From mboxrd@z Thu Jan 1 00:00:00 1970 From: Tom Lendacky Subject: Re: [PATCH v6 23/34] x86, realmode: Decrypt trampoline area if memory encryption is active Date: Wed, 14 Jun 2017 11:38:57 -0500 Message-ID: References: <20170607191309.28645.15241.stgit@tlendack-t1.amdoffice.net> <20170607191709.28645.69034.stgit@tlendack-t1.amdoffice.net> <20170614162416.ksa54esy5ql7sjgz@pd.tnic> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20170614162416.ksa54esy5ql7sjgz-fF5Pk5pvG8Y@public.gmane.org> Content-Language: en-US Sender: linux-efi-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Borislav Petkov Cc: linux-arch-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-efi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, kvm-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-doc-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, x86-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org, kexec-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r@public.gmane.org, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, kasan-dev-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org, linux-mm-Bw31MaZKKs3YtjvyW6yDsg@public.gmane.org, iommu-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org, Rik van Riel , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , Toshimitsu Kani , Arnd Bergmann , Jonathan Corbet , Matt Fleming , "Michael S. Tsirkin" , Joerg Roedel , Konrad Rzeszutek Wilk , Paolo Bonzini , Larry Woodman , Brijesh Singh , Ingo Molnar , Andy List-Id: linux-efi@vger.kernel.org On 6/14/2017 11:24 AM, Borislav Petkov wrote: > On Wed, Jun 07, 2017 at 02:17:09PM -0500, Tom Lendacky wrote: >> When Secure Memory Encryption is enabled, the trampoline area must not >> be encrypted. A CPU running in real mode will not be able to decrypt >> memory that has been encrypted because it will not be able to use addresses >> with the memory encryption mask. >> >> A recent change that added a new system_state value exposed a warning >> issued by early_ioreamp() when the system_state was not SYSTEM_BOOTING. >> At the stage where the trampoline area is decrypted, the system_state is >> now SYSTEM_SCHEDULING. The check was changed to issue a warning if the >> system_state is greater than or equal to SYSTEM_RUNNING. > > This piece along with the hunk touching system_state absolutely needs to > be a separate patch as it is unrelated. Yup, will do. Thanks, Tom >