Re: [PATCH Part1 v5 31/38] x86/compressed/64: add identity mapping for Confidential Computing blob

Borislav Petkov
2021-08-27T14:43:20Z

On Fri, Aug 20, 2021 at 10:19:26AM -0500, Brijesh Singh wrote:
> diff --git a/arch/x86/boot/compressed/ident_map_64.c b/arch/x86/boot/compressed/ident_map_64.c
> index 3cf7a7575f5c..54374e0f0257 100644
> --- a/arch/x86/boot/compressed/ident_map_64.c
> +++ b/arch/x86/boot/compressed/ident_map_64.c
> @@ -37,6 +37,9 @@
> #include <asm/setup.h> /* For COMMAND_LINE_SIZE */
> #undef _SETUP
>
> +#define __BOOT_COMPRESSED
> +#include <asm/sev.h> /* For sev_snp_active() + ConfidentialComputing blob */
> +

When you move all the cc_blob parsing to the compressed kernel, all that
ugly ifdeffery won't be needed.

> extern unsigned long get_cmd_line_ptr(void);
>
> /* Used by PAGE_KERN* macros: */
> @@ -163,6 +166,21 @@ void initialize_identity_maps(void *rmode)
> cmdline = get_cmd_line_ptr();
> add_identity_map(cmdline, cmdline + COMMAND_LINE_SIZE);

Carve that ...

> + /*
> + * The ConfidentialComputing blob is used very early in uncompressed
> + * kernel to find CPUID memory to handle cpuid instructions. Make sure
> + * an identity-mapping exists so they can be accessed after switchover.
> + */
> + if (sev_snp_enabled()) {
> + struct cc_blob_sev_info *cc_info =
> + (void *)(unsigned long)boot_params->cc_blob_address;
> +
> + add_identity_map((unsigned long)cc_info,
> + (unsigned long)cc_info + sizeof(*cc_info));
> + add_identity_map((unsigned long)cc_info->cpuid_phys,
> + (unsigned long)cc_info->cpuid_phys + cc_info->cpuid_len);
> + }
> +
> /* Load the new page-table. */
> sev_verify_cbit(top_level_pgt);

... up to here into a separate function called sev_prep_identity_maps()
so that SEV-specific code flow is not in the generic code path.

> write_cr3(top_level_pgt);

--
Regards/Gruss,
Boris.