From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752397AbdCPO3O (ORCPT ); Thu, 16 Mar 2017 10:29:14 -0400 Received: from mail-bl2nam02on0063.outbound.protection.outlook.com ([104.47.38.63]:24455 "EHLO NAM02-BL2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751321AbdCPO3K (ORCPT ); Thu, 16 Mar 2017 10:29:10 -0400 Authentication-Results: davemloft.net; dkim=none (message not signed) header.d=none;davemloft.net; dmarc=none action=none header.from=amd.com; Subject: Re: [RFC PATCH v2 12/32] x86: Add early boot support when running with SEV active To: Borislav Petkov , Brijesh Singh References: <148846752022.2349.13667498174822419498.stgit@brijesh-build-machine> <148846768878.2349.15757532025749214650.stgit@brijesh-build-machine> <20170309140748.tg67yo2jmc5ahck3@pd.tnic> <5d62b16f-16ef-1bd7-1551-f0c4c43573f4@redhat.com> <20170309162942.jwtb3l33632zhbaz@pd.tnic> <1fe1e177-f588-fe5a-dc13-e9fde00e8958@amd.com> <20170316101656.dcwgtn4qdtyp5hip@pd.tnic> CC: Paolo Bonzini , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , From: Tom Lendacky Message-ID: Date: Thu, 16 Mar 2017 09:28:58 -0500 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 In-Reply-To: <20170316101656.dcwgtn4qdtyp5hip@pd.tnic> Content-Type: text/plain; charset="utf-8"; format=flowed Content-Transfer-Encoding: 7bit X-Originating-IP: [165.204.77.1] X-ClientProxiedBy: DM5PR19CA0018.namprd19.prod.outlook.com (10.175.226.156) To MWHPR12MB1152.namprd12.prod.outlook.com (10.169.204.16) X-MS-Office365-Filtering-Correlation-Id: e228821b-56a1-4226-c39a-08d46c78ccc2 X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(48565401081);SRVR:MWHPR12MB1152; X-Microsoft-Exchange-Diagnostics: 1;MWHPR12MB1152;3:kFcFtY1OoHkak8daGrIdblut5T+R/0EF8S28ucrOmmWq2izwGAeJI8E4NQIyIM/HBBNwIl8hSF3CMwnq5chkfnym/TLsWJUBDf0DaKRLFFxeI9Z8O04K/jadfY+haOxuMD2v7phjss1mIsEpgsZHtnwFG7A9iqcv7berS2dn/TzAwng4SgLGgt8/DuKiK/vZ9q2k5bWBdsF05Wm6EtJO26FV6u+VmknqiMl4WkXSCheWsrdW/2wIG0xxFU72kw4cD0gWPQNVF7IuVysTSLf/O1v6fo7l95195fEXDUakouA=;25:5465/Hz6VIZNkXCA/5/YdGyG9xr8EkBIS18bE0+Yg3t62KpCsWxXRSM7TVJiFMg3zLL1e+HIYB/D+UWfsTAHHsY9LRkX3hOh0/mf0nt8gqBn9Yh7znMjOBB94OMdcRgk0yozvpiHYUkePV6iQLpbIDHFCYmuEZ+F3TLyen017AgC+d2bb1/zHz6EzxC0PLJsXhqUCauT7r8t7Qu8YxPJTXetaHA9y0G2hAzSYjN9Vof6dIzYQQTsDJSCEV8fkoNN83kWJIVaDWGXPETQ9/n1txnKbhADHV8KrR0bOU7gskMWTvKn3GMIT31rEfEc68zo5qhpSxj4rqzb6Fhly58cYu10fpzKwU9YFQGPRXmWr89sanPgCVv81CSjL3piyofs6QRVHSjpMebq5SoUQmchaLJFCPOjIT1HppwGhFlK74BbzrYk7pPk3OSAdq2wGgupynhrbcOFe3LBC64cyd3ZGg== X-Microsoft-Exchange-Diagnostics: 1;MWHPR12MB1152;31:MOmolGS1gXjjikYVu6w424lsSv+HAnUB8mhgfH2c2r1Ha7vIfsLy1Hc012up153b8+RIOx2TCenmGmbUuXGCMdVGJEuPOBVc6sDuw/9UNvag79IHDYxiBUK+0xpSCc4jReetqZslMVhbrM8oNCzoi7qhb3G8Ib7JxLl8qCHh0HAhBHYmRHr7rZo4E/avEr02E/N/eQ7r+OSNv9npVAF3WjD9DyM8kvV74lC6kNwdtf7aNi7h9AIxNu/vHl1pSeCs;20:lHbWC901EzH3K3Uw37FhU1BjIGq0bjOkMEYHpmLG0uV1X+rgczbJg+fa67QfQ2LO5MwJHyxx74lDp0R2TuPrzAdhV2fD4uagcn3IaZw5JzmJs+iCoHHzcv4FCJqKvMm+2MivvVz/Fqba7STGZ8bHC6luJ4QCAtDww1l/bJ6V/BuUTCkuP0g8NxH8zD4UD+FjCLXQq7rIqV5IieIDzD19p3cY6Ys4+wEpDoarXeLZlcKIexLNU9kBG8T1GQTiiYgPSLkORkcvPihpv5UT18CR/milhxPYw4t4/6SdjX4jI7FSVS8Sj4bhIAufjADMwSBeAvs45p3AUpPvOYLr1m5mkMY7CtM/NFW4UX4Yn9yq/GfS7zKngPIOCEZCho2Ouu4D7nxUpjf011hhvYB3tpNadCRf+6hsxcBKK9XNWN1AaM83wiiaSGhf/P19o/Lz/RfGMhGwiS6UxQyQVJ3W6Qxi8sksldNIrsPjJU+/n5oyEVwqxf0ytLuls1rQmGOuiyT9 X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(6041248)(20161123558025)(20161123564025)(20161123562025)(20161123560025)(20161123555025)(6072148);SRVR:MWHPR12MB1152;BCL:0;PCL:0;RULEID:;SRVR:MWHPR12MB1152; X-Microsoft-Exchange-Diagnostics: 1;MWHPR12MB1152;4:/ffjsAnzgduRJH5bUQStYEt93LmM7TBKMCZobunFZ+XmJMKeKaRol0lTQy0e9SbzqqZ197w7uxJoQOlwac9C0kSYeoHCAoW1onPP1IKSvdDFnJFLBkce93pg3F9OS7moUQWVVAE58AgvHfkSysXDvys6634vgEtXv1rDuiLUAHRUxDBBEYU6a8QUm31yRLkL+7cFFr1BDqeIa6OUhaEWKjxkauDDmIvXO4n3wdpTxZAUJckIAeM164S9eMORZaMsVlq//erL7XUpXEOQD3tlNv5Roc+78cV/B6RWCJrOMxpS0WIo2orEYvOIQnjsrJficTwaY7nHXqGMSPAS0uEBOtd+xHFIKmNW9JR9T/TIZYF9oYTIREQvOiYOU/GzinUedKV3KFG8r7j39DiwiocFGlAifSHb+jXOPW+cqBWm1gxr5LPTYJaciitSQwF0xd+QofhRHBm0pmUQGMzQRkzk/AEiRnavPxIpLH4XVq/4IFdzbd4ziKVskFd6F31vFlv4qbYVNqJLxB4/a/DnS2dhpqnTJxgocsoD3ueN1aTgvpqeOWWhx/fWbnhsnuxA2h3JZdJiJOgzkraGv53eLMiNBh377hQozwOBSYL3gDSfDoKir0ulxXqm+cEXHBT3ndoO X-Forefront-PRVS: 024847EE92 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(4630300001)(6049001)(6009001)(39860400002)(39840400002)(39450400003)(39410400002)(39850400002)(24454002)(377454003)(38730400002)(65826007)(6116002)(3846002)(5660300001)(6246003)(7406005)(230700001)(7366002)(93886004)(7416002)(189998001)(83506001)(31696002)(53546007)(54356999)(86362001)(76176999)(305945005)(50986999)(36756003)(50466002)(2906002)(42186005)(23676002)(47776003)(4326008)(33646002)(6636002)(7736002)(31686004)(6666003)(54906002)(25786008)(229853002)(6486002)(4001350100001)(77096006)(90366009)(66066001)(65956001)(8676002)(2950100002)(53936002)(81166006)(217873001);DIR:OUT;SFP:1101;SCL:1;SRVR:MWHPR12MB1152;H:[10.236.64.195];FPR:;SPF:None;MLV:sfv;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtNV0hQUjEyTUIxMTUyOzIzOm93aytmVWsyRDVwZUI1N1QrYXdJelZRSW5s?= =?utf-8?B?QktJOTUvSno5alJFbnRMajF0eVZKUy9KOEoxRmF3WmFLbEFlcDlnczZ5V05y?= =?utf-8?B?RFk0MkJmWnl6RTF3Ylhyd0lMNDVyZHl0Sm9ZNWE2MnZuYnViYlZxbmdEN3JP?= =?utf-8?B?VWNRbnRHTnVSN09ocXNVUjRXbjBhbGJmN2VxbVBja1p5WkNUbm5WOGNaSmRD?= =?utf-8?B?WFYxd01DYVp2dldrVVJ3RmNLR3M5QzV3anBzZzZvTUxnR0lZVGgxL3dkMVdq?= =?utf-8?B?dFVobWxmOGZ0WHJPR1pNK1JVbWxlV0RObUx0WXFaNDlkZTZpQllUdi9QV0hR?= =?utf-8?B?Z1BDb2VPaGwvc051QU0yZW5pZXF1Y2JxbVp3SVV2YW1ucEZ3ZlM2WHlaQzNj?= =?utf-8?B?dDdoeTFqcmZOV0l2anBDOE00d1Y5YnV2bHU5WndNN2d4aFRkSXlxOGxIRWJQ?= =?utf-8?B?M3RKY1ZDMlVNeDFKTDJBKzBXdDhTWmlmRStwQVhka05CdXRGdXduNnBEdkZ2?= =?utf-8?B?eXlsdUlUbGxaNE1iYm9VUWlDeTZIY0xMRXdYRGozZnFtMzIrcHBkeGJkV0Nn?= =?utf-8?B?ZGZVMmJiSHJDbllYa0VhZGtPcHI3VCtsSXhmTlYwdTVsWm5vWEZhVGN4TjdK?= =?utf-8?B?V0h6TEFIay9BTWtEajlqdTBic2h4R2ZEOERGM1I3WFVRcC9NbkJBSExSMi8x?= =?utf-8?B?SDlsTllJOVZMUGgrU0UxY280bkNYUGlyWmxlc29ZY1dYbW50VTRzOTJkSHZW?= =?utf-8?B?RWQ1RHpqUTZ0UEFvU0QvcTRMdWR3ODlMMmd4REZaeHpGejlxR3hxR3lQU1F5?= =?utf-8?B?NUxUUWlzRTBSQ2FEYThIbUdsSGhvblVLWW9NYlpSbHFOMVJ4amkwT1lsWDBZ?= =?utf-8?B?Nzd3M3phQit1REcvUUhKL3dxdERjbkdHLzhteFpCYnhwSVJlYmh5YU5IcVZD?= =?utf-8?B?U1NSK3ROSDE5U3RDTUlmK3R0Z3d3TVFWeS81TzJmZVZMU0lJMEVnVGRYMXRE?= =?utf-8?B?TmNWS2R3T3VKVExEZVhRV3Q1azZOeTB6a3EyanhacFhMSEV2S29IMkJNd2RX?= =?utf-8?B?L0F0bVNJVVRZMmQvWXVTS0x1WHpwQzJJd0VXTjBJTlNxUDdmcldVZitaamdB?= =?utf-8?B?S1VVVUlqc2tLUytBdHRaUi85bHptay9HTlJZQUU1c1owR0NpVDRVNjV4amxF?= =?utf-8?B?d2dFNWpqS2ErejRwdWxpcTEvWndTdGx4Y1NLSUFPWGZPVHBKOE5iMzQvSGtx?= =?utf-8?B?M29IdlZZQ0xndkxFenB0aXVsTHEwd1BEMitEd2F0RndHSEEwUkNXNUhzNkRR?= =?utf-8?B?WlljSld4TFhjam9OaGFCd2tKRXpWZG1QMWI4SkVGUnU1aElwaFBocFhoQ3Js?= =?utf-8?B?d25DOW82VWsvaE5yaHVnM2JtSy9SNEFpZVpDSUdyR01MMVRkYytVSDRsTUkw?= =?utf-8?B?K1FuVUFKaXZHU2h2MG8vS29BZFBsbWwxUDlJb2RyNzEwbVloUzRhb2tJWk55?= =?utf-8?B?ZzNCSEN3eVJxUUFBMk45T1JVSk5LQ3BJNkJQa05EUWlRM0UwUnVHK3htRnJU?= =?utf-8?B?MlArdzJ0VDRTdDhzRUJ0Y1BtY0ZnUjhNRDJKRHFCLytQUjhwWWRPTzgxTmh5?= =?utf-8?B?Ti9QTlNFZ3J6TXdlN2l0MVV2T3NoOWZ1T1AxRkttcTdaNlpNR2NobWhYc2gx?= =?utf-8?B?WmZCTWJhL3lPTUM5eDVNazNXYjhla2IrNG93RTdsblE3dWUrNlRVZlVXNWR2?= =?utf-8?B?TWZJVitBMXB3K3YyNFcyd3dnSXR1bmZ2MWc1dEQvOFA3NS9STUdEQzNVNndu?= =?utf-8?B?ZWZvUEV6dVkyN0JZWi9OOFJrRW91UXo2bnVVZFZUc1ptNGc9PQ==?= X-Microsoft-Exchange-Diagnostics: 1;MWHPR12MB1152;6:WvVAvhcVWCp8AA52bauqiSH/KuRaOZpBD0mqzPbkC0rfW+VZY4lZ1AZw4pavvWEKUL6F8UGHgeJtl4Br1AX0MDfN9jY6UH6PPmfePr9EDC5sPWBD2kk/YTH3cyoxS1HuG8vpNNlECHnFdYBASL+E+DNUGPdr9eVJF5z9FMl0+0DBA4wP3XO1WvjiflZtr5ErPq+3KlERD2HDUbmqC2KWkrZyNPK81Kc8Wug73EOrh1iKBxFkptEKZJnYffGARqi6rop4qWn2nK40rSk55ry46paz37eDdjK2v0c2D6g2IozNFopdVxJqn0nQmh6jKPp9v8k4LkygO3HFXVmACVmvoByPTsRMHv1RbJOIvnIAqEOT+3cdEO9NxyYJtS0yFbLqVpXoC9ytAF3mjhvyKTE0HwkWQLjrFQw3RHG8q4Qmjn8=;5:H3bfRC5ZdPqAz/5D6j+63PmAoeT2uo0UkVej4Ihvbb3wpwDTEDEx3CKcWvx8j2GqeUWhMZdI0Gim/mBarqmeJbmrj88EWQwSCF+tBia/24zi1hGZtpWVEZePhVZISv039DPXSshBCdvbhQwhvFs2AQ==;24:S8Qf3Fw8ozwLt9BjjqbYHCUnALDpJ5sjhJWDe17EET2qmJauXyY5oPtJh/w5e8TqhcaCWFHSxMDWPHjBXypK1zrbFEMNMyVSKNEjhI3lczE= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;MWHPR12MB1152;7:36tbC/k1k/U0bBP666jznmVsZ//b06jVGPIPBFa9YHlzPriwkRgSuayC/mCJbhlhNfzoHynTLH73yZGK5RLMCc4NM8IJDbeQygkNzAwi+EqUOSuUk4lJdtzmnp7HsS+oR8KWxkDyMFBd/4pxCxmzltqRU5n51htWaDvhvwSKzST15srYijtQTEh9uIf5b/a2sBGZxDHk0x470DWemgXGdk94xQ4YM+VbgZy8nsuu5Dfsq4NPQQDO1kgi40H+mHP42ahYI5adB5yzERPiBzGVcbws428e6mQ4puKrUA3sLMQLlY1gqJJofGXx4gJecGUC7Nkq+rntG0v9h2awTZJ8tA==;20:116x2VQpuAVUt81n1N3PNiIwmvuqtPG1wr19w+GMYvFy3xn1+R0PdLiO+n2RoRqGu/nF3sBdY77NnP+z2D3Wm4pzBvmC8lZtNiBIbxlf70BhYWCngpvc7CW9I6I0pc18leqwoju6UC3ofh7MX6gJzGMC0SUIH62kCYryWho4Dkw4dYa+Xo5IQFXvw0bF+Rwm4XDpu6MfJmu06ni/KI3h/rkvYsDh9MBc8H5AajWRYOivbZEOQMFkkUSF6i475sEo X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Mar 2017 14:29:02.0486 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR12MB1152 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 3/16/2017 5:16 AM, Borislav Petkov wrote: > On Fri, Mar 10, 2017 at 10:35:30AM -0600, Brijesh Singh wrote: >> We could update this patch to use the below logic: >> >> * CPUID(0) - Check for AuthenticAMD >> * CPID(1) - Check if under hypervisor >> * CPUID(0x80000000) - Check for highest supported leaf >> * CPUID(0x8000001F).EAX - Check for SME and SEV support >> * rdmsr (MSR_K8_SYSCFG)[MemEncryptionModeEnc] - Check if SMEE is set > > Actually, it is still not clear to me *why* we need to do anything > special wrt SEV in the guest. > > Lemme clarify: why can't the guest boot just like a normal Linux on > baremetal and use the SME(!) detection code to set sme_enable and so > on? IOW, I'd like to avoid all those checks whether we're running under > hypervisor and handle all that like we're running on baremetal. Because there are differences between how SME and SEV behave (instruction fetches are always decrypted under SEV, DMA to an encrypted location is not supported under SEV, etc.) we need to determine which mode we are in so that things can be setup properly during boot. For example, if SEV is active the kernel will already be encrypted and so we don't perform that step or the trampoline area for bringing up an AP must be decrypted for SME but encrypted for SEV. The hypervisor check will provide that ability to determine how we handle things. Thanks, Tom >