From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756822AbdGXTPb (ORCPT ); Mon, 24 Jul 2017 15:15:31 -0400 Received: from mail-sn1nam01on0078.outbound.protection.outlook.com ([104.47.32.78]:14752 "EHLO NAM01-SN1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1756351AbdGXTLU (ORCPT ); Mon, 24 Jul 2017 15:11:20 -0400 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; From: Brijesh Singh To: linux-kernel@vger.kernel.org, x86@kernel.org, linux-efi@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, kvm@vger.kernel.org Cc: Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , Borislav Petkov , Andy Lutomirski , Tony Luck , Piotr Luc , Tom Lendacky , Fenghua Yu , Lu Baolu , Reza Arbab , David Howells , Matt Fleming , "Kirill A . Shutemov" , Laura Abbott , Ard Biesheuvel , Andrew Morton , Eric Biederman , Benjamin Herrenschmidt , Paul Mackerras , Konrad Rzeszutek Wilk , Jonathan Corbet , Dave Airlie , Kees Cook , Paolo Bonzini , =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= , Arnd Bergmann , Tejun Heo , Christoph Lameter , Brijesh Singh Subject: [RFC Part1 PATCH v3 14/17] x86/boot: Add early boot support when running with SEV active Date: Mon, 24 Jul 2017 14:07:54 -0500 Message-Id: <20170724190757.11278-15-brijesh.singh@amd.com> X-Mailer: git-send-email 2.9.4 In-Reply-To: <20170724190757.11278-1-brijesh.singh@amd.com> References: <20170724190757.11278-1-brijesh.singh@amd.com> MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [165.204.78.1] X-ClientProxiedBy: CY4PR04CA0049.namprd04.prod.outlook.com (10.171.243.142) To CY1PR12MB0150.namprd12.prod.outlook.com (10.161.173.20) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 3c4b05fa-2c71-44ec-0553-08d4d2c7653e X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(22001)(300000502095)(300135100095)(48565401081)(300000503095)(300135400095)(201703131423075)(201703031133081)(300000504095)(300135200095)(300000505095)(300135600095)(300000506095)(300135500095);SRVR:CY1PR12MB0150; X-Microsoft-Exchange-Diagnostics: 1;CY1PR12MB0150;3:Wq0TNCjlHBD9RQjPr72xJjlDQB+q0/W7aJYDzCLCChtLoMNHvlz8AXIVgLpm33cRUJ0WuR944ZS+SadQ2YTlheb/+V8HT8iJGJeadjCsGC1q2VOJ4huxxV24pt2E2aVle/T9jI2TU0scBFi4HvQevv5tSCT3YfZmookG2UQOZsUCB+lXdMhHs83jk/JZnk/MlnCf8j6+sTB/McrznjZX+gIKKYCNbdgpwLFR66hbLcUaKL64iSOy5INc9QpXudeV38k+LOYQ4SS8kAVk3SaHERdEuPagI/oRFC5nC1vM+FBXkgz61ajtKFZl4+mKkZzvjBrS7hO+Ql3Z6qt9/V0I8wJWUYgG3P48U5dBZHEDwfgCQbo9iBUl/2LANbzzRXDsd9jCnLhWuUK7PEj4+nDWW4wl6Br/rpjfEsu39xjXIgj8xzusAcSMOYIUO2YuM/xcWeqtvD2rVFjdELElYhLxCqJnNIry2GtaClfkRdwd7HGWrbvfXb/UHHyP0kR7KdtsWAXyB5RQ67AcSZKuPuXYhg+Ayxa456osn9GNYYZ0SHZ+d2VYJPGLqOJFOz7F6tDTeUhGcTKaFpq1cMSW4Vxkg7yg9Vh2ziWkfKrYTlgzZGWMK+sSOk8iUdfQrgonPOuz6R8nj69StaOfnoraD8yuT86BIp4Dhs4ZDh0ek/Z6xZF06dp8gzG3Fb6UtTNPe3ufmQr1b8qjiI4gk1NLItXNvCbZ5CL9cQmGixS9n4mbzPOTkYdw+LJy6vny4yw6yin1oY7myl9W/uJQYDzxFudNqQ== X-MS-TrafficTypeDiagnostic: CY1PR12MB0150: X-Microsoft-Exchange-Diagnostics: 1;CY1PR12MB0150;25:BFMk5OiA907A9U402x8khImw4iOAHPJvgPG2MrHem1OAvgBSdBa1dmzLHh5XNWhTk6sKC2lL+PQItNNcI3ie+4oH+oF0cHXkY4cA+MZIgm7ZSPTtPK0sAe5nTtg7y+Ya3yHnxa3ii1JOm06QoJaCWTLCtOef6gN+YMd17Q8Ee9Ce/g1LQzTcTn1zaR2NPrcKS1Xaizncl4xs0U120liSyDQ9UnLSY9eWtUjyGo8/GJ6pQ8mvWQbFR7YGbnxyXk3x0XMGDkR5xb9hgh90OovDi9NltfkYAisUdY5QMNQYT62lZ+DlqvxbRcQD4QsIjA+fWvLbFe/UV8Qc7DVmKUsjSeWHzUtSx7/ZHo5Ar8qXyXkyU1b/4UMaSOgdzQynABNkcvTFFlMNcofKup6lLhqHgzLZx+yrKaNUX/OSoTEZBNiXEKBaUvKsZNApz5K83qaRjwsEw2Y/l7EWnaURh7znKRSe9OBoYrB7iZbhOnvvILacnqGf3N3YUXIg8+L1HROcXML9ZZbnRnrkm4mf5BY0MumlfkomuwexDr6EbVdxOeq9V9CRplKX7sYqCiJR5PDWimBN59xn7nAnjySnCDxIupELjPiAOf0LgC8XWCxKiSZ6W4yxnJOczjbx4w0JlVxO26IDWFGfBXC96gGfHD06Uuo4+mfbSIds0vr1WTBilEfwe4GKkmfwkKgC1c3arG1okVhp224KvA9gZGPiVsVR7/QmdmjoG17dR56gwVqaYtvQIg2pJK9dydxmv/kLYXM9qCPOkjsGV2IHC+vs8/5PI4nUamdV8mi8xA874KaZG3u54thFO8go+tvb8kvPwfxGOG+7zmHVRVbd8Hlbi/R09wlkEjwioa5d4rEr5cijEXgCCvjFWckrYjhX4yuCJusDFoW9ZRY+NqrY1m/NAh8dEu0QkrYpZG0SLDQ1AV2hrY8= X-Microsoft-Exchange-Diagnostics: 1;CY1PR12MB0150;31:rAp4YysNYRIXdsJJ1CoEVKXQlWItJXkr9zWXDnLyiJ+pSOu3N6x9HCcL6jS+fEQzKboVtfvCPqB6R+zOjRTNlbrAqejjyh1WahBZCzPOzd/tBHS4LFHaTyHU3+MWYa2CyyAqY1io3c/+yR6auK1ZYnNk0Crp+4e+DZ7k3egFORwzglLqbR0kGZoxLI4hFQvMKKoTcyXdHXTJIhYhDdMcgr7nswNCZXVtgesvJK7EWhmkW/zW9vPe0GQ9TtKhmQf3C3M/mZuN03CepvFEoXerFE+omM79ck9/PODgcwcVi6usk2VkMhhl5gT3Cwb7HHVyA9j7Pwj1vCxuiS5vrcib9UDi5LIEVSWJvlJ/BySGiJH084y+tZ7qh/Baav04ucY1dhgymYYoYyQgT14M9WGlOIqbL8DNHFwdoznT+QBtaF+L7D4JxJkQJ/+tzg/SYP4iZdHuhIL2W3bhG2qRSeJqcGBaaEwEXxBEO03XqvG6Ws2pNPJ1FpcTkHYDuyiqkUOGm1tc543MNFMFfX9KkEUqkFC0JbAbbAcSE1SPh4GGuYKm8otybQLSJYYdDl/ZiYEB5ehpGKWGoQOQJ9Em2UU7t/LRW5byGPfYRg0L6x/O7OVU8A0DkkDh896O8+UeZ2KNOiVCMJEsE5O0X2JlLUmxG6AWsY5zXy/LMGkH8Cre1Ug= X-Microsoft-Exchange-Diagnostics: 1;CY1PR12MB0150;20:Z3ppGPb4nMKFRjps0AFC0wgAB/3f/iROqFZ3ixi602YwkuQp7geoKt1TlGLL7rMRAVIH90nGhIQWUyIpAg+FOfqD9cCfPTRyLvvIw5uy9LrGVc1OdC3RuDr7BOP4KSruqsZgfkaEkB9ViEx1OWORnZXfI0Nf6gJWh+IxoC2HeZVecmwpo4La6ErTn6fyU6EdRzaDUKip7Qn4sxUACDuw6xTB/zCdgJwOEhjukJ/6yJF0joRunVVP+q/tVmP9fQs69+MuytWiBf549Qvzu18ULiwvLUeyXmifUD2lYV6RsX5avpzOSGzRiZnoYtoi0br2WYwb9+qKcUMEgwrykxytchohBnIJnZSNFdBcENfhixEJTrcpFZrI/a9jscy+7+T5vUib5F9NszmCYHx4T//PMFfxiKH5A5eHGGRWPNQEddJ1Ls53sMtP1gZs0g4V1OLe2UlYoEfyYBFhIu1RfZ5assPFkBt8S93Ke7gOXYAP+PJhZgBT4ql4GZomII6mRmGo X-Exchange-Antispam-Report-Test: UriScan:(767451399110); X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(601004)(2401047)(8121501046)(5005006)(93006095)(93001095)(10201501046)(100000703101)(100105400095)(3002001)(6055026)(6041248)(20161123564025)(20161123555025)(20161123560025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123558100)(20161123562025)(6072148)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:CY1PR12MB0150;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:CY1PR12MB0150; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;CY1PR12MB0150;4:5nx2Ze9mnlcUb89JP1BcOBsTKi3xZB+iim0VrY116+?= =?us-ascii?Q?b6TktMxxqz/iTJPFIa6NL22pP0rxUXYJXsDY3QBKyxZl8nug1Gk+bPpk8Wkn?= =?us-ascii?Q?QD7wWVSs7wzBbo5oUwp5AIbjMuCOYW37McL2FQZ1LgvoRwnxLhv5WIpAhiQw?= =?us-ascii?Q?9IheTo+VQ1ZyqLeAk3v4AwwRSLKFH4dC4OAqqQ4IMISbuFuYLxB3n5w9FuCB?= =?us-ascii?Q?5vdXbfoBTHHjoeagNUYvLkuE1KkHiuinpY4VpzPk6LaNJkPdKnAC0P+aweL3?= =?us-ascii?Q?ispM9T19twVconYUmDR/twryepWhL0cTnCJlL2MA+HaI1z+Rx95WZ3CaqhEy?= =?us-ascii?Q?EWOnXUndtYxtmLn4mddyVIph1k9c0/5HVXeS6UUyKinwmS7jII58KmsQUPcd?= =?us-ascii?Q?KSTyo7KDAg+RgK9GWraBwAigftPjm8wM695KzgWiRFplPQXZUmzkRYGlSreM?= =?us-ascii?Q?Ocy5c2zUvmYsiPz1kmCUyjub2bycIhqVa2nKp6EdTZ/4l2w56hmeL4G5DyJs?= =?us-ascii?Q?aoCdPC27WodvbDNb6SI5iKi92ajw414ZS8WQ662ZljPLO1aQRSH2/ebnu9tY?= =?us-ascii?Q?GkT6SkGU0C89S4gPOS5064qtNX8i9CEZC+Vx5bTaMDb9TIRkz2g3j0r3HGEn?= =?us-ascii?Q?vFZv/up+znY23quTWx6tXDi1E3r06xTBc34XMLynn9gyw/Nv3smrz/FgG/VF?= =?us-ascii?Q?qzohtPmavmVVMgG6yUydx5MCP8e4LZthvxmEkWtkJO8wM1mD/EjD3qhQsXr0?= =?us-ascii?Q?eFNwBEJYhn/OLZG5Wi7/ywMBZQ/sN4N5Rdhgls5wq1x21R1NBQ/oWqmuvHsA?= =?us-ascii?Q?B7yn0ZlieTE2qkaNZE0TINg6cjCAV2eVxQlR6L0qS/YCcGQVijBDzLVHNRD1?= =?us-ascii?Q?Nzjcy59bJH2618pJ+FP2/pkNRLjahehDVaQWPEf2SaW8gjSxYH4kt2oIys06?= =?us-ascii?Q?Fii4x71YXCqOO0VgGhHOP/tSzheB5rN6etzoFAhXmvIWPtnPObCKqhWXPFFU?= =?us-ascii?Q?Hm86hrx5hYBRuhyejO+8CWG0wq+DeL6GtmcP5w6WIo6Oj1y4MMbL7KTMLZgc?= =?us-ascii?Q?0UwK+m77zTD3Dv5Ar9oZKHsitpHr8Beud3h904UJvb4+vzgTC0ScBpaM+vdG?= =?us-ascii?Q?ItvfgiIfifEwDfVWLoV0GD1hDzZS0wyHz/jSAb7UspKyfDZYCutjO5X1AvX3?= =?us-ascii?Q?jQ6X6cdacZnuq0S4W46Vvqf2D0kMfto+h9?= X-Forefront-PRVS: 0378F1E47A X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(4630300001)(7370300001)(6009001)(39840400002)(39850400002)(39450400003)(39400400002)(39410400002)(39860400002)(199003)(189002)(4326008)(81156014)(7350300001)(81166006)(50226002)(50466002)(68736007)(36756003)(38730400002)(1076002)(110136004)(53936002)(6116002)(25786009)(48376002)(575784001)(8676002)(86362001)(305945005)(54906002)(7736002)(2950100002)(6666003)(50986999)(101416001)(47776003)(105586002)(5660300001)(5003940100001)(7416002)(33646002)(106356001)(66066001)(6486002)(7406005)(97736004)(189998001)(3846002)(76176999)(2906002)(53416004)(42186005)(478600001)(2004002);DIR:OUT;SFP:1101;SCL:1;SRVR:CY1PR12MB0150;H:ubuntu-010236106000.amd.com;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;CY1PR12MB0150;23:wnIXDRWr333pdevr1iniuBLH2UKAE1ceJBP5DT/9r?= =?us-ascii?Q?zgmdLaz4ybzu6FYO/l1lsgfN0BIi2TLqt5JJaPDcT0EgQNg5Vt7wzXoL2tpX?= =?us-ascii?Q?mN+E0Q1CpuA9iMKfV/QrHIgTE3nv0QlE+1uF6NKDmkb4/xJWyZuEwBW7kYNv?= =?us-ascii?Q?FfKCUlU9PJnNFSWv6eQBXzMbyFIGQLrsK4x5zp6d6lSatM+ptN6QrRfU3F3k?= =?us-ascii?Q?VUxInpjwJmzFPUV2Z3dn5UJp+a4dDbQsffKDIIf0Tma0vYhTw/onf2lB6aL7?= =?us-ascii?Q?nzwgfIbJi/VrrZkZ8FqvjrkoByFLVV5z9cPrhJg3vkkFp40OiPCUBfFnoV4C?= =?us-ascii?Q?v5cGcIigo6Q41VVNKNDlwu7Pyn48wGPcTQ+wbVci5omGRuWHu9RNnS/tGShC?= =?us-ascii?Q?YKr/TMNsBtc/kZIKUmZjY6lmmeUdaEUePLwUkYaOliE0RAtopMwYbMX3of/F?= =?us-ascii?Q?+P3rhbKgEukjWGbH23yUYsec6UyjTZkdgpsuBsKzUw1v/uBJZ9Pbn1OBUKt6?= =?us-ascii?Q?fw3SwrbanA2X6LxYyoPCRFxJKZN4uDVYbhcmPKGRKMpzyeJwR67YXMOnRmDH?= =?us-ascii?Q?8iCzGA9BuKpOO4VVRpATGkZsjIWUAriBOf/zT8tEwrzLdgbnBdmd6Z3dgSc8?= =?us-ascii?Q?cNMe3libf8bXAhMph6/u5o7wkPLIHWcZ9tvEyFzY9GOzx08DCbCIbwfyAbm3?= =?us-ascii?Q?gnfiNaangxd8IKLFhcuCarRvRSeM8ZagJVga4ZNLiUWJuLZQR333DHDWbrDZ?= =?us-ascii?Q?leJAPsdZJ6pr1JxANHfqALnOmNT+C3oNVU5+8lWfIsESudvA4ui+x8Fj/+tD?= =?us-ascii?Q?+H1fjVVG30vJ91mqwp6TcK15oBRC7jc6YGOZjBG1syOq9ymRN/eZx7+6oq1q?= =?us-ascii?Q?DWs3h3iLgbCB24vIRI0PnGxi2ko1xO1pD6Ohl4X+pHfuACG0WJjAgqBmbhK6?= =?us-ascii?Q?FNAt+v3U8pPUXmxm/8zdV/+PBEU/ZCTvMlmLphCkQfKbL42uUnAZUU1UbSxj?= =?us-ascii?Q?b2hAEEwlrXIN1S71WcKCNDIm8TEw1wgsIMWDy5itKS6J41oOAttdvpUWCQc5?= =?us-ascii?Q?ozNiaY3jGChTMvcGtlgq1D40cArzBUHQcXpWDA3799x0ZTPQBBP116/fx8h8?= =?us-ascii?Q?nak/o5PYudU+b0rI6l8aYmeTV6AdSgfCcUxu+8wP3nxJbFLZGqOaJrCmhM5a?= =?us-ascii?Q?2mYu9K0NNsqbwE1aheRjjikyQKjlE77Q4w5hwFLG0rmfSi3oRvcwpUFNXGEJ?= =?us-ascii?Q?ZmZPAzcmMYvErxA6j6zC/kGMLRm44pzvcVQ2SxOb2rd4OYg26H2dw9KWIUY0?= =?us-ascii?Q?T84I+MFP2KdgCSzRSFQ521BGHUOKZcTlt82+OIaIeRJAHBxqC/ZmFkAnIyHZ?= =?us-ascii?Q?xJ0LA=3D=3D?= X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;CY1PR12MB0150;6:LiMM3p2+fkmTHJz27Lr+oDs69l/OLSndHVqGPYUYnZ?= =?us-ascii?Q?imYEgDXlCMbUj3Elnk+CFg5kbcW9x6yduEYFMtRwQZEh3/8SwRYodxf3O7B9?= =?us-ascii?Q?xMuiqJEZ2gkYkRWcaEQpi8wHeeRvRZtPah58JvfUuP9gItktC0hl1+56/zJK?= =?us-ascii?Q?ZP7RKYZ0Z8vdifzYHKFpYLJKgjwyfoXFOqj4tt9CsNh3qybBuM8PPEG8vo/d?= =?us-ascii?Q?ZJ+2T52w8MOI2DENrmAbpd7d9sFVSJMP8+558LOrxvMXQg3kwvSd2r3Bix6b?= =?us-ascii?Q?19JIpiLzFX+Xk2BNzFjPQae0azeARY65pliqrBc4p4T6h9NMPjUSdWvdWEDr?= =?us-ascii?Q?+82H6Vu4lDcO31uBFf34BaOCKC+rbwNMOAZe6XvNoQMhnSV0V+xTZqJIEDv/?= =?us-ascii?Q?WBWQVBzRLEf6ZSljs7Wnd/7aflJIadDcAabZZX0bF97fvxOTflJyeOrzj9Hh?= =?us-ascii?Q?yC2iHJpobuP1EKoU0ISKOdUGEqTnQyoE8SoG6SvmoEatm4u8iWS7lLi7Z/+E?= =?us-ascii?Q?MQdllsvUv3kB2sazXwrMp41WEzTicfKfIhH0u1egtqHt+n4MhC63pce4mysf?= =?us-ascii?Q?5vbXw/AxD6EqTRWz2v4JsvWeAAPZRUjhFkyOHpNdV9G2y6b/0p1KJtR/YwVn?= =?us-ascii?Q?OxmkWipygOlVwu3XE/Op7nF18BOBA+G1YpNVG9O9vGicotGc3EWwKyogg8nZ?= =?us-ascii?Q?4k66SiDKkhXWsEmtVpLAs6zl+ilApj/fawi3FoFg702rOq2+ZXxOdNoj+82j?= =?us-ascii?Q?UFRAPGQjhohoGTsReXHbqZuaqhcWzBpqrajNS651m5GT0nZQyZrE58uD0ERs?= =?us-ascii?Q?/bB+mOLxJlbvowWStAy7mr9yXdjJtJrlw0+PMr3i6CF3RvoKtNYnb5Mll846?= =?us-ascii?Q?5TDBwcQfDLWkLZrcBUu37OEvmAbbZnQW6hKbIQOZgvS4rWa0CQE9UTq0KWeS?= =?us-ascii?Q?nVahfF6wb83HYjoDGE8Noe6qKQLnXH5jeVTOBGlGXcCBO+lLV+8jysmZ94vo?= =?us-ascii?Q?DObaxLWv6AjUgH3m0xaaHR?= X-Microsoft-Exchange-Diagnostics: 1;CY1PR12MB0150;5:20FqVSlNrgUuS25kX8H1cI49H6b/abiBWR/yArR7lYUO6ENmG62vX+4tIL8ZSQp9u46eoZjQjMX3p0gfwMv012k+wZcpHUeRalZcYBrzJXL95LuEPSwl1qciDcLtrrDjR1/efINdl6LGa1Dje5KZPAtWFbPyyLiGUs1xEtLzvr0bjmolf4sl6O3a/9BrLPbw9IbwJrQKczTKFfSWhaqFtHnXTM/otM6lR/JeRnE4vG8H0aZTT52uXQPJPYysOaehpSJOnoT81W9p/Jb+xQv2f4Kp01JyPdC+YbubERdwgpWbqzJp6frygofJ0V4E5RF5GPLLGLyxVJ5tX7YVJSnKZm2M7fL9HhiVkLW5JVyt2OKDlUorKMZGpK7DMmRNErhw6BN4yez56buIRFe9TnClEjPaheMUiDSoP7Uflfpy/MAVbvxhG4xfZnJgeT0ZS/XfFKwCe3Xlqk8McoLT09QGBmvsRvIjijslL0bIb8upG2AN/3k4vcJqBp2YDmyn9ynZ;24:YXJl+MY2WgAS4FbUwcfDeizT4uzeTczAdb2Z+oP+lQ8B/l26Qif7GxNIqYAQrZ+JzwjJ+tjz5ZQBmKih4+YfIUJDijB7XO1LZYIWk8ZAYns= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;CY1PR12MB0150;7:aaoLM9bBmFGUstC6gH2hISMv/qKxZ/rt8+ljfbhd8IsEvVffJ4J+1b+ebtsrUvjmxtuQC0g4QqO0jUsDP8RmhBlIG4xZgALsVtzP6ZicKc03CYKL42DXYwT5GNuapdUsCkumzC8zjng2Jc0whqNlxEplGDOt1Aj4vu/Edne0bd9onnmGfbQpMXYDNwDuWSH1sT4VkkSKjzrqlT3yP9IIU0Ga8MA306cUBTLm052exsP8H1w1EpzfZ7vHGdCVJS1PO671J9b2RlZ/Ehgd9/LjhuSJIKfU7NX0PRWF3iprcnw1CE/+HgQmc56T2CbOJUfNbhzpnzRg14koO/c7N5diDqUgvvBpDWv87pYU2YC+UoOl6S3IDuPKKERhAEOMAnTlhejgVVWSkX/SR+Faes1kX7ho+q0slF9BtGdUC8aOWBRSHlgH5BejdrMv747RVssDe8ooWw5tqGqFw1Os6olWeTr3vJgy7upU2QcfAPbr+K8svoCVvLwzNNsfAVqFUWSAMVmOWVPl47NiFEkTSnXN4g93LC+xiNMIDLSsb/ibPE+yQcEKJYCgpvh8ahV33ZcWxuAyIowIGa2HD9gOBxy/GRNe2+hcs9HHMMDP0PJhG/ZmOV5frkt2W4dYOj43clRWzjN0SZIwc7FZHyMslbOve9ADIHYBaa0s23I/0NSOBuFz6gsZWgWw/iJStwtBIKxTAOudNY2hZQVX8oYrU5sZuweZZ4rztTgjgkBQz4zAhuHylGxBPetXNX2cBXqFJzrALpfp8IoEvbcogabNow86Ts7uSYqczMvGQeIqp3+9Zoo= X-Microsoft-Exchange-Diagnostics: 1;CY1PR12MB0150;20:jHRU7e4hZd0k+8FylWc5lvk75ssF8HXJcxCORv6AoXyGD1VJpD0xNPvWUO9QGcP89f9k4kR5RMuuLxqjHYbSf9SR2lPO5Yuv74Oz/mOdjA61IXuhUv3mehWZfmz7uxkI6Do1v+eq78MjO5mIB8Fqr0ZlfGYdNSSxbc3FVjQQZzl/p+67HKJofkrUygBriaceWU4k6s3Cnv1HFG60XDGA30xuHwKDJ7578WpK0jhHrdDRhaM/dW4+kQh5PD/Qrn5L X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Jul 2017 19:08:39.0283 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR12MB0150 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Tom Lendacky Early in the boot process, add checks to determine if the kernel is running with Secure Encrypted Virtualization (SEV) active. Checking for SEV requires checking that the kernel is running under a hypervisor (CPUID 0x00000001, bit 31), that the SEV feature is available (CPUID 0x8000001f, bit 1) and then check a non-interceptable SEV MSR (0xc0010131, bit 0). This check is required so that during early compressed kernel booting the pagetables (both the boot pagetables and KASLR pagetables (if enabled) are updated to include the encryption mask so that when the kernel is decompressed into encrypted memory. After the kernel is decompressed and continues booting the same logic is used to check if SEV is active and set a flag indicating so. This allows us to distinguish between SME and SEV, each of which have unique differences in how certain things are handled: e.g. DMA (always bounce buffered with SEV) or EFI tables (always access decrypted with SME). Signed-off-by: Tom Lendacky Signed-off-by: Brijesh Singh --- arch/x86/boot/compressed/Makefile | 2 + arch/x86/boot/compressed/head_64.S | 16 +++++ arch/x86/boot/compressed/mem_encrypt.S | 103 +++++++++++++++++++++++++++++++++ arch/x86/boot/compressed/misc.h | 2 + arch/x86/boot/compressed/pagetable.c | 8 ++- arch/x86/include/asm/mem_encrypt.h | 3 + arch/x86/include/asm/msr-index.h | 3 + arch/x86/include/uapi/asm/kvm_para.h | 1 - arch/x86/mm/mem_encrypt.c | 42 +++++++++++--- 9 files changed, 169 insertions(+), 11 deletions(-) create mode 100644 arch/x86/boot/compressed/mem_encrypt.S diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile index 2c860ad..d2fe901 100644 --- a/arch/x86/boot/compressed/Makefile +++ b/arch/x86/boot/compressed/Makefile @@ -72,6 +72,8 @@ vmlinux-objs-y := $(obj)/vmlinux.lds $(obj)/head_$(BITS).o $(obj)/misc.o \ $(obj)/string.o $(obj)/cmdline.o $(obj)/error.o \ $(obj)/piggy.o $(obj)/cpuflags.o +vmlinux-objs-$(CONFIG_X86_64) += $(obj)/mem_encrypt.o + vmlinux-objs-$(CONFIG_EARLY_PRINTK) += $(obj)/early_serial_console.o vmlinux-objs-$(CONFIG_RANDOMIZE_BASE) += $(obj)/kaslr.o ifdef CONFIG_X86_64 diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S index fbf4c32..6179d43 100644 --- a/arch/x86/boot/compressed/head_64.S +++ b/arch/x86/boot/compressed/head_64.S @@ -130,6 +130,19 @@ ENTRY(startup_32) /* * Build early 4G boot pagetable */ + /* + * If SEV is active then set the encryption mask in the page tables. + * This will insure that when the kernel is copied and decompressed + * it will be done so encrypted. + */ + call get_sev_encryption_bit + xorl %edx, %edx + testl %eax, %eax + jz 1f + subl $32, %eax /* Encryption bit is always above bit 31 */ + bts %eax, %edx /* Set encryption mask for page tables */ +1: + /* Initialize Page tables to 0 */ leal pgtable(%ebx), %edi xorl %eax, %eax @@ -140,12 +153,14 @@ ENTRY(startup_32) leal pgtable + 0(%ebx), %edi leal 0x1007 (%edi), %eax movl %eax, 0(%edi) + addl %edx, 4(%edi) /* Build Level 3 */ leal pgtable + 0x1000(%ebx), %edi leal 0x1007(%edi), %eax movl $4, %ecx 1: movl %eax, 0x00(%edi) + addl %edx, 0x04(%edi) addl $0x00001000, %eax addl $8, %edi decl %ecx @@ -156,6 +171,7 @@ ENTRY(startup_32) movl $0x00000183, %eax movl $2048, %ecx 1: movl %eax, 0(%edi) + addl %edx, 4(%edi) addl $0x00200000, %eax addl $8, %edi decl %ecx diff --git a/arch/x86/boot/compressed/mem_encrypt.S b/arch/x86/boot/compressed/mem_encrypt.S new file mode 100644 index 0000000..696716e --- /dev/null +++ b/arch/x86/boot/compressed/mem_encrypt.S @@ -0,0 +1,103 @@ +/* + * AMD Memory Encryption Support + * + * Copyright (C) 2017 Advanced Micro Devices, Inc. + * + * Author: Tom Lendacky + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + */ + +#include + +#include +#include +#include + + .text + .code32 +ENTRY(get_sev_encryption_bit) + xor %eax, %eax + +#ifdef CONFIG_AMD_MEM_ENCRYPT + push %ebx + push %ecx + push %edx + + /* Check if running under a hypervisor */ + movl $1, %eax + cpuid + bt $31, %ecx /* Check the hypervisor bit */ + jnc .Lno_sev + + movl $0x80000000, %eax /* CPUID to check the highest leaf */ + cpuid + cmpl $0x8000001f, %eax /* See if 0x8000001f is available */ + jb .Lno_sev + + /* + * Check for the SEV feature: + * CPUID Fn8000_001F[EAX] - Bit 1 + * CPUID Fn8000_001F[EBX] - Bits 5:0 + * Pagetable bit position used to indicate encryption + */ + movl $0x8000001f, %eax + cpuid + bt $1, %eax /* Check if SEV is available */ + jnc .Lno_sev + + movl $MSR_F17H_SEV, %ecx /* Read the SEV MSR */ + rdmsr + bt $MSR_F17H_SEV_ENABLED_BIT, %eax /* Check if SEV is active */ + jnc .Lno_sev + + /* + * Get memory encryption information: + */ + movl %ebx, %eax + andl $0x3f, %eax /* Return the encryption bit location */ + jmp .Lsev_exit + +.Lno_sev: + xor %eax, %eax + +.Lsev_exit: + pop %edx + pop %ecx + pop %ebx + +#endif /* CONFIG_AMD_MEM_ENCRYPT */ + + ret +ENDPROC(get_sev_encryption_bit) + + .code64 +ENTRY(get_sev_encryption_mask) + xor %rax, %rax + +#ifdef CONFIG_AMD_MEM_ENCRYPT + push %rbp + push %rdx + + movq %rsp, %rbp /* Save current stack pointer */ + + call get_sev_encryption_bit /* Get the encryption bit position */ + testl %eax, %eax + jz .Lno_sev_mask + + xor %rdx, %rdx + bts %rax, %rdx /* Create the encryption mask */ + mov %rdx, %rax /* ... and return it */ + +.Lno_sev_mask: + movq %rbp, %rsp /* Restore original stack pointer */ + + pop %rdx + pop %rbp + +#endif + + ret +ENDPROC(get_sev_encryption_mask) diff --git a/arch/x86/boot/compressed/misc.h b/arch/x86/boot/compressed/misc.h index 766a521..38c5f0e 100644 --- a/arch/x86/boot/compressed/misc.h +++ b/arch/x86/boot/compressed/misc.h @@ -108,4 +108,6 @@ static inline void console_init(void) { } #endif +unsigned long get_sev_encryption_mask(void); + #endif diff --git a/arch/x86/boot/compressed/pagetable.c b/arch/x86/boot/compressed/pagetable.c index f1aa438..a577329 100644 --- a/arch/x86/boot/compressed/pagetable.c +++ b/arch/x86/boot/compressed/pagetable.c @@ -76,16 +76,18 @@ static unsigned long top_level_pgt; * Mapping information structure passed to kernel_ident_mapping_init(). * Due to relocation, pointers must be assigned at run time not build time. */ -static struct x86_mapping_info mapping_info = { - .page_flag = __PAGE_KERNEL_LARGE_EXEC, -}; +static struct x86_mapping_info mapping_info; /* Locates and clears a region for a new top level page table. */ void initialize_identity_maps(void) { + unsigned long sev_me_mask = get_sev_encryption_mask(); + /* Init mapping_info with run-time function/buffer pointers. */ mapping_info.alloc_pgt_page = alloc_pgt_page; mapping_info.context = &pgt_data; + mapping_info.page_flag = __PAGE_KERNEL_LARGE_EXEC | sev_me_mask; + mapping_info.kernpg_flag = _KERNPG_TABLE | sev_me_mask; /* * It should be impossible for this not to already be true, diff --git a/arch/x86/include/asm/mem_encrypt.h b/arch/x86/include/asm/mem_encrypt.h index 9274ec7..9cb6472 100644 --- a/arch/x86/include/asm/mem_encrypt.h +++ b/arch/x86/include/asm/mem_encrypt.h @@ -19,6 +19,9 @@ #include +#define AMD_SME_FEATURE_BIT BIT(0) +#define AMD_SEV_FEATURE_BIT BIT(1) + #ifdef CONFIG_AMD_MEM_ENCRYPT extern unsigned long sme_me_mask; diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h index e399d68..530020f 100644 --- a/arch/x86/include/asm/msr-index.h +++ b/arch/x86/include/asm/msr-index.h @@ -326,6 +326,9 @@ /* Fam 17h MSRs */ #define MSR_F17H_IRPERF 0xc00000e9 +#define MSR_F17H_SEV 0xc0010131 +#define MSR_F17H_SEV_ENABLED_BIT 0 +#define MSR_F17H_SEV_ENABLED BIT_ULL(MSR_F17H_SEV_ENABLED_BIT) /* Fam 16h MSRs */ #define MSR_F16H_L2I_PERF_CTL 0xc0010230 diff --git a/arch/x86/include/uapi/asm/kvm_para.h b/arch/x86/include/uapi/asm/kvm_para.h index a965e5b..c202ba3 100644 --- a/arch/x86/include/uapi/asm/kvm_para.h +++ b/arch/x86/include/uapi/asm/kvm_para.h @@ -109,5 +109,4 @@ struct kvm_vcpu_pv_apf_data { #define KVM_PV_EOI_ENABLED KVM_PV_EOI_MASK #define KVM_PV_EOI_DISABLED 0x0 - #endif /* _UAPI_ASM_X86_KVM_PARA_H */ diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c index 5e5d460..ed8780e 100644 --- a/arch/x86/mm/mem_encrypt.c +++ b/arch/x86/mm/mem_encrypt.c @@ -288,7 +288,9 @@ void __init mem_encrypt_init(void) if (sev_active()) dma_ops = &sme_dma_ops; - pr_info("AMD Secure Memory Encryption (SME) active\n"); + pr_info("AMD %s active\n", + sev_active() ? "Secure Encrypted Virtualization (SEV)" + : "Secure Memory Encryption (SME)"); } void swiotlb_set_mem_attributes(void *vaddr, unsigned long size) @@ -616,12 +618,23 @@ void __init __nostackprotector sme_enable(struct boot_params *bp) { const char *cmdline_ptr, *cmdline_arg, *cmdline_on, *cmdline_off; unsigned int eax, ebx, ecx, edx; + unsigned long feature_mask; bool active_by_default; unsigned long me_mask; char buffer[16]; u64 msr; - /* Check for the SME support leaf */ + /* + * Set the feature mask (SME or SEV) based on whether we are + * running under a hypervisor. + */ + eax = 1; + ecx = 0; + native_cpuid(&eax, &ebx, &ecx, &edx); + feature_mask = (ecx & BIT(31)) ? AMD_SEV_FEATURE_BIT + : AMD_SME_FEATURE_BIT; + + /* Check for the SME/SEV support leaf */ eax = 0x80000000; ecx = 0; native_cpuid(&eax, &ebx, &ecx, &edx); @@ -629,24 +642,39 @@ void __init __nostackprotector sme_enable(struct boot_params *bp) return; /* - * Check for the SME feature: + * Check for the SME/SEV feature: * CPUID Fn8000_001F[EAX] - Bit 0 * Secure Memory Encryption support + * CPUID Fn8000_001F[EAX] - Bit 1 + * Secure Encrypted Virtualization support * CPUID Fn8000_001F[EBX] - Bits 5:0 * Pagetable bit position used to indicate encryption */ eax = 0x8000001f; ecx = 0; native_cpuid(&eax, &ebx, &ecx, &edx); - if (!(eax & 1)) + if (!(eax & feature_mask)) return; me_mask = 1UL << (ebx & 0x3f); - /* Check if SME is enabled */ - msr = __rdmsr(MSR_K8_SYSCFG); - if (!(msr & MSR_K8_SYSCFG_MEM_ENCRYPT)) + /* Check if memory encryption is enabled */ + if (feature_mask == AMD_SME_FEATURE_BIT) { + /* For SME, check the SYSCFG MSR */ + msr = __rdmsr(MSR_K8_SYSCFG); + if (!(msr & MSR_K8_SYSCFG_MEM_ENCRYPT)) + return; + } else { + /* For SEV, check the SEV MSR */ + msr = __rdmsr(MSR_F17H_SEV); + if (!(msr & MSR_F17H_SEV_ENABLED)) + return; + + /* SEV state cannot be controlled by a command line option */ + sme_me_mask = me_mask; + sev_enabled = 1; return; + } /* * Fixups have not been applied to phys_base yet and we're running -- 2.9.4 From mboxrd@z Thu Jan 1 00:00:00 1970 From: Brijesh Singh Subject: [RFC Part1 PATCH v3 14/17] x86/boot: Add early boot support when running with SEV active Date: Mon, 24 Jul 2017 14:07:54 -0500 Message-ID: <20170724190757.11278-15-brijesh.singh@amd.com> References: <20170724190757.11278-1-brijesh.singh@amd.com> Mime-Version: 1.0 Content-Type: text/plain Return-path: In-Reply-To: <20170724190757.11278-1-brijesh.singh-5C7GfCeVMHo@public.gmane.org> Sender: linux-efi-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, x86-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org, linux-efi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linuxppc-dev-uLR06cmDAlY/bJ5BZ2RsiQ@public.gmane.org, kvm-u79uwXL29TY76Z2rM5mHXA@public.gmane.org Cc: Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , Borislav Petkov , Andy Lutomirski , Tony Luck , Piotr Luc , Tom Lendacky , Fenghua Yu , Lu Baolu , Reza Arbab , David Howells , Matt Fleming , "Kirill A . Shutemov" , Laura Abbott , Ard Biesheuvel , Andrew Morton , Eric Biederman , Benjamin Herrenschmidt Paul Mackerras

List-Id: linux-efi@vger.kernel.org From: Tom Lendacky Early in the boot process, add checks to determine if the kernel is running with Secure Encrypted Virtualization (SEV) active. Checking for SEV requires checking that the kernel is running under a hypervisor (CPUID 0x00000001, bit 31), that the SEV feature is available (CPUID 0x8000001f, bit 1) and then check a non-interceptable SEV MSR (0xc0010131, bit 0). This check is required so that during early compressed kernel booting the pagetables (both the boot pagetables and KASLR pagetables (if enabled) are updated to include the encryption mask so that when the kernel is decompressed into encrypted memory. After the kernel is decompressed and continues booting the same logic is used to check if SEV is active and set a flag indicating so. This allows us to distinguish between SME and SEV, each of which have unique differences in how certain things are handled: e.g. DMA (always bounce buffered with SEV) or EFI tables (always access decrypted with SME). Signed-off-by: Tom Lendacky Signed-off-by: Brijesh Singh --- arch/x86/boot/compressed/Makefile | 2 + arch/x86/boot/compressed/head_64.S | 16 +++++ arch/x86/boot/compressed/mem_encrypt.S | 103 +++++++++++++++++++++++++++++++++ arch/x86/boot/compressed/misc.h | 2 + arch/x86/boot/compressed/pagetable.c | 8 ++- arch/x86/include/asm/mem_encrypt.h | 3 + arch/x86/include/asm/msr-index.h | 3 + arch/x86/include/uapi/asm/kvm_para.h | 1 - arch/x86/mm/mem_encrypt.c | 42 +++++++++++--- 9 files changed, 169 insertions(+), 11 deletions(-) create mode 100644 arch/x86/boot/compressed/mem_encrypt.S diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile index 2c860ad..d2fe901 100644 --- a/arch/x86/boot/compressed/Makefile +++ b/arch/x86/boot/compressed/Makefile @@ -72,6 +72,8 @@ vmlinux-objs-y := $(obj)/vmlinux.lds $(obj)/head_$(BITS).o $(obj)/misc.o \ $(obj)/string.o $(obj)/cmdline.o $(obj)/error.o \ $(obj)/piggy.o $(obj)/cpuflags.o +vmlinux-objs-$(CONFIG_X86_64) += $(obj)/mem_encrypt.o + vmlinux-objs-$(CONFIG_EARLY_PRINTK) += $(obj)/early_serial_console.o vmlinux-objs-$(CONFIG_RANDOMIZE_BASE) += $(obj)/kaslr.o ifdef CONFIG_X86_64 diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S index fbf4c32..6179d43 100644 --- a/arch/x86/boot/compressed/head_64.S +++ b/arch/x86/boot/compressed/head_64.S @@ -130,6 +130,19 @@ ENTRY(startup_32) /* * Build early 4G boot pagetable */ + /* + * If SEV is active then set the encryption mask in the page tables. + * This will insure that when the kernel is copied and decompressed + * it will be done so encrypted. + */ + call get_sev_encryption_bit + xorl %edx, %edx + testl %eax, %eax + jz 1f + subl $32, %eax /* Encryption bit is always above bit 31 */ + bts %eax, %edx /* Set encryption mask for page tables */ +1: + /* Initialize Page tables to 0 */ leal pgtable(%ebx), %edi xorl %eax, %eax @@ -140,12 +153,14 @@ ENTRY(startup_32) leal pgtable + 0(%ebx), %edi leal 0x1007 (%edi), %eax movl %eax, 0(%edi) + addl %edx, 4(%edi) /* Build Level 3 */ leal pgtable + 0x1000(%ebx), %edi leal 0x1007(%edi), %eax movl $4, %ecx 1: movl %eax, 0x00(%edi) + addl %edx, 0x04(%edi) addl $0x00001000, %eax addl $8, %edi decl %ecx @@ -156,6 +171,7 @@ ENTRY(startup_32) movl $0x00000183, %eax movl $2048, %ecx 1: movl %eax, 0(%edi) + addl %edx, 4(%edi) addl $0x00200000, %eax addl $8, %edi decl %ecx diff --git a/arch/x86/boot/compressed/mem_encrypt.S b/arch/x86/boot/compressed/mem_encrypt.S new file mode 100644 index 0000000..696716e --- /dev/null +++ b/arch/x86/boot/compressed/mem_encrypt.S @@ -0,0 +1,103 @@ +/* + * AMD Memory Encryption Support + * + * Copyright (C) 2017 Advanced Micro Devices, Inc. + * + * Author: Tom Lendacky + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + */ + +#include + +#include +#include +#include + + .text + .code32 +ENTRY(get_sev_encryption_bit) + xor %eax, %eax + +#ifdef CONFIG_AMD_MEM_ENCRYPT + push %ebx + push %ecx + push %edx + + /* Check if running under a hypervisor */ + movl $1, %eax + cpuid + bt $31, %ecx /* Check the hypervisor bit */ + jnc .Lno_sev + + movl $0x80000000, %eax /* CPUID to check the highest leaf */ + cpuid + cmpl $0x8000001f, %eax /* See if 0x8000001f is available */ + jb .Lno_sev + + /* + * Check for the SEV feature: + * CPUID Fn8000_001F[EAX] - Bit 1 + * CPUID Fn8000_001F[EBX] - Bits 5:0 + * Pagetable bit position used to indicate encryption + */ + movl $0x8000001f, %eax + cpuid + bt $1, %eax /* Check if SEV is available */ + jnc .Lno_sev + + movl $MSR_F17H_SEV, %ecx /* Read the SEV MSR */ + rdmsr + bt $MSR_F17H_SEV_ENABLED_BIT, %eax /* Check if SEV is active */ + jnc .Lno_sev + + /* + * Get memory encryption information: + */ + movl %ebx, %eax + andl $0x3f, %eax /* Return the encryption bit location */ + jmp .Lsev_exit + +.Lno_sev: + xor %eax, %eax + +.Lsev_exit: + pop %edx + pop %ecx + pop %ebx + +#endif /* CONFIG_AMD_MEM_ENCRYPT */ + + ret +ENDPROC(get_sev_encryption_bit) + + .code64 +ENTRY(get_sev_encryption_mask) + xor %rax, %rax + +#ifdef CONFIG_AMD_MEM_ENCRYPT + push %rbp + push %rdx + + movq %rsp, %rbp /* Save current stack pointer */ + + call get_sev_encryption_bit /* Get the encryption bit position */ + testl %eax, %eax + jz .Lno_sev_mask + + xor %rdx, %rdx + bts %rax, %rdx /* Create the encryption mask */ + mov %rdx, %rax /* ... and return it */ + +.Lno_sev_mask: + movq %rbp, %rsp /* Restore original stack pointer */ + + pop %rdx + pop %rbp + +#endif + + ret +ENDPROC(get_sev_encryption_mask) diff --git a/arch/x86/boot/compressed/misc.h b/arch/x86/boot/compressed/misc.h index 766a521..38c5f0e 100644 --- a/arch/x86/boot/compressed/misc.h +++ b/arch/x86/boot/compressed/misc.h @@ -108,4 +108,6 @@ static inline void console_init(void) { } #endif +unsigned long get_sev_encryption_mask(void); + #endif diff --git a/arch/x86/boot/compressed/pagetable.c b/arch/x86/boot/compressed/pagetable.c index f1aa438..a577329 100644 --- a/arch/x86/boot/compressed/pagetable.c +++ b/arch/x86/boot/compressed/pagetable.c @@ -76,16 +76,18 @@ static unsigned long top_level_pgt; * Mapping information structure passed to kernel_ident_mapping_init(). * Due to relocation, pointers must be assigned at run time not build time. */ -static struct x86_mapping_info mapping_info = { - .page_flag = __PAGE_KERNEL_LARGE_EXEC, -}; +static struct x86_mapping_info mapping_info; /* Locates and clears a region for a new top level page table. */ void initialize_identity_maps(void) { + unsigned long sev_me_mask = get_sev_encryption_mask(); + /* Init mapping_info with run-time function/buffer pointers. */ mapping_info.alloc_pgt_page = alloc_pgt_page; mapping_info.context = &pgt_data; + mapping_info.page_flag = __PAGE_KERNEL_LARGE_EXEC | sev_me_mask; + mapping_info.kernpg_flag = _KERNPG_TABLE | sev_me_mask; /* * It should be impossible for this not to already be true, diff --git a/arch/x86/include/asm/mem_encrypt.h b/arch/x86/include/asm/mem_encrypt.h index 9274ec7..9cb6472 100644 --- a/arch/x86/include/asm/mem_encrypt.h +++ b/arch/x86/include/asm/mem_encrypt.h @@ -19,6 +19,9 @@ #include +#define AMD_SME_FEATURE_BIT BIT(0) +#define AMD_SEV_FEATURE_BIT BIT(1) + #ifdef CONFIG_AMD_MEM_ENCRYPT extern unsigned long sme_me_mask; diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h index e399d68..530020f 100644 --- a/arch/x86/include/asm/msr-index.h +++ b/arch/x86/include/asm/msr-index.h @@ -326,6 +326,9 @@ /* Fam 17h MSRs */ #define MSR_F17H_IRPERF 0xc00000e9 +#define MSR_F17H_SEV 0xc0010131 +#define MSR_F17H_SEV_ENABLED_BIT 0 +#define MSR_F17H_SEV_ENABLED BIT_ULL(MSR_F17H_SEV_ENABLED_BIT) /* Fam 16h MSRs */ #define MSR_F16H_L2I_PERF_CTL 0xc0010230 diff --git a/arch/x86/include/uapi/asm/kvm_para.h b/arch/x86/include/uapi/asm/kvm_para.h index a965e5b..c202ba3 100644 --- a/arch/x86/include/uapi/asm/kvm_para.h +++ b/arch/x86/include/uapi/asm/kvm_para.h @@ -109,5 +109,4 @@ struct kvm_vcpu_pv_apf_data { #define KVM_PV_EOI_ENABLED KVM_PV_EOI_MASK #define KVM_PV_EOI_DISABLED 0x0 - #endif /* _UAPI_ASM_X86_KVM_PARA_H */ diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c index 5e5d460..ed8780e 100644 --- a/arch/x86/mm/mem_encrypt.c +++ b/arch/x86/mm/mem_encrypt.c @@ -288,7 +288,9 @@ void __init mem_encrypt_init(void) if (sev_active()) dma_ops = &sme_dma_ops; - pr_info("AMD Secure Memory Encryption (SME) active\n"); + pr_info("AMD %s active\n", + sev_active() ? "Secure Encrypted Virtualization (SEV)" + : "Secure Memory Encryption (SME)"); } void swiotlb_set_mem_attributes(void *vaddr, unsigned long size) @@ -616,12 +618,23 @@ void __init __nostackprotector sme_enable(struct boot_params *bp) { const char *cmdline_ptr, *cmdline_arg, *cmdline_on, *cmdline_off; unsigned int eax, ebx, ecx, edx; + unsigned long feature_mask; bool active_by_default; unsigned long me_mask; char buffer[16]; u64 msr; - /* Check for the SME support leaf */ + /* + * Set the feature mask (SME or SEV) based on whether we are + * running under a hypervisor. + */ + eax = 1; + ecx = 0; + native_cpuid(&eax, &ebx, &ecx, &edx); + feature_mask = (ecx & BIT(31)) ? AMD_SEV_FEATURE_BIT + : AMD_SME_FEATURE_BIT; + + /* Check for the SME/SEV support leaf */ eax = 0x80000000; ecx = 0; native_cpuid(&eax, &ebx, &ecx, &edx); @@ -629,24 +642,39 @@ void __init __nostackprotector sme_enable(struct boot_params *bp) return; /* - * Check for the SME feature: + * Check for the SME/SEV feature: * CPUID Fn8000_001F[EAX] - Bit 0 * Secure Memory Encryption support + * CPUID Fn8000_001F[EAX] - Bit 1 + * Secure Encrypted Virtualization support * CPUID Fn8000_001F[EBX] - Bits 5:0 * Pagetable bit position used to indicate encryption */ eax = 0x8000001f; ecx = 0; native_cpuid(&eax, &ebx, &ecx, &edx); - if (!(eax & 1)) + if (!(eax & feature_mask)) return; me_mask = 1UL << (ebx & 0x3f); - /* Check if SME is enabled */ - msr = __rdmsr(MSR_K8_SYSCFG); - if (!(msr & MSR_K8_SYSCFG_MEM_ENCRYPT)) + /* Check if memory encryption is enabled */ + if (feature_mask == AMD_SME_FEATURE_BIT) { + /* For SME, check the SYSCFG MSR */ + msr = __rdmsr(MSR_K8_SYSCFG); + if (!(msr & MSR_K8_SYSCFG_MEM_ENCRYPT)) + return; + } else { + /* For SEV, check the SEV MSR */ + msr = __rdmsr(MSR_F17H_SEV); + if (!(msr & MSR_F17H_SEV_ENABLED)) + return; + + /* SEV state cannot be controlled by a command line option */ + sme_me_mask = me_mask; + sev_enabled = 1; return; + } /* * Fixups have not been applied to phys_base yet and we're running -- 2.9.4 From mboxrd@z Thu Jan 1 00:00:00 1970 From: Brijesh Singh Subject: [RFC Part1 PATCH v3 14/17] x86/boot: Add early boot support when running with SEV active Date: Mon, 24 Jul 2017 14:07:54 -0500 Message-ID: <20170724190757.11278-15-brijesh.singh@amd.com> References: <20170724190757.11278-1-brijesh.singh@amd.com> Mime-Version: 1.0 Content-Type: text/plain Cc: Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , Borislav Petkov , Andy Lutomirski , Tony Luck , Piotr Luc , Tom Lendacky , Fenghua Yu , Lu Baolu , Reza Arbab , David Howells , Matt Fleming , "Kirill A . Shutemov" , Laura Abbott , Ard Biesheuvel , Andrew Morton , Eric Biederman , Benjamin Herrenschmidt , Paul Mackerras

In-Reply-To: <20170724190757.11278-1-brijesh.singh-5C7GfCeVMHo@public.gmane.org> Sender: linux-efi-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org List-Id: kvm.vger.kernel.org From: Tom Lendacky Early in the boot process, add checks to determine if the kernel is running with Secure Encrypted Virtualization (SEV) active. Checking for SEV requires checking that the kernel is running under a hypervisor (CPUID 0x00000001, bit 31), that the SEV feature is available (CPUID 0x8000001f, bit 1) and then check a non-interceptable SEV MSR (0xc0010131, bit 0). This check is required so that during early compressed kernel booting the pagetables (both the boot pagetables and KASLR pagetables (if enabled) are updated to include the encryption mask so that when the kernel is decompressed into encrypted memory. After the kernel is decompressed and continues booting the same logic is used to check if SEV is active and set a flag indicating so. This allows us to distinguish between SME and SEV, each of which have unique differences in how certain things are handled: e.g. DMA (always bounce buffered with SEV) or EFI tables (always access decrypted with SME). Signed-off-by: Tom Lendacky Signed-off-by: Brijesh Singh --- arch/x86/boot/compressed/Makefile | 2 + arch/x86/boot/compressed/head_64.S | 16 +++++ arch/x86/boot/compressed/mem_encrypt.S | 103 +++++++++++++++++++++++++++++++++ arch/x86/boot/compressed/misc.h | 2 + arch/x86/boot/compressed/pagetable.c | 8 ++- arch/x86/include/asm/mem_encrypt.h | 3 + arch/x86/include/asm/msr-index.h | 3 + arch/x86/include/uapi/asm/kvm_para.h | 1 - arch/x86/mm/mem_encrypt.c | 42 +++++++++++--- 9 files changed, 169 insertions(+), 11 deletions(-) create mode 100644 arch/x86/boot/compressed/mem_encrypt.S diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile index 2c860ad..d2fe901 100644 --- a/arch/x86/boot/compressed/Makefile +++ b/arch/x86/boot/compressed/Makefile @@ -72,6 +72,8 @@ vmlinux-objs-y := $(obj)/vmlinux.lds $(obj)/head_$(BITS).o $(obj)/misc.o \ $(obj)/string.o $(obj)/cmdline.o $(obj)/error.o \ $(obj)/piggy.o $(obj)/cpuflags.o +vmlinux-objs-$(CONFIG_X86_64) += $(obj)/mem_encrypt.o + vmlinux-objs-$(CONFIG_EARLY_PRINTK) += $(obj)/early_serial_console.o vmlinux-objs-$(CONFIG_RANDOMIZE_BASE) += $(obj)/kaslr.o ifdef CONFIG_X86_64 diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S index fbf4c32..6179d43 100644 --- a/arch/x86/boot/compressed/head_64.S +++ b/arch/x86/boot/compressed/head_64.S @@ -130,6 +130,19 @@ ENTRY(startup_32) /* * Build early 4G boot pagetable */ + /* + * If SEV is active then set the encryption mask in the page tables. + * This will insure that when the kernel is copied and decompressed + * it will be done so encrypted. + */ + call get_sev_encryption_bit + xorl %edx, %edx + testl %eax, %eax + jz 1f + subl $32, %eax /* Encryption bit is always above bit 31 */ + bts %eax, %edx /* Set encryption mask for page tables */ +1: + /* Initialize Page tables to 0 */ leal pgtable(%ebx), %edi xorl %eax, %eax @@ -140,12 +153,14 @@ ENTRY(startup_32) leal pgtable + 0(%ebx), %edi leal 0x1007 (%edi), %eax movl %eax, 0(%edi) + addl %edx, 4(%edi) /* Build Level 3 */ leal pgtable + 0x1000(%ebx), %edi leal 0x1007(%edi), %eax movl $4, %ecx 1: movl %eax, 0x00(%edi) + addl %edx, 0x04(%edi) addl $0x00001000, %eax addl $8, %edi decl %ecx @@ -156,6 +171,7 @@ ENTRY(startup_32) movl $0x00000183, %eax movl $2048, %ecx 1: movl %eax, 0(%edi) + addl %edx, 4(%edi) addl $0x00200000, %eax addl $8, %edi decl %ecx diff --git a/arch/x86/boot/compressed/mem_encrypt.S b/arch/x86/boot/compressed/mem_encrypt.S new file mode 100644 index 0000000..696716e --- /dev/null +++ b/arch/x86/boot/compressed/mem_encrypt.S @@ -0,0 +1,103 @@ +/* + * AMD Memory Encryption Support + * + * Copyright (C) 2017 Advanced Micro Devices, Inc. + * + * Author: Tom Lendacky + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + */ + +#include + +#include +#include +#include + + .text + .code32 +ENTRY(get_sev_encryption_bit) + xor %eax, %eax + +#ifdef CONFIG_AMD_MEM_ENCRYPT + push %ebx + push %ecx + push %edx + + /* Check if running under a hypervisor */ + movl $1, %eax + cpuid + bt $31, %ecx /* Check the hypervisor bit */ + jnc .Lno_sev + + movl $0x80000000, %eax /* CPUID to check the highest leaf */ + cpuid + cmpl $0x8000001f, %eax /* See if 0x8000001f is available */ + jb .Lno_sev + + /* + * Check for the SEV feature: + * CPUID Fn8000_001F[EAX] - Bit 1 + * CPUID Fn8000_001F[EBX] - Bits 5:0 + * Pagetable bit position used to indicate encryption + */ + movl $0x8000001f, %eax + cpuid + bt $1, %eax /* Check if SEV is available */ + jnc .Lno_sev + + movl $MSR_F17H_SEV, %ecx /* Read the SEV MSR */ + rdmsr + bt $MSR_F17H_SEV_ENABLED_BIT, %eax /* Check if SEV is active */ + jnc .Lno_sev + + /* + * Get memory encryption information: + */ + movl %ebx, %eax + andl $0x3f, %eax /* Return the encryption bit location */ + jmp .Lsev_exit + +.Lno_sev: + xor %eax, %eax + +.Lsev_exit: + pop %edx + pop %ecx + pop %ebx + +#endif /* CONFIG_AMD_MEM_ENCRYPT */ + + ret +ENDPROC(get_sev_encryption_bit) + + .code64 +ENTRY(get_sev_encryption_mask) + xor %rax, %rax + +#ifdef CONFIG_AMD_MEM_ENCRYPT + push %rbp + push %rdx + + movq %rsp, %rbp /* Save current stack pointer */ + + call get_sev_encryption_bit /* Get the encryption bit position */ + testl %eax, %eax + jz .Lno_sev_mask + + xor %rdx, %rdx + bts %rax, %rdx /* Create the encryption mask */ + mov %rdx, %rax /* ... and return it */ + +.Lno_sev_mask: + movq %rbp, %rsp /* Restore original stack pointer */ + + pop %rdx + pop %rbp + +#endif + + ret +ENDPROC(get_sev_encryption_mask) diff --git a/arch/x86/boot/compressed/misc.h b/arch/x86/boot/compressed/misc.h index 766a521..38c5f0e 100644 --- a/arch/x86/boot/compressed/misc.h +++ b/arch/x86/boot/compressed/misc.h @@ -108,4 +108,6 @@ static inline void console_init(void) { } #endif +unsigned long get_sev_encryption_mask(void); + #endif diff --git a/arch/x86/boot/compressed/pagetable.c b/arch/x86/boot/compressed/pagetable.c index f1aa438..a577329 100644 --- a/arch/x86/boot/compressed/pagetable.c +++ b/arch/x86/boot/compressed/pagetable.c @@ -76,16 +76,18 @@ static unsigned long top_level_pgt; * Mapping information structure passed to kernel_ident_mapping_init(). * Due to relocation, pointers must be assigned at run time not build time. */ -static struct x86_mapping_info mapping_info = { - .page_flag = __PAGE_KERNEL_LARGE_EXEC, -}; +static struct x86_mapping_info mapping_info; /* Locates and clears a region for a new top level page table. */ void initialize_identity_maps(void) { + unsigned long sev_me_mask = get_sev_encryption_mask(); + /* Init mapping_info with run-time function/buffer pointers. */ mapping_info.alloc_pgt_page = alloc_pgt_page; mapping_info.context = &pgt_data; + mapping_info.page_flag = __PAGE_KERNEL_LARGE_EXEC | sev_me_mask; + mapping_info.kernpg_flag = _KERNPG_TABLE | sev_me_mask; /* * It should be impossible for this not to already be true, diff --git a/arch/x86/include/asm/mem_encrypt.h b/arch/x86/include/asm/mem_encrypt.h index 9274ec7..9cb6472 100644 --- a/arch/x86/include/asm/mem_encrypt.h +++ b/arch/x86/include/asm/mem_encrypt.h @@ -19,6 +19,9 @@ #include +#define AMD_SME_FEATURE_BIT BIT(0) +#define AMD_SEV_FEATURE_BIT BIT(1) + #ifdef CONFIG_AMD_MEM_ENCRYPT extern unsigned long sme_me_mask; diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h index e399d68..530020f 100644 --- a/arch/x86/include/asm/msr-index.h +++ b/arch/x86/include/asm/msr-index.h @@ -326,6 +326,9 @@ /* Fam 17h MSRs */ #define MSR_F17H_IRPERF 0xc00000e9 +#define MSR_F17H_SEV 0xc0010131 +#define MSR_F17H_SEV_ENABLED_BIT 0 +#define MSR_F17H_SEV_ENABLED BIT_ULL(MSR_F17H_SEV_ENABLED_BIT) /* Fam 16h MSRs */ #define MSR_F16H_L2I_PERF_CTL 0xc0010230 diff --git a/arch/x86/include/uapi/asm/kvm_para.h b/arch/x86/include/uapi/asm/kvm_para.h index a965e5b..c202ba3 100644 --- a/arch/x86/include/uapi/asm/kvm_para.h +++ b/arch/x86/include/uapi/asm/kvm_para.h @@ -109,5 +109,4 @@ struct kvm_vcpu_pv_apf_data { #define KVM_PV_EOI_ENABLED KVM_PV_EOI_MASK #define KVM_PV_EOI_DISABLED 0x0 - #endif /* _UAPI_ASM_X86_KVM_PARA_H */ diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c index 5e5d460..ed8780e 100644 --- a/arch/x86/mm/mem_encrypt.c +++ b/arch/x86/mm/mem_encrypt.c @@ -288,7 +288,9 @@ void __init mem_encrypt_init(void) if (sev_active()) dma_ops = &sme_dma_ops; - pr_info("AMD Secure Memory Encryption (SME) active\n"); + pr_info("AMD %s active\n", + sev_active() ? "Secure Encrypted Virtualization (SEV)" + : "Secure Memory Encryption (SME)"); } void swiotlb_set_mem_attributes(void *vaddr, unsigned long size) @@ -616,12 +618,23 @@ void __init __nostackprotector sme_enable(struct boot_params *bp) { const char *cmdline_ptr, *cmdline_arg, *cmdline_on, *cmdline_off; unsigned int eax, ebx, ecx, edx; + unsigned long feature_mask; bool active_by_default; unsigned long me_mask; char buffer[16]; u64 msr; - /* Check for the SME support leaf */ + /* + * Set the feature mask (SME or SEV) based on whether we are + * running under a hypervisor. + */ + eax = 1; + ecx = 0; + native_cpuid(&eax, &ebx, &ecx, &edx); + feature_mask = (ecx & BIT(31)) ? AMD_SEV_FEATURE_BIT + : AMD_SME_FEATURE_BIT; + + /* Check for the SME/SEV support leaf */ eax = 0x80000000; ecx = 0; native_cpuid(&eax, &ebx, &ecx, &edx); @@ -629,24 +642,39 @@ void __init __nostackprotector sme_enable(struct boot_params *bp) return; /* - * Check for the SME feature: + * Check for the SME/SEV feature: * CPUID Fn8000_001F[EAX] - Bit 0 * Secure Memory Encryption support + * CPUID Fn8000_001F[EAX] - Bit 1 + * Secure Encrypted Virtualization support * CPUID Fn8000_001F[EBX] - Bits 5:0 * Pagetable bit position used to indicate encryption */ eax = 0x8000001f; ecx = 0; native_cpuid(&eax, &ebx, &ecx, &edx); - if (!(eax & 1)) + if (!(eax & feature_mask)) return; me_mask = 1UL << (ebx & 0x3f); - /* Check if SME is enabled */ - msr = __rdmsr(MSR_K8_SYSCFG); - if (!(msr & MSR_K8_SYSCFG_MEM_ENCRYPT)) + /* Check if memory encryption is enabled */ + if (feature_mask == AMD_SME_FEATURE_BIT) { + /* For SME, check the SYSCFG MSR */ + msr = __rdmsr(MSR_K8_SYSCFG); + if (!(msr & MSR_K8_SYSCFG_MEM_ENCRYPT)) + return; + } else { + /* For SEV, check the SEV MSR */ + msr = __rdmsr(MSR_F17H_SEV); + if (!(msr & MSR_F17H_SEV_ENABLED)) + return; + + /* SEV state cannot be controlled by a command line option */ + sme_me_mask = me_mask; + sev_enabled = 1; return; + } /* * Fixups have not been applied to phys_base yet and we're running -- 2.9.4