From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753207AbdJTOhH (ORCPT ); Fri, 20 Oct 2017 10:37:07 -0400 Received: from mail-dm3nam03on0088.outbound.protection.outlook.com ([104.47.41.88]:47104 "EHLO NAM03-DM3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752366AbdJTObc (ORCPT ); Fri, 20 Oct 2017 10:31:32 -0400 From: Brijesh Singh To: x86@kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Borislav Petkov , Tom Lendacky , Brijesh Singh , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , Borislav Petkov , Andy Lutomirski , Matt Fleming , Ard Biesheuvel , linux-efi@vger.kernel.org Subject: [Part1 PATCH v7 07/17] x86/efi: Access EFI data as encrypted when SEV is active Date: Fri, 20 Oct 2017 09:30:49 -0500 Message-Id: <20171020143059.3291-8-brijesh.singh@amd.com> X-Mailer: git-send-email 2.9.5 In-Reply-To: <20171020143059.3291-1-brijesh.singh@amd.com> References: <20171020143059.3291-1-brijesh.singh@amd.com> MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [165.204.78.1] X-ClientProxiedBy: BN6PR14CA0029.namprd14.prod.outlook.com (10.171.172.143) To SN1PR12MB0160.namprd12.prod.outlook.com (10.162.3.147) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 352cde6f-16b7-4228-8383-08d517c73ceb X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(48565401081)(4534020)(4602075)(4627075)(201703031133081)(201702281549075)(2017052603229);SRVR:SN1PR12MB0160; X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0160;3:u3VrutEHanWGCV6ykfWIaTNbgecBPsXkUwxNNEv5sC4OhiDIV7OaDMM5blzJIqxBcNCms5U9ipFJ+bmpmIci3xDsq9mv+QEDdGIasZ/X9TX3A07UDPCEtqL2M2WIW47CTjbF1truBrwlsCrNNbhOCdrkf1cJF2O2OWkxgmPxaH/Vbgi6yiWj/YnyQpwq26CeR/+5BhCHVSacluGdYIQfhv7t95mFo7KGLa6k1DrKHz7+iAVl1myWXJqfcn4RaJuX;25:AB9bLEtkgg8ormavrs4QYufS+PsxuB70KZdWB1dsUelw585Quym2/7r1KDMdtCSLMcNrNtj4FoOAi34kJ9SaM6Uskx9qihmsXxTswo2KLvGcw+mqGz4ejBZrqFT67uOr9sL/YS65bX4fOAA3I82IoVVpp9rhYHPwm9IwBSRpalxN+6vE2ZaYgJOwvVhuHktYaE+lWDupGUIVLm1yRG3LnyWzO/K0d7kG3+pX4pAd+O747Pzs/0Z3Ze6sM3nBBGppDSQ8jOLLIuby2iJPR9VRvwIrOSlNyC4Ec5a2rvtDeV3/oN4wA7K0tN/7h7PKG1LFUldy2MpYSMOmLjM5Tpfc9w==;31:LXEmx3u3O4kUnExo6IZMd1sYKIaA7z2kBIAGMdNEs19omPzFn7cw7SLahssMwDZQmAcTG6o9O/xxVuY1wqxUYLeTt+Fo8DM3lAvPUE/MB+RN3fnoYwy9NXzweXjWbre5g7CSgfxWFaoByjtavHmakiuUddTcKzPGK/rQrob4+mz8GUiScs5sfyJqRl+9UG398idquMSJsSSzJt3NaMLjoTeQRZyHpVwUVUu6BVc1UEE= X-MS-TrafficTypeDiagnostic: SN1PR12MB0160: X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0160;20:nOgiIjn2f+odXk+jenWiqS/WxMXkdAzKmxYCXDBZi8UuF/m2nU0h7PQWvGJCuzN8gNI/5HjWKScwSPCPYQrXy2NLg7UgdaId/57AP73nWgYnEc+Rs/VRN5SycqRk71A7hGlCTTrneCzO0o/Do9KO6UWw7lmUrLYb4BdvnGVPO8oAWLdlHdtDhbS2FqB5X0m7m6i5TYYonodVyBDWPx35Kv+j13lrm4wIisSO+tFJaXrml9O873I3PAvRvoHFBeXbOKbUosNwyblAULtq0VjLpoHgGW4Y2mqLK9EXbCBayH4ZSM8rFJBqDxKGvJSpCM9zYo4fft2YOQ+CzkDwv8QAx+VkBbIZ4KPedWIxeSroXu98yLlCZaYJVONYj8uFLL4n4EeG732nsLLXMu2d1ea8iBe56ThfwbR5yU3ceyrxsKGIxLF00lDPLkxrUqzebwqaVlAHYvM4rrLqYsZA0Vgpr54OZ/vTf/IRAqTPtGuyPWxbG9URAfVrrg1IVicF+45u;4:lQRxnPw6i1ro8FK4A8xLWq3XgErdSrz1y2vzReBJPDFIeU8Z/bcGXkOt7sGdq4dgfKOhva+vBQchX8oK8Hu8Qk7t6guc+gVAxfuzl3+jykmLsK2fcjJU4GIRKNugC3qsXsBCjBzB+qWUtS45iQn6byvrvyEARx9oQo36f5sk4+VwZErVmfC9m/fgJs8k+rdO5ksmkJ3NrBEocCp7SfJxt/wM8jcH9aBg0NmaVnl5E8sHWlRprWb1RXJdDtnN+Xb+9UbS0sWh/mlg0uZh1pVi1N0qfXFkL2mXxXXS2GPTtSOivz8KApzII1es/Jo62fDG X-Exchange-Antispam-Report-Test: UriScan:(9452136761055)(767451399110); X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(5005006)(8121501046)(3002001)(3231020)(93006095)(93001095)(10201501046)(100000703101)(100105400095)(6055026)(6041248)(20161123562025)(20161123564025)(20161123555025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123560025)(20161123558100)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:SN1PR12MB0160;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:SN1PR12MB0160; X-Forefront-PRVS: 0466CA5A45 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(6009001)(39860400002)(376002)(346002)(199003)(189002)(54906003)(1076002)(6666003)(189998001)(68736007)(8676002)(305945005)(50226002)(7736002)(101416001)(76176999)(8936002)(97736004)(25786009)(81166006)(81156014)(16526018)(6486002)(478600001)(48376002)(2906002)(50466002)(4326008)(7416002)(47776003)(66066001)(5660300001)(2950100002)(53936002)(106356001)(3846002)(50986999)(16586007)(53416004)(6116002)(5003940100001)(36756003)(33646002)(86362001)(105586002)(316002);DIR:OUT;SFP:1101;SCL:1;SRVR:SN1PR12MB0160;H:ubuntu-010236106000.amd.com;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;SN1PR12MB0160;23:HE6racNGCKSkFY4ad96lTzT6lJ4DpX6Fcn93vUAKS?= =?us-ascii?Q?Lv85ArM6nux8Rd0Ak5Jk911GS49BDWK725FxqHKeV7wwKfRklPZ9J1ByWbVK?= =?us-ascii?Q?b1W5uHmyJ3R/baJYKLjH5uXPKo3m4B0W5yOShG93XiBFv0HabQZrNAF00nyb?= =?us-ascii?Q?/vZ795uLjh6L2gA8zj7GCHLMwQZPS1toSqQAvXB3ossFm46rkdpuUpILBkNO?= =?us-ascii?Q?Q3JJgmlSweIrdLUpw280ty1sJMAdROebxVClDmJwi39QCqc+3tfkwRYNbmFO?= =?us-ascii?Q?JyYeTe0YfxaSKUQ6Q/oXacxuwOmoDiS6yDxzhpfnox+3bTDTLsYJc6bgbfNi?= =?us-ascii?Q?AjcLzGh+235EtlZhWkqA8wJh/j3ORn1RjN8x7GbLjfllsaALZFHncUuGyVN3?= =?us-ascii?Q?A28UPucerX1UagqgSBwVAt7fPqxz6pTIRyY+cR5qdkB0FukreEosAsLj91TO?= =?us-ascii?Q?p5+C2qVQcMcukgyrKlQ/SrBIl3T4WD2KaJSNbndH2gYmHg+/o5guupYThh7/?= =?us-ascii?Q?ML9Gv+70R03KEVwH+YOuZYVQqCl22GW2Var7PjwFDl3hwx164FaoeE6P5hcl?= =?us-ascii?Q?IfY1Wzb4k+14p8ATUaElKl5wpC0R6QM61J4mpFd1RnY5hyeTifa3UbXlcwkB?= =?us-ascii?Q?IzkEJbUtbl4VdV0Ahc19luV9Z4w38eFtO3boIeyf8burMu9tSr1GORIvEXoj?= =?us-ascii?Q?wc5iQ+nuu+dHMBCMJpSmu5MJ9Luj1oYtqrqkeU7xDADK+v7LsNqPauGkohPh?= =?us-ascii?Q?9vmHW6rw0sNWdYi+bXgxoSqjk6RHtSyMww1B5vdQSM6MPz52vGrkpUJPd+4p?= =?us-ascii?Q?Rwtb9+34ajnaiFUFEjaAK0krquJ6xgAHQ2wL2oxQ2kOOnlQW6SyX9/rguAYB?= =?us-ascii?Q?SDeiFL3001OfZAyQEIDVw5vRQ1u95YbEaaumjaV01rQdpPtHqVi6XgIlWm5d?= =?us-ascii?Q?vxaCMc/V3WJq1hFIt3/YBwnb2nGIrghLXCAmlcb5MjdUSaO2HsIdWB3aX2vp?= =?us-ascii?Q?Xfw+xOBfD2r5Z/a/oJZxwUg3T72Ft8qNQrKcvUj/5ff0GoqdLunPD6RsWuty?= =?us-ascii?Q?NIDBQspWfMztxIOi/aLMlvTEkXTVDm2YVPB+rzs8KaeuodUuThCR6o3zEPeQ?= =?us-ascii?Q?n1wrUqVrFI=3D?= X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0160;6:fdz0rlsm/S46oOtQZLJ8TjstAxf5C6ieCVVKI6YnEZdr0FgYtstyWyUjZfS3a7kAeJTSHWwocE2YYnvdPp/YFjAFBPpFGFShmcaeXulZ6d4Y/wdapfQjOq6W9a+FB8t22yGnGc+keFeGul4CgSsUTmR7yEAHSknpnKqrno9lM7uKtGerfSQI9ibMInOvDnGQ+KBFXmnw+cjndwoZaSGakNF5uF1h4snlDGLY6PaX9/kdf4w5Ejiu4gY7umhJFcylnP4BtHJvQEsPp6iPEbagXBIhjUwBbfRhEUimeKrgAvO0jBTTnmpJwsl1rkax++lON/jqU0xlA8gIb5YZ34W4Ww==;5:y1I/Hcc/Ohy9RArZrkq8tcEbQ+x6X4yCDaL87FbO6+X1ajzgINWXKwbOcqB1kH0WrOEfMav7sEdnx/S9VEIvryq3GY+svdxPp1XDUQ+ALAavV3RoiplwvbZBB6Aq7LNEa5u96q3BoDiyP0jG/vKwlw==;24:SFnuFolc3VrJGAZrJKI5NlQS9gmncg3izWoAa0C8kHJO87bckDbXEjy/B2PWOhuBG+rmBILbQcWKQmDVDhoDTJJCMfMteFII77uxgzEPvf8=;7:axMyiVVSdcKJP3shzcsUoN7WEmDCqgNRTKEtJQPJSRruHbNC8oIqtgNNKP5lXEtbYWxwAiC8D6Y31t+0vmAVuub4F4keq3YoInaXlun4rBBtuvF+vJb3fkeHVWWTbarMMydevyWqnFmIIVWKhk73/yjG13MsUmk2u8QTBQqdoVOOtXt5oM9+Aedg99ovarqS6n5UcVid0AcUdx9tQYs7HjU+WR3XhZBifu3GDcnGIqE= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0160;20:Gp9pAZz+cgkbd993x4VHso0tG0HsJDT9+nbJe+6i5pWWMGs5ROfdZ/FdKGaVPGYGdBykih3rPx5Nwy+PKBHC3MyGfR8sLS4LDrqBQdq7nGiuVGQATiNNo52SMPZirjY8/bmGhOZjvTqN6EqzlYTtg5efNws0wSYTfQyXZGUQMNtD0BPe+NGkj7mNChRzre6AbI/0DnjCzaYqT0AKM43qR3d84XR8s5FGj5y1097gyvsBEEfq4ep1Zp5wEWmXrPBf X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Oct 2017 14:31:21.9073 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 352cde6f-16b7-4228-8383-08d517c73ceb X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN1PR12MB0160 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Tom Lendacky EFI data is encrypted when the kernel is run under SEV. Update the page table references to be sure the EFI memory areas are accessed encrypted. Signed-off-by: Tom Lendacky Signed-off-by: Brijesh Singh Reviewed-by: Borislav Petkov Tested-by: Borislav Petkov Cc: Thomas Gleixner Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: Borislav Petkov Cc: Andy Lutomirski Cc: Matt Fleming Cc: Ard Biesheuvel Cc: linux-efi@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: x86@kernel.org --- arch/x86/platform/efi/efi_64.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c index 12e83888e5b9..5469c9319f43 100644 --- a/arch/x86/platform/efi/efi_64.c +++ b/arch/x86/platform/efi/efi_64.c @@ -32,6 +32,7 @@ #include #include #include +#include #include #include @@ -369,7 +370,11 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages) * as trim_bios_range() will reserve the first page and isolate it away * from memory allocators anyway. */ - if (kernel_map_pages_in_pgd(pgd, 0x0, 0x0, 1, _PAGE_RW)) { + pf = _PAGE_RW; + if (sev_active()) + pf |= _PAGE_ENC; + + if (kernel_map_pages_in_pgd(pgd, 0x0, 0x0, 1, pf)) { pr_err("Failed to create 1:1 mapping for the first page!\n"); return 1; } @@ -412,6 +417,9 @@ static void __init __map_region(efi_memory_desc_t *md, u64 va) if (!(md->attribute & EFI_MEMORY_WB)) flags |= _PAGE_PCD; + if (sev_active()) + flags |= _PAGE_ENC; + pfn = md->phys_addr >> PAGE_SHIFT; if (kernel_map_pages_in_pgd(pgd, pfn, va, md->num_pages, flags)) pr_warn("Error mapping PA 0x%llx -> VA 0x%llx!\n", @@ -538,6 +546,9 @@ static int __init efi_update_mem_attr(struct mm_struct *mm, efi_memory_desc_t *m if (!(md->attribute & EFI_MEMORY_RO)) pf |= _PAGE_RW; + if (sev_active()) + pf |= _PAGE_ENC; + return efi_update_mappings(md, pf); } @@ -589,6 +600,9 @@ void __init efi_runtime_update_mappings(void) (md->type != EFI_RUNTIME_SERVICES_CODE)) pf |= _PAGE_RW; + if (sev_active()) + pf |= _PAGE_ENC; + efi_update_mappings(md, pf); } } -- 2.9.5