsUWmJoulRhxuwSV+8lIHJj6qcTQwEEYdILGpiEZ5EpumjnReJiZPxLJJxWOj6/KRy13Nop5Kr52pyUe+9dJ2GBljup1NX6b9buSf2yK0+fNcVfwVAS0ehXvO3AcUa0kP4lyxZL8XuyAzsqocvyaysDFWjQA2+/WHxylrq/hgS+JkV37+ijFmU580qkN1K19N1rqP8zcQRD5p4OJpEf4DeFV6B/CcViNySjIa9fQPCY8wS60tf9p0fHvcZ+LIE8VBjs+VuYIst4gSNkYL6UvgplTqnSBiAN5xDspGQRIXTWoqj62DHrF0SAvrVYsOV1Awk0mijOrk3dyKvr+j/9l0ezTf0ZdFrTi3yFgy65r+Ny/2PWOtUDgXloS3rRvhdDVlm3AwO/fjRisoXZajIhMdrEADjNGPbA5QcO0Ik+9uyXVT3/S6Uf7+643mfOb0ulqi2DWM+ZHXqa5V9iIXGNzVZ/8lq28AWLvCHrwh7Z4rUiIny5vIVqPXjkkBg+Cwc/Sk0i/ABBYwzy+iRnEMfAdH2eWPzLHIh0iUD/ZJQpK2BCvXxN42fncMzmryU1PbEAVesaN3X7u9bpAD8MmvEEnsTARNYBQZh7YuM1k6Fzy6jiK3JbV/VO4gOyKhQ= X-Forefront-PRVS: 0232B30BBC X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(4630300001)(6049001)(6009001)(7916002)(39450400003)(39860400002)(39840400002)(39410400002)(39850400002)(24454002)(199003)(377454003)(189002)(65956001)(76176999)(66066001)(86362001)(2906002)(4001350100001)(65806001)(106356001)(36756003)(54356999)(50986999)(105586002)(31686004)(53546006)(54906002)(25786008)(47776003)(189998001)(31696002)(101416001)(42186005)(229853002)(5660300001)(6486002)(77096006)(3846002)(68736007)(50466002)(7416002)(81156014)(53936002)(97736004)(81166006)(65826007)(6666003)(6916009)(83506001)(92566002)(2950100002)(8676002)(7736002)(6116002)(230700001)(6246003)(64126003)(33646002)(38730400002)(110136004)(90366009)(305945005)(4326008)(23676002)(217873001);DIR:OUT;SFP:1101;SCL:1;SRVR:CY4PR12MB1142;H:[10.236.64.179];FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtDWTRQUjEyTUIxMTQyOzIzOk1MUnNWalJaSU9UUUZmQTdQMzUzcUlMOTcv?= =?utf-8?B?d0Y3QzU5cEdUaVg3RHkzWGVhL002Q0RFNXp5b1AxU1ZUS01QcVZ0Z2R4Tnhj?= =?utf-8?B?NVEyTFkzcHZzOTltWHJta2w0bmQvcmNLOXNrY2RiZ3h3eUI3RWdUM2NFeE1J?= =?utf-8?B?c1F1dVZ6ckF6K1ArVy9oUDBGTnYvS0pLNm9FSkt4TWRDZTZ0cE0zYmRZM3BN?= =?utf-8?B?bGRPeTVLZVV0dlRNWUl0VlZFVEFocTlmK1hOS0E4MU9QUW5ZNTBXM09Pcnoz?= =?utf-8?B?Y1kwNEs4TGtXTGlZTzJhKzVEWkxYbDl2c01NQTJFMTJJUXhNNDNrQXhCRmho?= =?utf-8?B?UVIzaU9RdER1WHZwMkhwRElRK0pyTFRHLzVhUUpaQi9ZQm1uUWtyR290VHMx?= =?utf-8?B?VEV5c0ZidVBNS0JiU3ZaaThwcWdna3pYYVZ5MFlZTkF2RS9RcUgyUnZjTFFv?= =?utf-8?B?U1dFMWF1K3IxSWRoUmczczJnTy91eHpHRDRXU3d2cER2T092andmSFpNRE9z?= =?utf-8?B?d1J4RHVnS2tIR3dJMkQ3N29QdHZqbk55UnpjZDMrNTViejJybUlFRXo5dXNz?= =?utf-8?B?QWlLRi9aeFF5YVY3VjdVZDVnNUlFbEh3ekFtODVUWCsxQUVkaGpYQXByNUdj?= =?utf-8?B?ZWNXWVowQ3VUMFFORzNlTitkaWI5STNLa3NBVWRzbVRHWFVzd2I2K2xHYnlB?= =?utf-8?B?bkxEalA2R2cxc1BnMHpWbTdyNmYwalJNK3MvYkVDbnVRZnFlaEZvdExWV0JL?= =?utf-8?B?ZDVXU0RyUUtCU1MxUGVKT1ZPSFpvNlhrUTNMMEZicTFnL2lQbElJdVpLcE5N?= =?utf-8?B?YnM0V3hsS2FoTG51dEhtNXcrcjlFVFhtNlk3ZndROU5VeTFDUzM3aE53V01i?= =?utf-8?B?M044aWRwUmNRNktQVndkZGhBWmk4d29BNUgrcnV2QjIrdzlPVnIrN3dycTRs?= =?utf-8?B?SW5hWlozbnFUN0t1M1c3SDM2d0hlS3J6Z1lEaW1VZWx3SWFiSFVuWWdlTnhN?= =?utf-8?B?Q2cvc1dUaEFRVXdvcExNU3BERjhRaHlJSnZxMElQZm1UeFg1bG1BeVFVSGpU?= =?utf-8?B?VU13T2xsVmVIS3Jxb3BOS1VZbFpITW9QUDNldXZHS3ZIVVJrcnFzSk5rV0th?= =?utf-8?B?ektRUEtsTmF5cDFFTi91YVlaa2U3dWthYy81RXk5RHhoeno3d0o4bVpMQ3dt?= =?utf-8?B?NnlJUW1VaDl0KzcrRTJHS3A3a0szeWxDWXlOU3hsN1ppRlBqc2JIaU9HdVFv?= =?utf-8?B?TWxDRGxKUjRQZUFxZUk0TWtMUEdHQXZHblk0OUJKYjI2Y2NFSUpKOUdiNm9S?= =?utf-8?B?dy9TYjRWZ0ZtTXRGODcwVkdUTmhpOGYvSGxQRGhVNE5SRmhYQXhjSGZPd3gx?= =?utf-8?B?clVYMTRKWVFFOEEvMUdLZnkvb215NmpMc1FLMjFvU0I1d0tXNmFBVStzTjRL?= =?utf-8?B?cXJXQ2ZQVURicGpTSEEzRk45eThjQUxPcnFnZW9VOThlTkVsa2tscXhySFJP?= =?utf-8?B?VXU1VEJGQ2YzeU9zdXR3ejVER0JxampiWnFJdnpqME13ZWFCS0EwM1V4MjVj?= =?utf-8?B?ZklaUk5PelpUUnZTZTcrbGVBVjZiRzhzcExuMEIxdGZIeTZqNnNSb2lWUEd3?= =?utf-8?B?SFF2dTYzczRDd3pGM2h2aVdPcmxLZkJmdUNXc254SkhRNjJ5MHpZeTAzK3Ra?= =?utf-8?B?cmlKSkhFbkNvZFVHSHVEbHZRbENWVWdvcEhTSUxId3JZT1QvQis1QXlLRmRY?= =?utf-8?B?ZG92aDZoelZSb3l2akxXdXZQWGx6ajcrM2VlWFpuTGZVVlFGb2piR2JteW9w?= =?utf-8?B?R25YcStHU21GWUdRdmhzbzlMeHNoaUNRMXgzN0tBU2Yrcm9LZFQ1ZjdZY0Rl?= =?utf-8?B?M3hCUkRRUis0VTlKK2FRSTFZOEw0YTJtTzlkWHZYL2VHcFpyOHh0enMrQTNJ?= =?utf-8?B?ZjNNODVnUVpKNmNRN01zNVFycjNJVVRFR3NCYk1DNys2elRsOTBNQWdoYXpT?= =?utf-8?B?ZEFiV1pNSkY5QkdLakNXSEJSZnY2Q2dCNjY0VWRZd2xHeTJ5bkF1K3YwMmEr?= =?utf-8?B?R3BocnZ6NndUbU1jaHR1UFpIdjBUeFRhMngwMDdPWVdGU0pTYXhYeHJrRW16?= =?utf-8?Q?Iv3rs6owOrenr/qLO24UqLM=3D?= X-Microsoft-Exchange-Diagnostics: 1;CY4PR12MB1142;6:wB0yDK3AvvQeeCYJEg9hhXY9EcapNKkOY7CxwTwo5zUWFYD7EmpZJYDnUge62yxAUU+UYFP/f4un4CcfqZLdxggP3X9ZmAgbnNzQlz5zmZ2iCjRckyVs82V3MKSxJGCDMqd79AQWgRgZ6By2MElh+OHNh4exLkU57xtT4bDDR5EuktFEJfmhTd5u/mtIVQWkHSgIB2uy5m9cIhcjRT51Ei08xV1ajViftN53srgwkQ5So793ID6vjon1odrCtYUjPSLSvhv4w02solF0NvOLtPoNpIVUs+ad9SYPh3FXcsJ7kLr52EWxuZBmXrnQ1yJ8x8JTmRr/eRPOT4Nzs1V8UtPJitkcEldJ7+bKLViZl0hSbtKeDTZlXdohYBtsyFP8X0lUbBESU+ZxmRlMkVvIwc+iyIlIbvtGUmbJXJQhcpo=;5:i16rIKBbZvbbBknK5n/ZqabhpFOcFCNdDl0E1hWs7ON7MU+t7P99/R8ijnWZH/AtFW65EgDMOZ5Jfkg8livSSSvt7zniLnTXBJ9/QdBGl+8wpoV2hYvWuXojOP6jD+xlYagALCXf2l0+RWRWPcGTfA==;24:stw9amxD0HhgMIuoXn07MKpZEOZQE8sncqmgzv/M4jxy2NPFjqj+VX93hsTss8W+ywTa1hqD3La20soqdLpzCOHDLltUfMZ4Q5MEbsifR/w= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;CY4PR12MB1142;7:iDLNe9e4KVSd/Ld3ku2P7m+vMVfl+nZPTjwEy43pKcJSVn75jb5UXpeTLMHi2FsPJkFrzeaLTJ6GDDnEsprbSmzieg485Xjo5H42hYoUEMAHuM5xQMClMLOpXpvh9BTFIn4diLswryacbVEcRyEqz0tPDgnOOw7oMVaNXFjOfgiB5JvGasLaHfIB97ctfPmqyGByoD2tDubSr58xWsKVZgCqlLeNiMZQjmVAGB+hEzUpxhCds6EFH0hRioB/xE+WdHwYkuUDnAGD5/hRPWVPCwMM4mfkBE5lg+jSE6q0QAQva440YzngEJImAo7Vn208iAl6YzXFPaJ212dbNKle0g==;20:A0S5us6dowq+RjRiS/Pn2PHHWNyRF8SULXwvjZyTL31mxNFpZIf9luNfjE2tTzHLGHZPmGs0n0SNb8z7MiiQkx4tzJiB0kuCpe2TBeF7aQK2Jzg1oTfMATisPchN8MmCFzyfEA55M6hQEqfl1vkaN27PLeZVP0zsuzAXcYF0qZ81UzWVJZ2WjUVnHhLfoq8SIhlcreCx4gR+w7Bj5PKyown3T9k31YIbFPIDeXrIyi1JTD/ldCYc0qOtcOyBEa9o X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Feb 2017 23:28:54.0105 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR12MB1142 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 2/27/2017 12:17 PM, Borislav Petkov wrote: > On Thu, Feb 16, 2017 at 09:46:47AM -0600, Tom Lendacky wrote: >> Add support to check if memory encryption is active in the kernel and that >> it has been enabled on the AP. If memory encryption is active in the kernel >> but has not been enabled on the AP, then set the SYS_CFG MSR bit to enable >> memory encryption on that AP and allow the AP to continue start up. >> >> Signed-off-by: Tom Lendacky >> --- >> arch/x86/include/asm/realmode.h | 12 ++++++++++++ >> arch/x86/realmode/init.c | 4 ++++ >> arch/x86/realmode/rm/trampoline_64.S | 17 +++++++++++++++++ >> 3 files changed, 33 insertions(+) >> >> diff --git a/arch/x86/include/asm/realmode.h b/arch/x86/include/asm/realmode.h >> index 230e190..4f7ef53 100644 >> --- a/arch/x86/include/asm/realmode.h >> +++ b/arch/x86/include/asm/realmode.h >> @@ -1,6 +1,15 @@ >> #ifndef _ARCH_X86_REALMODE_H >> #define _ARCH_X86_REALMODE_H >> >> +/* >> + * Flag bit definitions for use with the flags field of the trampoline header >> + * int the CONFIG_X86_64 variant. > > s/int/in/ Fixed. > >> + */ >> +#define TH_FLAGS_SME_ACTIVE_BIT 0 >> +#define TH_FLAGS_SME_ACTIVE BIT(TH_FLAGS_SME_ACTIVE_BIT) >> + >> +#ifndef __ASSEMBLY__ >> + >> #include >> #include >> >> @@ -38,6 +47,7 @@ struct trampoline_header { >> u64 start; >> u64 efer; >> u32 cr4; >> + u32 flags; >> #endif >> }; >> >> @@ -69,4 +79,6 @@ static inline size_t real_mode_size_needed(void) >> void set_real_mode_mem(phys_addr_t mem, size_t size); >> void reserve_real_mode(void); >> >> +#endif /* __ASSEMBLY__ */ >> + >> #endif /* _ARCH_X86_REALMODE_H */ >> diff --git a/arch/x86/realmode/init.c b/arch/x86/realmode/init.c >> index 21d7506..5010089 100644 >> --- a/arch/x86/realmode/init.c >> +++ b/arch/x86/realmode/init.c >> @@ -102,6 +102,10 @@ static void __init setup_real_mode(void) >> trampoline_cr4_features = &trampoline_header->cr4; >> *trampoline_cr4_features = mmu_cr4_features; >> >> + trampoline_header->flags = 0; >> + if (sme_active()) >> + trampoline_header->flags |= TH_FLAGS_SME_ACTIVE; >> + >> trampoline_pgd = (u64 *) __va(real_mode_header->trampoline_pgd); >> trampoline_pgd[0] = trampoline_pgd_entry.pgd; >> trampoline_pgd[511] = init_level4_pgt[511].pgd; >> diff --git a/arch/x86/realmode/rm/trampoline_64.S b/arch/x86/realmode/rm/trampoline_64.S >> index dac7b20..a88c3d1 100644 >> --- a/arch/x86/realmode/rm/trampoline_64.S >> +++ b/arch/x86/realmode/rm/trampoline_64.S >> @@ -30,6 +30,7 @@ >> #include >> #include >> #include >> +#include >> #include "realmode.h" >> >> .text >> @@ -92,6 +93,21 @@ ENTRY(startup_32) >> movl %edx, %fs >> movl %edx, %gs >> >> + /* Check for memory encryption support */ > > Let's add some blurb here about this being a safety net in case BIOS > f*cks up. Which wouldn't be that far-fetched... :-) That's a good idea, I'll expand on that. I probably won't be that direct in my comment though :) Thanks, Tom > >> + bt $TH_FLAGS_SME_ACTIVE_BIT, pa_tr_flags >> + jnc .Ldone >> + movl $MSR_K8_SYSCFG, %ecx >> + rdmsr >> + bts $MSR_K8_SYSCFG_MEM_ENCRYPT_BIT, %eax >> + jc .Ldone >