From: Ard Biesheuvel <ardb@kernel.org>
To: linux-efi@vger.kernel.org
Cc: linux-kernel@vger.kernel.org, Ard Biesheuvel <ardb@kernel.org>,
Evgeniy Baskov <baskov@ispras.ru>, Borislav Petkov <bp@alien8.de>,
Andy Lutomirski <luto@kernel.org>,
Dave Hansen <dave.hansen@linux.intel.com>,
Ingo Molnar <mingo@redhat.com>,
Peter Zijlstra <peterz@infradead.org>,
Thomas Gleixner <tglx@linutronix.de>,
Alexey Khoroshilov <khoroshilov@ispras.ru>,
Peter Jones <pjones@redhat.com>,
Gerd Hoffmann <kraxel@redhat.com>, Dave Young <dyoung@redhat.com>,
Mario Limonciello <mario.limonciello@amd.com>,
Kees Cook <keescook@chromium.org>,
Tom Lendacky <thomas.lendacky@amd.com>,
"Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>,
Linus Torvalds <torvalds@linux-foundation.org>,
Joerg Roedel <jroedel@suse.de>
Subject: [PATCH v4 20/21] x86/efistub: Perform SNP feature test while running in the firmware
Date: Fri, 2 Jun 2023 12:13:12 +0200 [thread overview]
Message-ID: <20230602101313.3557775-21-ardb@kernel.org> (raw)
In-Reply-To: <20230602101313.3557775-1-ardb@kernel.org>
Before refactoring the EFI stub boot flow to avoid the legacy bare metal
decompressor, duplicate the SNP feature check in the EFI stub before
handing over to the kernel proper.
The SNP feature check can be performed while running under the EFI boot
services, which means we can fail gracefully and return an error to the
bootloader if the loaded kernel does not implement support for all the
features that the hypervisor enabled.
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
arch/x86/boot/compressed/sev.c | 74 ++++++++++++--------
arch/x86/include/asm/sev.h | 4 ++
drivers/firmware/efi/libstub/x86-stub.c | 17 +++++
3 files changed, 67 insertions(+), 28 deletions(-)
diff --git a/arch/x86/boot/compressed/sev.c b/arch/x86/boot/compressed/sev.c
index 014b89c890887b9a..be021e24f1ece421 100644
--- a/arch/x86/boot/compressed/sev.c
+++ b/arch/x86/boot/compressed/sev.c
@@ -315,6 +315,11 @@ static void enforce_vmpl0(void)
*/
#define SNP_FEATURES_PRESENT (0)
+u64 snp_get_unsupported_features(u64 status)
+{
+ return status & SNP_FEATURES_IMPL_REQ & ~SNP_FEATURES_PRESENT;
+}
+
void snp_check_features(void)
{
u64 unsupported;
@@ -328,7 +333,7 @@ void snp_check_features(void)
* EXIT_INFO_2 of the GHCB protocol so that those features can be reported
* as part of the guest boot failure.
*/
- unsupported = sev_status & SNP_FEATURES_IMPL_REQ & ~SNP_FEATURES_PRESENT;
+ unsupported = snp_get_unsupported_features(sev_status);
if (unsupported) {
if (ghcb_version < 2 || (!boot_ghcb && !early_setup_ghcb()))
sev_es_terminate(SEV_TERM_SET_GEN, GHCB_SNP_UNSUPPORTED);
@@ -338,10 +343,38 @@ void snp_check_features(void)
}
}
-void sev_enable(struct boot_params *bp)
+u64 sev_get_status(void)
{
unsigned int eax, ebx, ecx, edx;
struct msr m;
+
+ /* Check for the SME/SEV support leaf */
+ eax = 0x80000000;
+ ecx = 0;
+ native_cpuid(&eax, &ebx, &ecx, &edx);
+ if (eax < 0x8000001f)
+ return 0;
+
+ /*
+ * Check for the SME/SEV feature:
+ * CPUID Fn8000_001F[EAX]
+ * - Bit 0 - Secure Memory Encryption support
+ * - Bit 1 - Secure Encrypted Virtualization support
+ */
+ eax = 0x8000001f;
+ ecx = 0;
+ native_cpuid(&eax, &ebx, &ecx, &edx);
+ /* Check whether SEV is supported */
+ if (!(eax & BIT(1)))
+ return 0;
+
+ boot_rdmsr(MSR_AMD64_SEV, &m);
+ return m.q;
+}
+
+void sev_enable(struct boot_params *bp)
+{
+ unsigned int eax, ebx, ecx, edx;
bool snp;
/*
@@ -358,37 +391,14 @@ void sev_enable(struct boot_params *bp)
*/
snp = snp_init(bp);
- /* Check for the SME/SEV support leaf */
- eax = 0x80000000;
- ecx = 0;
- native_cpuid(&eax, &ebx, &ecx, &edx);
- if (eax < 0x8000001f)
- return;
-
- /*
- * Check for the SME/SEV feature:
- * CPUID Fn8000_001F[EAX]
- * - Bit 0 - Secure Memory Encryption support
- * - Bit 1 - Secure Encrypted Virtualization support
- * CPUID Fn8000_001F[EBX]
- * - Bits 5:0 - Pagetable bit position used to indicate encryption
- */
- eax = 0x8000001f;
- ecx = 0;
- native_cpuid(&eax, &ebx, &ecx, &edx);
- /* Check whether SEV is supported */
- if (!(eax & BIT(1))) {
+ /* Set the SME mask if this is an SEV guest. */
+ sev_status = sev_get_status();
+ if (!(sev_status & MSR_AMD64_SEV_ENABLED)) {
if (snp)
error("SEV-SNP support indicated by CC blob, but not CPUID.");
return;
}
- /* Set the SME mask if this is an SEV guest. */
- boot_rdmsr(MSR_AMD64_SEV, &m);
- sev_status = m.q;
- if (!(sev_status & MSR_AMD64_SEV_ENABLED))
- return;
-
/* Negotiate the GHCB protocol version. */
if (sev_status & MSR_AMD64_SEV_ES_ENABLED) {
if (!sev_es_negotiate_protocol())
@@ -409,6 +419,14 @@ void sev_enable(struct boot_params *bp)
if (snp && !(sev_status & MSR_AMD64_SEV_SNP_ENABLED))
error("SEV-SNP supported indicated by CC blob, but not SEV status MSR.");
+ /*
+ * Check for the SME/SEV feature:
+ * CPUID Fn8000_001F[EBX]
+ * - Bits 5:0 - Pagetable bit position used to indicate encryption
+ */
+ eax = 0x8000001f;
+ ecx = 0;
+ native_cpuid(&eax, &ebx, &ecx, &edx);
sme_me_mask = BIT_ULL(ebx & 0x3f);
}
diff --git a/arch/x86/include/asm/sev.h b/arch/x86/include/asm/sev.h
index 13dc2a9d23c1eb25..e5aad673194698b8 100644
--- a/arch/x86/include/asm/sev.h
+++ b/arch/x86/include/asm/sev.h
@@ -202,6 +202,8 @@ void snp_set_wakeup_secondary_cpu(void);
bool snp_init(struct boot_params *bp);
void __init __noreturn snp_abort(void);
int snp_issue_guest_request(u64 exit_code, struct snp_req_data *input, struct snp_guest_request_ioctl *rio);
+u64 snp_get_unsupported_features(u64 status);
+u64 sev_get_status(void);
#else
static inline void sev_es_ist_enter(struct pt_regs *regs) { }
static inline void sev_es_ist_exit(void) { }
@@ -225,6 +227,8 @@ static inline int snp_issue_guest_request(u64 exit_code, struct snp_req_data *in
{
return -ENOTTY;
}
+static inline u64 snp_get_unsupported_features(u64 status) { return 0; }
+static inline u64 sev_get_status(void) { return 0; }
#endif
#endif
diff --git a/drivers/firmware/efi/libstub/x86-stub.c b/drivers/firmware/efi/libstub/x86-stub.c
index 2d3282d2ed6eb756..f9d203b5ee6236e8 100644
--- a/drivers/firmware/efi/libstub/x86-stub.c
+++ b/drivers/firmware/efi/libstub/x86-stub.c
@@ -15,6 +15,7 @@
#include <asm/setup.h>
#include <asm/desc.h>
#include <asm/boot.h>
+#include <asm/sev.h>
#include "efistub.h"
#include "x86-stub.h"
@@ -756,6 +757,19 @@ static efi_status_t exit_boot(struct boot_params *boot_params, void *handle)
return EFI_SUCCESS;
}
+static bool have_unsupported_snp_features(void)
+{
+ u64 unsupported;
+
+ unsupported = snp_get_unsupported_features(sev_get_status());
+ if (unsupported) {
+ efi_err("Unsupported SEV-SNP features detected: 0x%llx\n",
+ unsupported);
+ return true;
+ }
+ return false;
+}
+
static void __noreturn enter_kernel(unsigned long kernel_addr,
struct boot_params *boot_params)
{
@@ -785,6 +799,9 @@ void __noreturn efi_stub_entry(efi_handle_t handle,
if (efi_system_table->hdr.signature != EFI_SYSTEM_TABLE_SIGNATURE)
efi_exit(handle, EFI_INVALID_PARAMETER);
+ if (have_unsupported_snp_features())
+ efi_exit(handle, EFI_UNSUPPORTED);
+
if (IS_ENABLED(CONFIG_EFI_DXE_MEM_ATTRIBUTES)) {
efi_dxe_table = get_efi_config_table(EFI_DXE_SERVICES_TABLE_GUID);
if (efi_dxe_table &&
--
2.39.2
next prev parent reply other threads:[~2023-06-02 10:25 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-02 10:12 [PATCH v4 00/21] efi/x86: Avoid bare metal decompressor during EFI boot Ard Biesheuvel
2023-06-02 10:12 ` [PATCH v4 01/21] x86/efistub: Branch straight to kernel entry point from C code Ard Biesheuvel
2023-06-02 10:12 ` [PATCH v4 02/21] x86/efistub: Simplify and clean up handover entry code Ard Biesheuvel
2023-06-02 10:12 ` [PATCH v4 03/21] x86/decompressor: Avoid magic offsets for EFI handover entrypoint Ard Biesheuvel
2023-06-02 10:12 ` [PATCH v4 04/21] x86/efistub: Clear BSS in EFI handover protocol entrypoint Ard Biesheuvel
2023-06-02 10:12 ` [PATCH v4 05/21] x86/decompressor: Use proper sequence to take the address of the GOT Ard Biesheuvel
2023-06-02 10:12 ` [PATCH v4 06/21] x86/decompressor: Store boot_params pointer in callee save register Ard Biesheuvel
2023-06-02 10:12 ` [PATCH v4 07/21] x86/decompressor: Call trampoline as a normal function Ard Biesheuvel
2023-06-02 10:13 ` [PATCH v4 08/21] x86/decompressor: Use standard calling convention for trampoline Ard Biesheuvel
2023-06-02 10:13 ` [PATCH v4 09/21] x86/decompressor: Avoid the need for a stack in the 32-bit trampoline Ard Biesheuvel
2023-06-02 10:13 ` [PATCH v4 10/21] x86/decompressor: Call trampoline directly from C code Ard Biesheuvel
2023-06-02 10:13 ` [PATCH v4 11/21] x86/decompressor: Only call the trampoline when changing paging levels Ard Biesheuvel
2023-06-02 10:13 ` [PATCH v4 12/21] x86/decompressor: Merge trampoline cleanup with switching code Ard Biesheuvel
2023-06-02 10:13 ` [PATCH v4 13/21] x86/efistub: Perform 4/5 level paging switch from the stub Ard Biesheuvel
2023-06-02 10:13 ` [PATCH v4 14/21] x86/efistub: Prefer EFI memory attributes protocol over DXE services Ard Biesheuvel
2023-06-02 10:13 ` [PATCH v4 15/21] decompress: Use 8 byte alignment Ard Biesheuvel
2023-06-02 10:13 ` [PATCH v4 16/21] x86/decompressor: Move global symbol references to C code Ard Biesheuvel
2023-06-02 10:13 ` [PATCH v4 17/21] x86/decompressor: Factor out kernel decompression and relocation Ard Biesheuvel
2023-06-02 10:13 ` [PATCH v4 18/21] x86/head_64: Store boot_params pointer in callee-preserved register Ard Biesheuvel
2023-06-02 10:13 ` [PATCH v4 19/21] efi/libstub: Add limit argument to efi_random_alloc() Ard Biesheuvel
2023-06-02 10:13 ` Ard Biesheuvel [this message]
2023-06-02 20:38 ` [PATCH v4 20/21] x86/efistub: Perform SNP feature test while running in the firmware Tom Lendacky
2023-06-02 20:39 ` Tom Lendacky
2023-06-02 21:29 ` Ard Biesheuvel
2023-06-02 22:01 ` Tom Lendacky
2023-06-02 22:22 ` Ard Biesheuvel
2023-06-02 10:13 ` [PATCH v4 21/21] x86/efistub: Avoid legacy decompressor when doing EFI boot Ard Biesheuvel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230602101313.3557775-21-ardb@kernel.org \
--to=ardb@kernel.org \
--cc=baskov@ispras.ru \
--cc=bp@alien8.de \
--cc=dave.hansen@linux.intel.com \
--cc=dyoung@redhat.com \
--cc=jroedel@suse.de \
--cc=keescook@chromium.org \
--cc=khoroshilov@ispras.ru \
--cc=kirill.shutemov@linux.intel.com \
--cc=kraxel@redhat.com \
--cc=linux-efi@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mario.limonciello@amd.com \
--cc=mingo@redhat.com \
--cc=peterz@infradead.org \
--cc=pjones@redhat.com \
--cc=tglx@linutronix.de \
--cc=thomas.lendacky@amd.com \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).