From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1763744AbcINOb4 (ORCPT ); Wed, 14 Sep 2016 10:31:56 -0400 Received: from mail-dm3nam03on0089.outbound.protection.outlook.com ([104.47.41.89]:34386 "EHLO NAM03-DM3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1757910AbcINObv (ORCPT ); Wed, 14 Sep 2016 10:31:51 -0400 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Thomas.Lendacky@amd.com; Subject: Re: [RFC PATCH v2 20/20] x86: Add support to make use of Secure Memory Encryption To: Borislav Petkov References: <20160822223529.29880.50884.stgit@tlendack-t1.amdoffice.net> <20160822223908.29880.50365.stgit@tlendack-t1.amdoffice.net> <20160912170856.2uklaoc4vxmkgnkq@pd.tnic> CC: , , , , , , , , , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , Arnd Bergmann , Jonathan Corbet , Matt Fleming , Joerg Roedel , Konrad Rzeszutek Wilk , Andrey Ryabinin , Ingo Molnar , Andy Lutomirski , "H. Peter Anvin" , Paolo Bonzini , Alexander Potapenko , Thomas Gleixner , Dmitry Vyukov From: Tom Lendacky Message-ID: <11306db6-fec1-db98-5e1b-400f7d828f7e@amd.com> Date: Wed, 14 Sep 2016 09:31:42 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <20160912170856.2uklaoc4vxmkgnkq@pd.tnic> Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-Originating-IP: [165.204.77.1] X-ClientProxiedBy: SN1PR0701CA0025.namprd07.prod.outlook.com (10.162.96.35) To BN6PR12MB1137.namprd12.prod.outlook.com (10.168.226.139) X-MS-Office365-Filtering-Correlation-Id: ac04d3c7-5ca4-49bf-70d7-08d3dcabdcec X-Microsoft-Exchange-Diagnostics: 1;BN6PR12MB1137;2:ChluKenRxK8yypYTGxYsAyhgLfBJnzgGsJvKIPg8cHhJsNx2an2RXF/CYP5L8bp++Mf63dapdnjYaQlt/2g2gtGktKHRmN3XExRwoiYiMB0bZtHqF40qM1MMNnSwaMuodT3+0Z3x7hyB3VW963zhrz5TjlKHGJmphDvI0nn3JGFdYg55vPFwr9FM8Uai7M1G;3:a458OhxnatDDL/m5IBpoXgg5OfXCGRh7sQiupmt5A6ZxtmuymvAxAlMi8VwMVPsDRwb7LxScnzuNtFTh9Y6TvLsVa/a0uQj0VkOFoZ6b32F+6m9YQqP/NJVnsZPknzti;25:IxEgf4FFUx2iQBOgEWeLXB2RAqtOJ2vEQSSR5QsgQGmWdo/OPfhZLHInGYrVt0I9uRI4USlySkElNdpF5sAmSuw36kGD2fRW25I2VTUTlBc/A2VQeSuFrntg6I3W72s5hAETRdR7FTOXyhJ1BOk04L17T3Sj0r+xiDCbzByW183jH3y1uUlzKplxG2HjfbNq+MjkbZxMMT1JB6WOR979x2ld9EWee1WZCmnVudODErKbxJ8ConeDVVNqUpZzF4BaCtnuTkPelZOQxm0LH17cKP67AbZjhHIWYSjMfayHYDrIwoxXEfT1YimF+ZbxC4UliKaIdgfQp6WdCS1tO32VRp3cJkRH39ligATycuN5vpO53AhuJlRLjldNbW7MQb10LDqq9sRQRoHNubYvZK8MoND1ao+Nl49OJXWin0CjekQ= X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BN6PR12MB1137; X-Microsoft-Exchange-Diagnostics: 1;BN6PR12MB1137;31:qOMG8D6r12hOb0kJ9wxuZHf9WrEI+jAqI/4GnUcqrqkpfB1wiuM9JPnB31oRD6PxVifUxjbaQYh0EQa+YSOpaNd0w4JtRQYwskB14K2Wi+CQwC+PePGAcqeQAqceXihk6ftUQxPcywh91ZxA3mFBeyMUTLiDLfBluBKYXB8u/vpRkCdUO4AuQDrTn0wJfhEhutv3ZFq9pTQOHM/WrM0cpphICWcC6U+p+gjgR+4Ubqs=;20:HDwBfpxTBWmCT+yFgz1ANsUWmUMS8Wg1caIkFLyib19s+TvLQ9puhnn4Us/dPCZYt8HLUICNepWm5/UTHc56CpcSeW831DJzhuYZeT/ecN6yA64qA7s3LtVxWcHkTRgT4MxWMIuuBWLh2IJk40agYZpYXbVbvfnxPeoRmWY9N9B35uIVtlumHWJWv7CgkfubVxzRZFuuMzcJLNNIWiyl+PBLnSUG2bQqMr16OxD0s4l+gixKGlmhEFGkLoxXjQQRaIrLj8PyN3jYfJAp4bp407jR266EsIZWW5OL1b/Bx/ut42VZWiX2YyLe+C2EesvBPJ1XAzmRvbNrfFgvzyCNf7twRusLGotDG/Dfp8o8/1LE4N+OiVxV8ZDTQX/wt7CLiW2o+7SEIrY7ZHjSqOM1e9TTMpTXHlJSN24Cy3GWUAT4bYuMzKw+K4GDUkW8UdmDGfNJkidMbYfe+xol0wyhRW5HXwGJYTcsa+fBHxQoJZ+xZ9kElXVteztm0ueVvdIV X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(767451399110); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040176)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(6055026);SRVR:BN6PR12MB1137;BCL:0;PCL:0;RULEID:;SRVR:BN6PR12MB1137; X-Microsoft-Exchange-Diagnostics: 1;BN6PR12MB1137;4:Snzm86GjxMoNvNYC1m4S3FaSXntVQGoPy/gr2m5h4FCGNaacG5UhrlJoMIL/R7a7qjxPOpKM2N0fAdTEWS4OF+5Fuo5JvGML63iIROftVCaopXB+6uzvN0NuLYqSe5w5brwhNqYIMWMLTiBhuuqhOaeBjHhaY2myG2Xb3x6tul2Mpb1v8Q37hCGaM+ddAJjWznNW37M+FRtVXCYqyyjGTcXWldqfpMVQHF/csEriVXEQpIQK864Ar1e3juH83ipUsMoogVJQj/RD6yZz2JGQdo4FW8yyjJu95SswJyLR4pJmAg9q+uB2LU5rbHTb7WQ1wUaZA9UKYX+Z/BALb8+xwv7uC79OzsFTfPAaVnj+DlqZO2WInOGxQ+q+KhGba5I4XWBPBPgbwOXH7nmoxJ7v8RH1bcuwING6wXfhvH76IDYGuwJXPS3jdPx6cbep6RwY X-Forefront-PRVS: 006546F32A X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(4630300001)(6009001)(6049001)(7916002)(189002)(24454002)(199003)(377454003)(50986999)(54356999)(189998001)(305945005)(33646002)(110136003)(230700001)(77096005)(65826007)(86362001)(76176999)(2950100001)(19580405001)(83506001)(19580395003)(101416001)(8676002)(4326007)(81166006)(81156014)(4001350100001)(68736007)(36756003)(586003)(105586002)(106356001)(7416002)(6116002)(3846002)(50466002)(42186005)(31686004)(2906002)(7846002)(66066001)(65806001)(65956001)(7736002)(47776003)(92566002)(97736004)(31696002)(23676002)(5660300001)(64126003)(217873001);DIR:OUT;SFP:1101;SCL:1;SRVR:BN6PR12MB1137;H:[10.236.18.82];FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtCTjZQUjEyTUIxMTM3OzIzOkp6NGozSGVjOGFNQ0ZhNnNmV1hPSXBYS05D?= =?utf-8?B?T1ViTE5LWFllS2MwZ1FlNnhReVR2RGtRc3l0aUNYWWNncVdOc24wU1V2b2dV?= =?utf-8?B?dDRqb2NHNHB0R2xnbmRuN3hoanNBSGhMamFKUUp2dUFiQjdOU2dRQ052QWdE?= =?utf-8?B?WmFNdDlRZWNrMW9ZS0c1V2YzZDJGQ1FOSVFXMFdVZ1lIT0szTzNtblQxeG5R?= =?utf-8?B?d3NtUHlXei9wKzJjemhkL1VLMFFGb2FuNmozWWF5UGRKYkRld3dBOUZFRFYw?= =?utf-8?B?ZmsrZTdvOFdGcE82UGo2K3Q0VTM3Y281R3JlQ3YxMzcveGV4T0E1UEhlTUxP?= =?utf-8?B?eGh5UlJlMmRJSVM4NTh3N2E5OXZ1K0RSV0w5c2p4RHA3TC84RzdHemRieWVy?= =?utf-8?B?ZFJnbmJ5YXZLRkt1L1c1ZXVhY0lMUm1uUk10aUQyQW9ieXROV3hmcTUzWEln?= =?utf-8?B?eTM4MGR6RWlrNjQwbWsvUzFkUW1FdEpPRTd1N1NZcE9Wa1ZWMVVWVUZJcGNR?= =?utf-8?B?ZW8vRHlqQXJDaTJRaGIrZDlpRndkVmxCYWk5T29aelh6UURhVURMSVJ1NTAr?= =?utf-8?B?dFBEZlA2bXFQWU9uUzFtellEQ1pwUmR2WFp5Yy85MWtzS1pqZ25wRThscUNj?= =?utf-8?B?WTk1MEdHZ0I5c0xlcVFPK3kvakhKdlF4S0FWS2M4djRUa1F4MFZaby9IT3Vh?= =?utf-8?B?dXhJVWpMUGUzK2hNdlg1ZFRlTkFma3dOdFQxN08rNjJ6R0wzeDhNMWtocy9H?= =?utf-8?B?M0FyNmtudURXNW5iQnVlREtWbW5scERwUWNadjQyWkVKcjFvT2wxZUFVNm9i?= =?utf-8?B?N0MzWldPNGtHRkRhWGJWOTFSSGhya0dGOG5LTWNSdmxoM2lnWllvQU5ScmJh?= =?utf-8?B?VEtjaC9IZzhoQUVWaFhMM01CMkZHQVFFaGp1Mnp2NWIzeWkyVVVKbG9oMXhn?= =?utf-8?B?OUpXRC85UCtpd3RmT3Q0K280QVVrQmdnRUx2Vi9oRE9Xc1h4NzNzWXI0czBm?= =?utf-8?B?NUxrVFdEVVh5eFdQeEg0REFiZVlnRjd2NlVWZE5jQWh1OHFvUWIxVkY3azB0?= =?utf-8?B?TjlKb04zVE0rczhzVm4yZk5jeEUyZHptYmk1TnowelRUTlJsZWhXN2pRcVlt?= =?utf-8?B?S2h5QTFRS3E2S3Bnc1NVb3h1R1YzNGsvYUR0RFBzVkJnT2JGcHA0dmUyYUE2?= =?utf-8?B?dGMzS3hWSVcrNkVObDZieENNc2VjeFdJanpSL3pGamhRUllZKzdJZ2xVbmdv?= =?utf-8?B?WDBDcTM0eldnYytDYTdlWENhNk15cUVaSlVQaXZNK2xWRElvNGNpbUlSZDZt?= =?utf-8?B?d1RSVTFOVmpwRkRBdkdPYytNck55RXgrSkEyZFZ2Z1FnazZSTXBvNWllRVJk?= =?utf-8?B?TzRNQmRFSkx2cWd6QWEzU0JvVUVLcVR6QVduVlNyNW9RZmR2VGNnLzliT3FL?= =?utf-8?B?ZitjWUtENVZjY1FkaHhHL0V0M3hrL09PZk9PakpWT3FQb3FYRStGN2tsdVpD?= =?utf-8?B?ZEdjT24wbzZQdkt0MGozSkNKMjR2ZXdVNDYwR0ZtKzBaSGdoRi94RDNpYmRz?= =?utf-8?B?RWY3Z3B0Zmg0QWVnM25ZZmFoWWJDMndpY2VTMWRmY1pGSmZpRjh3a0xmWmJ3?= =?utf-8?B?MGFveno0U3lZeUhsYjE2MUQyUHNMWFdKU1NIaU14OG1vb1h0UXBWakI1eTJ6?= =?utf-8?B?NmM1Q1h6RVd6eXhBSzQ5QVlOSGlrRmZtaWJmbkVhaGVRa0tHdGJLWFpFR24y?= =?utf-8?B?MC9XNzVPNktJTS9JMFNIRW1VeUV3NFpGMlVqQzN1U2h2SkhhZEJpcnNZSFhj?= =?utf-8?Q?HUSFlnNCwLNu0?= X-Microsoft-Exchange-Diagnostics: 1;BN6PR12MB1137;6:1jFmJUX1aFZeuDhYfqTiOKTlZB4z3LKsMZyXX509shqAt/yI9M+sezXoGlUkUVw3m9TSeXzXNk8xLmSDHSCc/JRBDpepQOEJDOjxFrFBm5PmER2X2BThGKyaMmVMAtcE403ACUz8cm3erCGD6ZuJxIlWSMzL+bEZdDU5daov+nKIefY9Ng2U6NGfUDATSXyHvppdUzYJYyb9j5XujwDuHJpDpw1VrevoZ5W+eZXIX7zrwaXYWlSS9uVI1chgiYzvUPT5yE7534jQbDgSdltjpkc+tal1VvBGpmxMRpn8eVmx1PkX9eq7g3XnrI9OSG4zgmknmCoiNa7WXU9/C/8vUg==;5:wTrLG2DLYqm+lewNcvfs+VMUWMUGimYELPKICutQs9smBTGXlqyIWFAewci1xKhCrmS8skOGpE2G8YZu+GonO+jzzyv9HnfKERL5Pb7t18OAry8vVvqIAIqfA+lp9u4hx+3oXDUgf8UrYYfqulvmBA==;24:N32etJeTIyVG3rR2CB13mtFhkAMf/SNvrJrGA3datRdaYHkUgmV+cjq903S+hss4LRP7NNs6b9WIgWbE+uqRisNGhamVs/U0mM+G4I6zfHU=;7:PdzQCNJC62kjzVxzOb0AdvKi7qY9CfR9YrrCnt1BxLp7+yaKTIF7OFmsg6Jg4zmF1GduuX3dLKJzkcwS9pdDf7Rj3x0U6XV632veniLjYovMSiE8Bc6xSNdU7wdKDuc5bWTNHCzUtHUkD/C77MUkjYXeiZvJTeKPgs4k/VwgouRANQmfuvbynz6HwzQXbEAajojLihBuSPaYBQZ3Oedem+qs5YH0YHYCchJtW3cMRbhCUiTCE9PMVk8rhf2YxDhX SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;BN6PR12MB1137;20:YTgWPS1kpTRxtS5Qab9KIezj1sQUBZGgxhIMGeKXFdlLn2gF8v5DvdoNMjdpJ+3wOunNRehD77Mx0ggEhDmmBNHa70al+y+npJ4kepXbiuDJ+sXN2mjYcmvHvnGSX2EZ3MrXOOBcCQoJMmjKFCDQhkXWUZymIqLZJ5KMG8ti2G12tPEIVfJ5DCsOjJ/VGkOwXnLGC8hygbFZt1LSIRS1SRG7vviHqkIjYofQUEnNrVsTc/bU/msi/40kxCmieD+Q X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Sep 2016 14:31:48.1172 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR12MB1137 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 09/12/2016 12:08 PM, Borislav Petkov wrote: > On Mon, Aug 22, 2016 at 05:39:08PM -0500, Tom Lendacky wrote: >> This patch adds the support to check if SME has been enabled and if the >> mem_encrypt=on command line option is set. If both of these conditions >> are true, then the encryption mask is set and the kernel is encrypted >> "in place." >> >> Signed-off-by: Tom Lendacky >> --- >> Documentation/kernel-parameters.txt | 3 >> arch/x86/kernel/asm-offsets.c | 2 >> arch/x86/kernel/mem_encrypt.S | 302 +++++++++++++++++++++++++++++++++++ >> arch/x86/mm/mem_encrypt.c | 2 >> 4 files changed, 309 insertions(+) >> >> diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt >> index 46c030a..a1986c8 100644 >> --- a/Documentation/kernel-parameters.txt >> +++ b/Documentation/kernel-parameters.txt >> @@ -2268,6 +2268,9 @@ bytes respectively. Such letter suffixes can also be entirely omitted. >> memory contents and reserves bad memory >> regions that are detected. >> >> + mem_encrypt=on [X86_64] Enable memory encryption on processors >> + that support this feature. >> + >> meye.*= [HW] Set MotionEye Camera parameters >> See Documentation/video4linux/meye.txt. >> >> diff --git a/arch/x86/kernel/asm-offsets.c b/arch/x86/kernel/asm-offsets.c >> index 2bd5c6f..e485ada 100644 >> --- a/arch/x86/kernel/asm-offsets.c >> +++ b/arch/x86/kernel/asm-offsets.c >> @@ -85,6 +85,8 @@ void common(void) { >> OFFSET(BP_init_size, boot_params, hdr.init_size); >> OFFSET(BP_pref_address, boot_params, hdr.pref_address); >> OFFSET(BP_code32_start, boot_params, hdr.code32_start); >> + OFFSET(BP_cmd_line_ptr, boot_params, hdr.cmd_line_ptr); >> + OFFSET(BP_ext_cmd_line_ptr, boot_params, ext_cmd_line_ptr); >> >> BLANK(); >> DEFINE(PTREGS_SIZE, sizeof(struct pt_regs)); >> diff --git a/arch/x86/kernel/mem_encrypt.S b/arch/x86/kernel/mem_encrypt.S >> index f2e0536..bf9f6a9 100644 >> --- a/arch/x86/kernel/mem_encrypt.S >> +++ b/arch/x86/kernel/mem_encrypt.S >> @@ -12,13 +12,230 @@ >> >> #include >> >> +#include >> +#include >> +#include >> +#include >> +#include >> + >> .text >> .code64 >> ENTRY(sme_enable) >> +#ifdef CONFIG_AMD_MEM_ENCRYPT >> + /* Check for AMD processor */ >> + xorl %eax, %eax >> + cpuid >> + cmpl $0x68747541, %ebx # AuthenticAMD >> + jne .Lmem_encrypt_exit >> + cmpl $0x69746e65, %edx >> + jne .Lmem_encrypt_exit >> + cmpl $0x444d4163, %ecx >> + jne .Lmem_encrypt_exit >> + >> + /* Check for memory encryption leaf */ >> + movl $0x80000000, %eax >> + cpuid >> + cmpl $0x8000001f, %eax >> + jb .Lmem_encrypt_exit >> + >> + /* >> + * Check for memory encryption feature: >> + * CPUID Fn8000_001F[EAX] - Bit 0 >> + * Secure Memory Encryption support >> + * CPUID Fn8000_001F[EBX] - Bits 5:0 >> + * Pagetable bit position used to indicate encryption >> + * CPUID Fn8000_001F[EBX] - Bits 11:6 >> + * Reduction in physical address space (in bits) when enabled >> + */ >> + movl $0x8000001f, %eax >> + cpuid >> + bt $0, %eax >> + jnc .Lmem_encrypt_exit >> + >> + /* Check if BIOS/UEFI has allowed memory encryption */ >> + movl $MSR_K8_SYSCFG, %ecx >> + rdmsr >> + bt $MSR_K8_SYSCFG_MEM_ENCRYPT_BIT, %eax >> + jnc .Lmem_encrypt_exit > > Like other people suggested, it would be great if this were in C. Should be > actually readable :) Yup, working on that. I'll try and make it all completely C. > >> + >> + /* Check for the mem_encrypt=on command line option */ >> + push %rsi /* Save RSI (real_mode_data) */ >> + push %rbx /* Save CPUID information */ >> + movl BP_ext_cmd_line_ptr(%rsi), %ecx >> + shlq $32, %rcx >> + movl BP_cmd_line_ptr(%rsi), %edi >> + addq %rcx, %rdi >> + leaq mem_encrypt_enable_option(%rip), %rsi >> + call cmdline_find_option_bool >> + pop %rbx /* Restore CPUID information */ >> + pop %rsi /* Restore RSI (real_mode_data) */ >> + testl %eax, %eax >> + jz .Lno_mem_encrypt > > This too. > >> + >> + /* Set memory encryption mask */ >> + movl %ebx, %ecx >> + andl $0x3f, %ecx >> + bts %ecx, sme_me_mask(%rip) >> + >> +.Lno_mem_encrypt: >> + /* >> + * BIOS/UEFI has allowed memory encryption so we need to set >> + * the amount of physical address space reduction even if >> + * the user decides not to use memory encryption. >> + */ >> + movl %ebx, %ecx >> + shrl $6, %ecx >> + andl $0x3f, %ecx >> + movb %cl, sme_me_loss(%rip) >> + >> +.Lmem_encrypt_exit: >> +#endif /* CONFIG_AMD_MEM_ENCRYPT */ >> + >> ret >> ENDPROC(sme_enable) >> >> ENTRY(sme_encrypt_kernel) > > This should be doable too but I guess you'll have to try it to see. > > ... > >> diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c >> index 2f28d87..1154353 100644 >> --- a/arch/x86/mm/mem_encrypt.c >> +++ b/arch/x86/mm/mem_encrypt.c >> @@ -183,6 +183,8 @@ void __init mem_encrypt_init(void) >> >> /* Make SWIOTLB use an unencrypted DMA area */ >> swiotlb_clear_encryption(); >> + >> + pr_info("memory encryption active\n"); > > Let's make it more official with nice caps and so on... > > pr_info("AMD Secure Memory Encryption active.\n"); Will do. Thanks, Tom > From mboxrd@z Thu Jan 1 00:00:00 1970 From: Tom Lendacky Subject: Re: [RFC PATCH v2 20/20] x86: Add support to make use of Secure Memory Encryption Date: Wed, 14 Sep 2016 09:31:42 -0500 Message-ID: <11306db6-fec1-db98-5e1b-400f7d828f7e@amd.com> References: <20160822223529.29880.50884.stgit@tlendack-t1.amdoffice.net> <20160822223908.29880.50365.stgit@tlendack-t1.amdoffice.net> <20160912170856.2uklaoc4vxmkgnkq@pd.tnic> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20160912170856.2uklaoc4vxmkgnkq@pd.tnic> Sender: owner-linux-mm@kvack.org To: Borislav Petkov Cc: linux-arch@vger.kernel.org, linux-efi@vger.kernel.org, kvm@vger.kernel.org, linux-doc@vger.kernel.org, x86@kernel.org, linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com, linux-mm@kvack.org, iommu@lists.linux-foundation.org, =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , Arnd Bergmann , Jonathan Corbet , Matt Fleming , Joerg Roedel , Konrad Rzeszutek Wilk , Andrey Ryabinin , Ingo Molnar , Andy Lutomirski , "H. Peter Anvin" , Paolo Bonzini , Alexander Potapenko , Thomas Gleixner , Dmitry Vyukov List-Id: linux-efi@vger.kernel.org On 09/12/2016 12:08 PM, Borislav Petkov wrote: > On Mon, Aug 22, 2016 at 05:39:08PM -0500, Tom Lendacky wrote: >> This patch adds the support to check if SME has been enabled and if the >> mem_encrypt=on command line option is set. If both of these conditions >> are true, then the encryption mask is set and the kernel is encrypted >> "in place." >> >> Signed-off-by: Tom Lendacky >> --- >> Documentation/kernel-parameters.txt | 3 >> arch/x86/kernel/asm-offsets.c | 2 >> arch/x86/kernel/mem_encrypt.S | 302 +++++++++++++++++++++++++++++++++++ >> arch/x86/mm/mem_encrypt.c | 2 >> 4 files changed, 309 insertions(+) >> >> diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt >> index 46c030a..a1986c8 100644 >> --- a/Documentation/kernel-parameters.txt >> +++ b/Documentation/kernel-parameters.txt >> @@ -2268,6 +2268,9 @@ bytes respectively. Such letter suffixes can also be entirely omitted. >> memory contents and reserves bad memory >> regions that are detected. >> >> + mem_encrypt=on [X86_64] Enable memory encryption on processors >> + that support this feature. >> + >> meye.*= [HW] Set MotionEye Camera parameters >> See Documentation/video4linux/meye.txt. >> >> diff --git a/arch/x86/kernel/asm-offsets.c b/arch/x86/kernel/asm-offsets.c >> index 2bd5c6f..e485ada 100644 >> --- a/arch/x86/kernel/asm-offsets.c >> +++ b/arch/x86/kernel/asm-offsets.c >> @@ -85,6 +85,8 @@ void common(void) { >> OFFSET(BP_init_size, boot_params, hdr.init_size); >> OFFSET(BP_pref_address, boot_params, hdr.pref_address); >> OFFSET(BP_code32_start, boot_params, hdr.code32_start); >> + OFFSET(BP_cmd_line_ptr, boot_params, hdr.cmd_line_ptr); >> + OFFSET(BP_ext_cmd_line_ptr, boot_params, ext_cmd_line_ptr); >> >> BLANK(); >> DEFINE(PTREGS_SIZE, sizeof(struct pt_regs)); >> diff --git a/arch/x86/kernel/mem_encrypt.S b/arch/x86/kernel/mem_encrypt.S >> index f2e0536..bf9f6a9 100644 >> --- a/arch/x86/kernel/mem_encrypt.S >> +++ b/arch/x86/kernel/mem_encrypt.S >> @@ -12,13 +12,230 @@ >> >> #include >> >> +#include >> +#include >> +#include >> +#include >> +#include >> + >> .text >> .code64 >> ENTRY(sme_enable) >> +#ifdef CONFIG_AMD_MEM_ENCRYPT >> + /* Check for AMD processor */ >> + xorl %eax, %eax >> + cpuid >> + cmpl $0x68747541, %ebx # AuthenticAMD >> + jne .Lmem_encrypt_exit >> + cmpl $0x69746e65, %edx >> + jne .Lmem_encrypt_exit >> + cmpl $0x444d4163, %ecx >> + jne .Lmem_encrypt_exit >> + >> + /* Check for memory encryption leaf */ >> + movl $0x80000000, %eax >> + cpuid >> + cmpl $0x8000001f, %eax >> + jb .Lmem_encrypt_exit >> + >> + /* >> + * Check for memory encryption feature: >> + * CPUID Fn8000_001F[EAX] - Bit 0 >> + * Secure Memory Encryption support >> + * CPUID Fn8000_001F[EBX] - Bits 5:0 >> + * Pagetable bit position used to indicate encryption >> + * CPUID Fn8000_001F[EBX] - Bits 11:6 >> + * Reduction in physical address space (in bits) when enabled >> + */ >> + movl $0x8000001f, %eax >> + cpuid >> + bt $0, %eax >> + jnc .Lmem_encrypt_exit >> + >> + /* Check if BIOS/UEFI has allowed memory encryption */ >> + movl $MSR_K8_SYSCFG, %ecx >> + rdmsr >> + bt $MSR_K8_SYSCFG_MEM_ENCRYPT_BIT, %eax >> + jnc .Lmem_encrypt_exit > > Like other people suggested, it would be great if this were in C. Should be > actually readable :) Yup, working on that. I'll try and make it all completely C. > >> + >> + /* Check for the mem_encrypt=on command line option */ >> + push %rsi /* Save RSI (real_mode_data) */ >> + push %rbx /* Save CPUID information */ >> + movl BP_ext_cmd_line_ptr(%rsi), %ecx >> + shlq $32, %rcx >> + movl BP_cmd_line_ptr(%rsi), %edi >> + addq %rcx, %rdi >> + leaq mem_encrypt_enable_option(%rip), %rsi >> + call cmdline_find_option_bool >> + pop %rbx /* Restore CPUID information */ >> + pop %rsi /* Restore RSI (real_mode_data) */ >> + testl %eax, %eax >> + jz .Lno_mem_encrypt > > This too. > >> + >> + /* Set memory encryption mask */ >> + movl %ebx, %ecx >> + andl $0x3f, %ecx >> + bts %ecx, sme_me_mask(%rip) >> + >> +.Lno_mem_encrypt: >> + /* >> + * BIOS/UEFI has allowed memory encryption so we need to set >> + * the amount of physical address space reduction even if >> + * the user decides not to use memory encryption. >> + */ >> + movl %ebx, %ecx >> + shrl $6, %ecx >> + andl $0x3f, %ecx >> + movb %cl, sme_me_loss(%rip) >> + >> +.Lmem_encrypt_exit: >> +#endif /* CONFIG_AMD_MEM_ENCRYPT */ >> + >> ret >> ENDPROC(sme_enable) >> >> ENTRY(sme_encrypt_kernel) > > This should be doable too but I guess you'll have to try it to see. > > ... > >> diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c >> index 2f28d87..1154353 100644 >> --- a/arch/x86/mm/mem_encrypt.c >> +++ b/arch/x86/mm/mem_encrypt.c >> @@ -183,6 +183,8 @@ void __init mem_encrypt_init(void) >> >> /* Make SWIOTLB use an unencrypted DMA area */ >> swiotlb_clear_encryption(); >> + >> + pr_info("memory encryption active\n"); > > Let's make it more official with nice caps and so on... > > pr_info("AMD Secure Memory Encryption active.\n"); Will do. Thanks, Tom > -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org