From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754843AbdFWRpQ (ORCPT ); Fri, 23 Jun 2017 13:45:16 -0400 Received: from mail-sn1nam01on0068.outbound.protection.outlook.com ([104.47.32.68]:34505 "EHLO NAM01-SN1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1754601AbdFWRo5 (ORCPT ); Fri, 23 Jun 2017 13:44:57 -0400 Authentication-Results: redhat.com; dkim=none (message not signed) header.d=none;redhat.com; dmarc=none action=none header.from=amd.com; Subject: Re: [PATCH v7 34/36] x86/mm: Add support to encrypt the kernel in-place To: Borislav Petkov Cc: linux-arch@vger.kernel.org, linux-efi@vger.kernel.org, kvm@vger.kernel.org, linux-doc@vger.kernel.org, x86@kernel.org, kexec@lists.infradead.org, linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com, xen-devel@lists.xen.org, linux-mm@kvack.org, iommu@lists.linux-foundation.org, Brijesh Singh , Toshimitsu Kani , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , Matt Fleming , Alexander Potapenko , "H. Peter Anvin" , Larry Woodman , Jonathan Corbet , Joerg Roedel , "Michael S. Tsirkin" , Ingo Molnar , Andrey Ryabinin , Dave Young , Rik van Riel , Arnd Bergmann , Konrad Rzeszutek Wilk , Andy Lutomirski , Boris Ostrovsky , Dmitry Vyukov , Juergen Gross , Thomas Gleixner , Paolo Bonzini References: <20170616184947.18967.84890.stgit@tlendack-t1.amdoffice.net> <20170616185619.18967.38945.stgit@tlendack-t1.amdoffice.net> <20170623100013.upd4or6esjvulmvg@pd.tnic> From: Tom Lendacky Message-ID: Date: Fri, 23 Jun 2017 12:44:46 -0500 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.2.0 MIME-Version: 1.0 In-Reply-To: <20170623100013.upd4or6esjvulmvg@pd.tnic> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-Originating-IP: [165.204.78.1] X-ClientProxiedBy: BN6PR11CA0015.namprd11.prod.outlook.com (10.172.17.25) To CY4PR12MB1141.namprd12.prod.outlook.com (10.168.163.149) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 79036cb5-babe-49f1-aa3f-08d4ba5f8ed2 X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(48565401081)(201703131423075)(201703031133081);SRVR:CY4PR12MB1141; X-Microsoft-Exchange-Diagnostics: 1;CY4PR12MB1141;3:RyKdIgOIAnQQoqwZilLxZi2J4TtVpzPixdZba9W/JJg5MuH+GVCOhkbATYRHuOMHvWaEUnd+czvEk+Vplqlrv6g83nJU7R/LNkwqUw6bwGQ8AP/hS0806VFV5VDcZpED0NRqi0D4jppOpxZEavYyG50KsJFt6KtVrwggduhdbAQpdCH9nz87Ba6xupuNbcLojzn2DuxzHrSof9qNiHXdmkSp29cL5EOnkHYkGLmRcJIGbQMUKUqCPoMwcbJAIUi1XhyQzCp0mY1hcvhUPg+eO/glKngJpDvcUV3O5zFTx+6QuWVuNnfrGsTQwTZh7ZMOGu7E/MYycPgA6tPP5rMc40pBNeA56cQjc4H19kkaLSc= X-MS-TrafficTypeDiagnostic: CY4PR12MB1141: X-Microsoft-Exchange-Diagnostics: 1;CY4PR12MB1141;25:/C7kaP+on/V6qdaPg4svUOKIsPsP9tnF73/vwy/Ii5eYm8h0qOWe9hgMX+EvJKeLj3Bp4W359nQ+eIjQDTq1iocwYcCNPBn0nNKV2bqIY7mSfb1w6l1VYvNEjLwj5oIs1DwWFhOLyW3oOYcmBbZpNXRexrw4BmtyctrYOZYfpVPsGBYJLaQgk4j2EeajimdrLsxFGZJFo0j7mjaadnEkba5nyAfsWZ8UTadj7onT5CfYb0KL2LsUo2cu0qzVAaxm/1iKkQBJUHs6884agmXILTk+tsqscrJuxFk522YIdtfrB4OWHP+ufmMJZG3e2ywyiycNQYe9GxcyspN6D0dFF1WyZsQ+20P1QT8EcwzXAAGaqshrOA+VHMufz5ActgYdnJHGhctI/MU5j0Ry3iYLH1LPUF6P+0Yro0ZzvJqDDBHIdCE7ZMes0/pzrpcb0awzePqNLOPHfQz3scMA9IW66/v8/5tgSl4HT+w28ckpCWPgMKyW3DlzvcFV6fnjTwsYtBw7PL9xlWh4X1sdbsoCkVYVcdlDAUS9sMtHw65ADG7iAURsTokXCt6SP9253FKkVMFgbH3mWRPxG80nB2CHmehDLRWilRb4EwR5gY0XZL22TfTgbiOLhy/wBClH1mKHYwOutH/2sbyQjVnFzUqWJmmVEjIXpza+XvxXGB0JtSYEnga+ODZfPnNufanyXMsGMSNlcGoUDh2n9Mi6sP7iNwrMWinsqsilzEQShSjr4maxchDD8aBY0Ze2XDDfaCdVP+8K06401NPSyXncwqpODFSwiRAY0mZRr2Qy7qx8rBTokyBmjMCc4FTl+GFvZes/vXS1B2hnJzd+++z6ZbVnJFz8P4lJ1iLm/TfxyvDVtQhpCv8JuGqJGkil9+Z/luWgw553cGDqI5+UqyBTHFiq6daXSbl12ff2k3HSh/x+QmI= X-Microsoft-Exchange-Diagnostics: 1;CY4PR12MB1141;31:pavTq95eSfyxiChJiKdtQsqQdT0qEpqFt4WGGwJfPEFQoJ37tN8WBnJp/C4NGTdSsJZvF/3ZAiUilnWqn4ZPa7SPlvuvLLSFWRqYwsADOZQkTPssacyV1nfEZJWc63F2LvcxzPRuloGNCUTefo3PA182BR1CXq2XJw0hS0TUOXZNmSxbi9R9jx3+fq5Tu6O+fXZnj4385OhFf34unj2GjpkUMNGtIgzXPZuHomaKI5CE6vVC/79uRZg0D4GbbzI5s+HHKbbT5dXWwH7Ue0H1LnrzjOUF9oOIgJqWaPLUnKrmtDI9QM4lp9NlWgb49OtbNnUqWvICljT8/PQJObp2eInfXg1F8jKJ+1WubmOsAouZSKIWpQHhkNGO8LBpCBZrauq5NXOSWQ9ttlxghaCFA4sbtty0U8obMAa/FsBCyFHb7s+APggvtp/6/tS9X4bRgBBq0pt9mXeiZPIcp/eoQFEzexfDnj2DnkN0omt3/t1CJxuPFrRDKL1ZgmEW2C/O5o0rySuVbRTn8UwR/pwHMAwLgkjca+m3VOEEY4sTaILSFgCdmXPiIhyEYJj8C9OIrme3yQVUD0iWBHMdUNtdOXWxlDNUip9AkuTmeSOniAftLaKNHYNhUsUeomT1DMKtG7SiZrYZOUVAp5yw2OCYabduUznUAQV0PzbOiC5kMc4= X-Microsoft-Exchange-Diagnostics: 1;CY4PR12MB1141;20:m+Bbrc2O5gmEHa4T93fztUbSCikLlVXXyxKNjKdxJDU/+S3I4fY0o2KPmNs48HtKJ6MOaKks5HsB1+BWycO1VJcFv1CtJ7+Xt4rdNhXwXja+eY8AhJwgwEDfb98/FR13i4WtyAmDPnjYrXniDN6TP+lnplZDB1mSJrAomeAzE6HTRW7DGOAAXxaRTICrAu9ecsF1YSZcGPlEfGsReuqvDtU/qt0gp+CNhGWekyVxh3Kza2sjxFgYR8l4EAx+STw1/mV0l49BbyTp02MMNR0R9Yq6vZ0L8lPZHhDR7LOOQq+ohKPVRZLfb44BYNNJ+OAGRVT4edCZ+CFTZnYOA9dDMmF9QHxDlWB9GkoqacmaW20Ihq9YzTam6dy7dZXz08W/awaxq4RZMlQsQ5F+X3Y+ldmuGOYaUDlD8iAXntdCuE0j2zHgNVh2o//idBgWN4KDG2VoFHiAMN3AZCZGS/2VeGnbUqS9rmnOySyets/R3Ie48yNH5UTj2qguESRGREVT X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(767451399110); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(601004)(2401047)(8121501046)(5005006)(100000703101)(100105400095)(10201501046)(3002001)(93006095)(93001095)(6055026)(6041248)(20161123562025)(20161123555025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123560025)(20161123558100)(20161123564025)(6072148)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:CY4PR12MB1141;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:CY4PR12MB1141; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtDWTRQUjEyTUIxMTQxOzQ6Q2hqenJZWTdrOG1TS0xpRFpucVVtaDBrN1E3?= =?utf-8?B?bUt0Q2hHUTdpVE1KWHNOV2liUURPWnV0NXJpRTVMdlQ5TVluNU92UUVBSVdW?= =?utf-8?B?RHI5K0x4b0tlK0dBNHZtUmFmQkkvN09EZmJXUG5pNEpNbmJRQnczZWpUOEI4?= =?utf-8?B?bXg4RnFhK0dNdVNFLzJKWDJ4dTV4cFJoSVFTVzRBMjVoU2szT3ZTWldoWmRt?= =?utf-8?B?cHZ2clI3VWF0THNJOWxyN1B4emxIdnMyOUgvMDhYVUU1UUNjV2ZjaTIvNTlx?= =?utf-8?B?SndtTU5KUkdNSzNoL0tlODVpOVNmWEJTTmU4U0FlMXZYRFBtNG1xMnVJZ1hj?= =?utf-8?B?Qis5WDFNZEdHTzR0a0VTWWdoRlgrYUoydjA4KzhzUXQ2bnJFaU05c0E3VFB0?= =?utf-8?B?NUtWNnZ6bUhzbFl6aFN5L0JBQ0lMR3lBbXF2ZWJNYU15MVgxcWVxUG5Kc05t?= =?utf-8?B?VWV1RjNYbG9XeFRsTWVNSUdBN1NLZmI4NEg0VTZDbGNneVNIcFJTb0djR3Q0?= =?utf-8?B?ZjFKdGlRN01uSi9jRVF5YS9oZGlaNTh3SkJBNWp5aWRmeUtFVjloem1uYWV1?= =?utf-8?B?SC95U2JxRW9sVHloVnd2U2ZHdkpmcytjQjFTWE5tTFh4eE8veGRlbWZWRnBN?= =?utf-8?B?MWRWY1JzRjNLYlVKeXRvUy9ZYU0za21TVDVZZVJUQWNxQTdoWmUvUEFaOUUz?= =?utf-8?B?NmRjWFZQYUZmenFrdHBIdmVZcTdDRWFlbm1Cdm03VzBPMjM2eXAyU0Npc3ZG?= =?utf-8?B?elY1dTBFYWJlTGlHNVBpT0lpUmRzZGpibjhyUngrN3hCVWFFdWU3aHM5Q0sv?= =?utf-8?B?czZWcTJSR0x4NEhVMERJeEJqalRWb05ZTEpzUFlZMnR0K21ZVmRQaUR1OUFI?= =?utf-8?B?VFQ1emJ6UURWazg1NUpDVHEzRy9hS1BHUmpwdjFLclJEWDAxaTBXN0tnZXo4?= =?utf-8?B?OVlBZDgyUnQ0c0NEZlVGT2hBaC9BSVE4WHhubmhUNXVrZHFMLzN1Sk5PSmhq?= =?utf-8?B?VG83RDhiaEIxUWJVRnpvNkdldmNoV0l6UzdEK1pqM3Z3YlJOTnpwTkFzVi84?= =?utf-8?B?UjAxMGordmVZcy9EWG1pQ2t3U2FQNENUWXgwdXk1SThVait1WVRSc25DSEhu?= =?utf-8?B?aDZZZWZrNENlcjVydnAwVndHcEQ4TmdxR0dWVXd3L2JJdkdxN256ZmsvVjZl?= =?utf-8?B?YVlZeFNpSi92QkM1VUUwTGNyQkF5NmFob3p4R0JlYkdaRDE2MmFjYmVhUzJo?= =?utf-8?B?ZEpva1JmUmlVYk8rdS93MUV4aEZkTGpFUzl0Q3JHTHpCbnh5V3ZaUGl2LzR0?= =?utf-8?B?M0l2MGpSS3R2M0tMMUQydDQ2TURYS2kxeWhqdmRPN2ltSTlNNlllVnQrY2hS?= =?utf-8?B?ay9uNmdtbXUyTDdhYmlNNE5hMHR0TnFpaXJET1RFLzgyd2U4S0NhZTNxMTJV?= =?utf-8?B?eGlBZzY3UEs2YzhLRyt0MEdoMHJ2bzI0cWdNaEJXUmpoS1dGTVc0Q3ZqYVpu?= =?utf-8?B?bWZkSG54N0UvNzBIRUFhK0Z5UXhpeFZyR2ZsRzFkOFdOVkJFRjBHTHZSTzRJ?= =?utf-8?B?OXdUZXlJd3E4VG43dENYNEZ6aUxFOHNOZVNTQkQ4THpmeHlCcTVEZm9sL1dP?= =?utf-8?Q?Aga4qGQn4n5Y75wB40d?= X-Forefront-PRVS: 0347410860 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(4630300001)(6049001)(6009001)(39410400002)(39450400003)(39400400002)(39850400002)(39840400002)(24454002)(377454003)(230700001)(6666003)(76176999)(5660300001)(7416002)(47776003)(65806001)(54356999)(64126003)(23676002)(189998001)(6916009)(66066001)(50986999)(7406005)(2950100002)(2906002)(65826007)(86362001)(31696002)(33646002)(4326008)(8676002)(53546010)(53936002)(81166006)(38730400002)(31686004)(42186005)(110136004)(6246003)(305945005)(6486002)(25786009)(3260700006)(36756003)(72206003)(229853002)(6116002)(90366009)(50466002)(478600001)(54906002)(3846002)(77096006);DIR:OUT;SFP:1101;SCL:1;SRVR:CY4PR12MB1141;H:[10.236.64.250];FPR:;SPF:None;MLV:sfv;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtDWTRQUjEyTUIxMTQxOzIzOkYxeTJTb1F3ei9OM2xaMUViOG9mdG03Ykp5?= =?utf-8?B?ejV4dFQzYTNtU3pxTG93ZU5nWEhyb1NyRExwaXZTOUZxM1hNa1FzbjYxb2Rp?= =?utf-8?B?UVlPdWNCcGlqek10aThHTXQwUTVDSUZvTDBtMmk5WkZsTTBIQzBzQ2t4ZGp1?= =?utf-8?B?amNrNTdMY1RSeUdJdkllTW1mcWdHeWcyeFlGQzRuNWZxVUxqV0djS1VDeGJy?= =?utf-8?B?ZEhFeE5WU1JaSmVzRnRMYW5uNE5COEswcFNCcnNMcFRFUnFmNTJyRU02Slhk?= =?utf-8?B?Sk8zamhUTXdCdTZybTgvZDJVb25wOFMrb2c0TzgybHNvdXc3Y0VUeitMOWp5?= =?utf-8?B?NTdVSldzTVVDcUJQemdVUUZtRDFGRnNIMURZeFVodWFMbTFaZDRPS2U0SHhT?= =?utf-8?B?UUtHUWFUWlFQdnJUM3RBVE4xNUpsU2Q5Tnc1NWNNNzNTOXlla3JKYXByZk40?= =?utf-8?B?dno4YVY0T2ZXVjRkZlhHSXJuQkR0ejR3bHJ1V0wzbWpxVUdoOE1LN3hiQ0hV?= =?utf-8?B?bFNVS2d0TDdSVGFoRHAxKzY5ZElhbll5b29mQkpKNkNLZEhQM3NZVG5XNEJh?= =?utf-8?B?RFREdFkwSGFCcEVFV1RUZ3RwSWF5blNZV1NvaWtXaWJxV3FWV3M4M09mNXZ5?= =?utf-8?B?S1ZkdlJYVG1IZmkrOTF1REZQdFdjY1A5Q2ZTcGlvWjJIQnpkOFRVRmlhODcr?= =?utf-8?B?czJIc3NIaFZQMEVON0Y3NW1yZ24rMGQwYjlsNFNtY2pkUi9DblpPeE1jd2xm?= =?utf-8?B?TmQwb1FvSXYyb1hhYUhxaUY0OGthY3BYazFIUjgzU2pKNSs3VENSNHptRG9P?= =?utf-8?B?U0l5aXl4MFhLaG9pb2tCVzJ2N1ByTTZaQWR0WWI2WWpEUDU1OEgxTE5JR3NG?= =?utf-8?B?dmhlSm5iL0FUWkNCNjRmQzJnL2crSFNwVXM3RDFzeFZLRjlZaldyeWRESHc5?= =?utf-8?B?YW1WdjdrYWZrLzhjU1BrWTVtUFIva1kva2YxNktyNWhGbnNLZGRmSmFJL1pp?= =?utf-8?B?YmhNMkZrTEM0bms2bEhRWjNuMVF3OEFEZGN4dGFaV1JqeTIwdGpJRVV4YWwz?= =?utf-8?B?b3RoR1VlQmkwQjlraFdYZXZMWm1COE5xUWxTR3U4TlR4ZDZ2a1EzeFhXRi9o?= =?utf-8?B?SklnRVBMSnZqaFREbUN0a2MzZlB6ajhrbmcrVkR4eThQVUw5V3NqVkQwaFN0?= =?utf-8?B?YWZBUkR5ZTJuQjBsZ2IvZ0tBYVUwYVVGY2kzY3BCdzIvbFVNNEQwSFlvU2pR?= =?utf-8?B?NGtYWGZwWUFwc2UvT2c2QktRcWxaM3g4dDV4K0VpQkN2bHB5N1M3a3NaeGEx?= =?utf-8?B?UGtzd3dXdUgyYnVoVWtVTXFTdDAxcUQ1dWZRVHFxUEt0QTlyWldMdndwZDVU?= =?utf-8?B?YWxGVkloYzhncU5SdDZSRHNNejlMditnbXh0SmpCK0FFZUJBMWRKU2ljYitK?= =?utf-8?B?UmovMmk2aFNDOUdvKzY5ZHZaeXk1QUpKOUNmLzFpbTlnSzM2cXlwb2hFVnpK?= =?utf-8?B?ajdIaEtuTEZyNnU1d2xhS1pJTHVaQm13a1ZlVWlOU1BCQ1VEUUlBVEQ1RUxT?= =?utf-8?B?TTVKQkhUTHNFN0xBSmg2T2FXajNmZmJ3YlJvZmhQWEs3bjF6bUhJdzBWMkdM?= =?utf-8?B?cm1tS1Z6S2JGRVF5M1M2a1QxNUppT3NMamdSQzg0WGFwalk2eWFuRmFXN3d2?= =?utf-8?B?Y0pZaTBMM0huaDNSdGJLS0FmMUlVYlJRL1hDdnRlYllzRU8yeWpUdTdMYi9L?= =?utf-8?B?ZjJRaUdnd2xnaXRxeENBeHRYMXB5N0VpVWV5WWdzVFpkcGNGTWpTY1g0YklR?= =?utf-8?Q?TmKLyjK/2IBp9?= X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtDWTRQUjEyTUIxMTQxOzY6eUxSMTdUVU82dE84SnZtZng1OTVXdkNCd3Bi?= =?utf-8?B?dXJpUkk4SzJtNlI4UGQxTVFZbHhBWlRTbE02UGdRR0lpYldwNnJhQk02U2xT?= =?utf-8?B?TlFOTklvUXJGOEtuYjRWZFl2VEZsOUhUODJjWm8ybDAyWTc5RHZOYmJnWDVw?= =?utf-8?B?L0U2MWYzNEpyRXZiUzFiQmUzL3NyaXFMQkREMUhYMnBxSzNkVnE4U2ZWazA3?= =?utf-8?B?eE44MzFtNFZhd3UzY01na0k1VjFnc1g5ZW8zU1Y3SFQ1dXVHNUUraHQvenlO?= =?utf-8?B?Z0NiSTlrenVEMDRhbmZXVVJUL1FmR0JqR1pjT2wyQWhXdlR4YnJoc1lkbkVq?= =?utf-8?B?cE8zZkdzeXF0dmh5bG80ZUsrNWwzSlN4S3BIN2RCTE9XYU1uWWVUbDRSTysw?= =?utf-8?B?cTlpQy93bjcvYVVmSVpGanpQRllQdEJjd2RiTE1DY3gwUm9jQjQ3ZjRtd0pT?= =?utf-8?B?aHJHY25MMFBrZVEzMUhVQVU3c1hhTHJQRE93dEtRcmo2WDR3UTRXQWdmbXNo?= =?utf-8?B?SEcrVmlTcDk2K2k1dnJVVTM4TlE0WTZHQ1o5Z3lXd2hoemRselBJcjEwb2RQ?= =?utf-8?B?YmozMTZYYWNlQnFZQlB4bWxGWXdoWE5hV1RCV01HbUcwVlB5aGNvV1F6OWk1?= =?utf-8?B?UDVleDkyZjJmVlUrR1AxbiswSzRUYUZveFBNNkY4QndTRG8zOHZmY25IbVU0?= =?utf-8?B?dGFZYkF2ODRZRVZlbG1DdVl0NXZEcUU0NmdZVUxuMFV2MDVNOElqa3Z3Ujla?= =?utf-8?B?b3VnQlJhVjI2MTcvRnNQYTZMS3FDZWYvdE85Q2tteGVRci96cnJscnpUMno4?= =?utf-8?B?Njg3U0J1Y3VFNlFPajhOSWpPN1FsamxySWNGNCswVkJhOUNMQzlIaFhiUStj?= =?utf-8?B?Y21QRnlqODlwN2k4bG1oeUV1VXd1U3JCTDJSZTA4TUo1RW0vOHdNdForb2Ew?= =?utf-8?B?ZHR5NnJUQ2xIMXVReGF5NmNZMzB4cE9vYkE2VmdLcUQrelZVZUFGTmxybEZC?= =?utf-8?B?YXM2OStkbTdPaXN1b3BxUXFFSFhGbjhORFhxRlZIY0tjYXFiWlhKRGhXbXUv?= =?utf-8?B?TzNXNTBaQ2g3MW9wM2Z6Q05lWkNDSjVUSllGTklJK0NZSW5scFlvM1haenMw?= =?utf-8?B?YjlLdk9IM05BWTB5NkZMVWpkelRTZDVuM2NTNWthc1RKMnJGNDJnSFRNOUwx?= =?utf-8?B?ckk4M3YxNS93S04vNVhnKzFLdXVwOGc5aXNQVXdhM1RQcWNGbFprTld1VzI1?= =?utf-8?B?Z1VHMWlPbzM0S29NM1c3bXFBektWWkFVSC83OUNXTlJMTzBlOEpEd3dkZEJn?= =?utf-8?B?UVRScVdyeVBaZVNyTEJvbXRNbTVqb3duUHlnMVlzaTltUUJxa2RSaTc2ZXJi?= =?utf-8?Q?qKBPZSh?= X-Microsoft-Exchange-Diagnostics: 1;CY4PR12MB1141;5:OAVi2gtGJjDGIl9+dDBBMvwIWm0nUgRqRzDaw3dpxvBMnmJEPBVAE9gT1R3T5MO8Kklazhj87NWFobUmcrBRcmLQiFar8Tx81wcdSJLr1icZnS/+Rbqm7YmZSTWOIPopGHusxbdJf71IpEP0sPrfldtT30ABWlZpyIVF+VHIV5IqxTS9BNOt10shTIB/zPCvJNHlNR+q3Jz++3LLBNgN/1qxqT0zbmcZm1xGF/BZGxHHsz/17YDB5DWoJfkrbMxSDkOvEivq4qkxIQJYKjhv3h/L12uQZW9XHxSU0Q08vge46KuqkYWwfQ+9TLCjLrOtDDjPDRTfcbLp/kwZOdn4xlYTiT5DIvEUSkStSa8iqK/mMht05SfBOm/fwtkOkb5iaLjgJTr4Usxp1UADTYuimfXhki/gCTA1StUKzfRGx6JKEfrszMr1fqjzm3Z2stmktddvDCNKgbdC0WEkTi4b7NjRzBG5Mm8m3OSXSwpRnTbhURG41XfcoOQ4g+o2nHia;24:7lOjviR2lY8p9IYWJsfyMPE/qtgcGnmb1ODUW2Lt/Mc14rWyT24ahQl6/B7kiIVXssJ3rWhHlOA5j+aofFcZ6RfkNHcuC7fhIJ97p+xSLr0= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;CY4PR12MB1141;7:TEUn4ONTU7WpzSuKJScM4hnpEdiOk0EqsLOjZkt6GzVktBekJunEcanHI7eUTmV8muqe86Vp6gch665iPJJKoeNfWe1vZyndyDiSVdX9xQ3oTSysaRvtfg+sUiYOfl4C9S/ttoIxMfnoMOJNy83i4hNlt592YBK4uZsF/T5ZPmGbhfKNdXTJRwAbZx+sD6JEGWOUKBkl8WEqVvC59FygfAtWvgFws24oVVr7I7IbSRwhd+0PqRupWgHZz0iE1wxP6dWt3L6wqafGj8IbpDE2+HCt7xd6kIqSSkDe8e4h16BOaZImuuMDkmBEPt/UcMISXDyUapu3KNDGuMCis3jMjMfN37sjcAl0H7C6xKihgEeddZnZf18MPp9MQGIoUDjfHsVjZy0wmga3bSuPodcZ++XbctdxvRatUSLdVWrPiZWWtum1f7PUhbtuCk1P3MOjj0rkH1LybkxmHobDCjqQ8f/K4ixWm3GoLc3IHs6IyO8S+iOHy1yxemIMiwN7XT7aJ97AMu8RSGhdN/R3uR/cIdm7ZOxteT9AgRP6Ru61zdZ1qlGFookK9hjN4hUNu0ZSm3FkWSTvf48RiaLxRdy+zbE9ktrtsjjlfcWIKyJzuwWQW9kzZPBbIE3AAi7b1ga+DzvA0QY2diRsuErLy3q2Q7eE4jMhbe4EEg/z2xOjm0w8EvYJkNnuj6/10LEW7Q3s3QIaunZbBvkfMAJyy1kDooWOlbXm3Xx+gV/e414QPxFBvjqN6yV6X5SaK2gMzpmZtuoPqV4gUMFnW7gl6XMpo/uiP95FCr3qP1Y7p7R7LpQ= X-Microsoft-Exchange-Diagnostics: 1;CY4PR12MB1141;20:2DIVoViecqOyaOYshmfkyNybIGilUpTmR737pO5vH1YRpoZqQJfkD2QzYFL749TYYnd0s3PJlF1i4MsMKEiu8Y34GfX5oklInlAGL4I9MawDvoYOO2L8m+F69P3gsp/H/puRm6rdqa69vYs3pwbcb+dUwg1XQdvJXTZi619qreEyfkAeyaaRfoPrdj5u/ljuZfr8PSdrHSICu452oVzO9xcNhYWXzZipvodjzf6E+bCXKEPfVI/4nTiVoT06v7dk X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 Jun 2017 17:44:50.8730 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR12MB1141 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 6/23/2017 5:00 AM, Borislav Petkov wrote: > On Fri, Jun 16, 2017 at 01:56:19PM -0500, Tom Lendacky wrote: >> Add the support to encrypt the kernel in-place. This is done by creating >> new page mappings for the kernel - a decrypted write-protected mapping >> and an encrypted mapping. The kernel is encrypted by copying it through >> a temporary buffer. >> >> Signed-off-by: Tom Lendacky >> --- >> arch/x86/include/asm/mem_encrypt.h | 6 + >> arch/x86/mm/Makefile | 2 >> arch/x86/mm/mem_encrypt.c | 314 ++++++++++++++++++++++++++++++++++++ >> arch/x86/mm/mem_encrypt_boot.S | 150 +++++++++++++++++ >> 4 files changed, 472 insertions(+) >> create mode 100644 arch/x86/mm/mem_encrypt_boot.S >> >> diff --git a/arch/x86/include/asm/mem_encrypt.h b/arch/x86/include/asm/mem_encrypt.h >> index af835cf..7da6de3 100644 >> --- a/arch/x86/include/asm/mem_encrypt.h >> +++ b/arch/x86/include/asm/mem_encrypt.h >> @@ -21,6 +21,12 @@ >> >> extern unsigned long sme_me_mask; >> >> +void sme_encrypt_execute(unsigned long encrypted_kernel_vaddr, >> + unsigned long decrypted_kernel_vaddr, >> + unsigned long kernel_len, >> + unsigned long encryption_wa, >> + unsigned long encryption_pgd); >> + >> void __init sme_early_encrypt(resource_size_t paddr, >> unsigned long size); >> void __init sme_early_decrypt(resource_size_t paddr, >> diff --git a/arch/x86/mm/Makefile b/arch/x86/mm/Makefile >> index 9e13841..0633142 100644 >> --- a/arch/x86/mm/Makefile >> +++ b/arch/x86/mm/Makefile >> @@ -38,3 +38,5 @@ obj-$(CONFIG_NUMA_EMU) += numa_emulation.o >> obj-$(CONFIG_X86_INTEL_MPX) += mpx.o >> obj-$(CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS) += pkeys.o >> obj-$(CONFIG_RANDOMIZE_MEMORY) += kaslr.o >> + >> +obj-$(CONFIG_AMD_MEM_ENCRYPT) += mem_encrypt_boot.o >> diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c >> index 842c8a6..6e87662 100644 >> --- a/arch/x86/mm/mem_encrypt.c >> +++ b/arch/x86/mm/mem_encrypt.c >> @@ -24,6 +24,8 @@ >> #include >> #include >> #include >> +#include >> +#include >> >> /* >> * Since SME related variables are set early in the boot process they must >> @@ -209,8 +211,320 @@ void swiotlb_set_mem_attributes(void *vaddr, unsigned long size) >> set_memory_decrypted((unsigned long)vaddr, size >> PAGE_SHIFT); >> } >> >> +static void __init sme_clear_pgd(pgd_t *pgd_base, unsigned long start, >> + unsigned long end) >> +{ >> + unsigned long pgd_start, pgd_end, pgd_size; >> + pgd_t *pgd_p; >> + >> + pgd_start = start & PGDIR_MASK; >> + pgd_end = end & PGDIR_MASK; >> + >> + pgd_size = (((pgd_end - pgd_start) / PGDIR_SIZE) + 1); >> + pgd_size *= sizeof(pgd_t); >> + >> + pgd_p = pgd_base + pgd_index(start); >> + >> + memset(pgd_p, 0, pgd_size); >> +} >> + >> +#ifndef CONFIG_X86_5LEVEL >> +#define native_make_p4d(_x) (p4d_t) { .pgd = native_make_pgd(_x) } >> +#endif > > Huh, why isn't this in arch/x86/include/asm/pgtable_types.h in the #else > branch of #if CONFIG_PGTABLE_LEVELS > 4 ? Normally the __p4d() macro would be used and that would be ok whether CONFIG_X86_5LEVEL is defined or not. But since __p4d() is part of the paravirt ops path I have to use native_make_p4d(). I'd be the only user of the function and thought it would be best to localize it this way. > > Also > > ERROR: Macros with complex values should be enclosed in parentheses > #105: FILE: arch/x86/mm/mem_encrypt.c:232: > +#define native_make_p4d(_x) (p4d_t) { .pgd = native_make_pgd(_x) } > > so why isn't it a function? I can define it as an inline function. > >> + >> +#define PGD_FLAGS _KERNPG_TABLE_NOENC >> +#define P4D_FLAGS _KERNPG_TABLE_NOENC >> +#define PUD_FLAGS _KERNPG_TABLE_NOENC >> +#define PMD_FLAGS (__PAGE_KERNEL_LARGE_EXEC & ~_PAGE_GLOBAL) >> + >> +static void __init *sme_populate_pgd(pgd_t *pgd_base, void *pgtable_area, >> + unsigned long vaddr, pmdval_t pmd_val) >> +{ >> + pgd_t *pgd_p; >> + p4d_t *p4d_p; >> + pud_t *pud_p; >> + pmd_t *pmd_p; >> + >> + pgd_p = pgd_base + pgd_index(vaddr); >> + if (native_pgd_val(*pgd_p)) { >> + if (IS_ENABLED(CONFIG_X86_5LEVEL)) > > Err, I don't understand: so this is a Kconfig symbol and when it is > enabled at build time, you do a 5level pagetable. > > But you can't stick a 5level pagetable to a hardware which doesn't know > about it. True, 5-level will only be turned on for specific hardware which is why I originally had this as only 4-level pagetables. But in a comment from you back on the v5 version you said it needed to support 5-level. I guess we should have discussed this more, but I also thought that should our hardware ever support 5-level paging in the future then this would be good to go. > > Or do you mean that p4d layer folding at runtime to happen? (I admit, I > haven't looked at that in detail.) But then I'd hope that the generic > macros/functions would give you the ability to not care whether we have > a p4d or not and not add a whole bunch of ifdeffery to this code. The macros work great if you are not running identity mapped. You could use p*d_offset() to move easily through the tables, but those functions use __va() to generate table virtual addresses. I've seen where boot/compressed/pagetable.c #defines __va() to work with identity mapped pages but that would only work if I create a separate file just for this function. Given when this occurs it's very similar to what __startup_64() does in regards to the IS_ENABLED(CONFIG_X86_5LEVEL) checks. Thanks, Tom > > Hmmm. >