From mboxrd@z Thu Jan 1 00:00:00 1970 From: Tom Lendacky Subject: Re: [RFC PATCH v2 11/20] mm: Access BOOT related data in the clear Date: Wed, 14 Sep 2016 09:20:44 -0500 Message-ID: References: <20160822223529.29880.50884.stgit@tlendack-t1.amdoffice.net> <20160822223738.29880.6909.stgit@tlendack-t1.amdoffice.net> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: iommu-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: iommu-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: Andy Lutomirski , Matt Fleming Cc: "linux-efi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org" , kvm list , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , Matt Fleming , "linux-mm-Bw31MaZKKs3YtjvyW6yDsg@public.gmane.org" , Alexander Potapenko , "H. Peter Anvin" , linux-arch , Jonathan Corbet , X86 ML , kasan-dev , Ingo Molnar , Andrey Ryabinin , Arnd Bergmann , Borislav Petkov , Thomas Gleixner , Dmitry Vyukov , "linux-doc-u79uwXL29TY76Z2rM5mHXA@public.gmane.org" , "linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org" , iommu-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org, Paolo Bonzini List-Id: linux-arch.vger.kernel.org On 09/12/2016 11:55 AM, Andy Lutomirski wrote: > On Aug 22, 2016 6:53 PM, "Tom Lendacky" wrote: >> >> BOOT data (such as EFI related data) is not encyrpted when the system is >> booted and needs to be accessed as non-encrypted. Add support to the >> early_memremap API to identify the type of data being accessed so that >> the proper encryption attribute can be applied. Currently, two types >> of data are defined, KERNEL_DATA and BOOT_DATA. > > What happens when you memremap boot services data outside of early > boot? Matt just added code that does this. > > IMO this API is not so great. It scatters a specialized consideration > all over the place. Could early_memremap not look up the PA to figure > out what to do? Yes, I could see if the PA falls outside of the kernel usable area and, if so, remove the memory encryption attribute from the mapping (for both early_memremap and memremap). Let me look into that, I would prefer something along that line over this change. Thanks, Tom > > --Andy > From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-sn1nam02on0072.outbound.protection.outlook.com ([104.47.36.72]:11728 "EHLO NAM02-SN1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1764171AbcINOU5 (ORCPT ); Wed, 14 Sep 2016 10:20:57 -0400 Subject: Re: [RFC PATCH v2 11/20] mm: Access BOOT related data in the clear References: <20160822223529.29880.50884.stgit@tlendack-t1.amdoffice.net> <20160822223738.29880.6909.stgit@tlendack-t1.amdoffice.net> From: Tom Lendacky Message-ID: Date: Wed, 14 Sep 2016 09:20:44 -0500 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Sender: linux-arch-owner@vger.kernel.org List-ID: To: Andy Lutomirski , Matt Fleming Cc: kasan-dev , "linux-efi@vger.kernel.org" , linux-arch , Thomas Gleixner , Paolo Bonzini , Ingo Molnar , Borislav Petkov , iommu@lists.linux-foundation.org, "linux-doc@vger.kernel.org" , Jonathan Corbet , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , Konrad Rzeszutek Wilk , "linux-mm@kvack.org" , Matt Fleming , Alexander Potapenko , "linux-kernel@vger.kernel.org" , Dmitry Vyukov , Arnd Bergmann , Joerg Roedel , Andrey Ryabinin , "H. Peter Anvin" , X86 ML , kvm list Message-ID: <20160914142044.nGGN5EsP2yB-zpSUDm9xWshlRzBM1tzPfCyXhzBEcDY@z> On 09/12/2016 11:55 AM, Andy Lutomirski wrote: > On Aug 22, 2016 6:53 PM, "Tom Lendacky" wrote: >> >> BOOT data (such as EFI related data) is not encyrpted when the system is >> booted and needs to be accessed as non-encrypted. Add support to the >> early_memremap API to identify the type of data being accessed so that >> the proper encryption attribute can be applied. Currently, two types >> of data are defined, KERNEL_DATA and BOOT_DATA. > > What happens when you memremap boot services data outside of early > boot? Matt just added code that does this. > > IMO this API is not so great. It scatters a specialized consideration > all over the place. Could early_memremap not look up the PA to figure > out what to do? Yes, I could see if the PA falls outside of the kernel usable area and, if so, remove the memory encryption attribute from the mapping (for both early_memremap and memremap). Let me look into that, I would prefer something along that line over this change. Thanks, Tom > > --Andy >