From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933774AbcECPze (ORCPT ); Tue, 3 May 2016 11:55:34 -0400 Received: from mail-by2on0097.outbound.protection.outlook.com ([207.46.100.97]:39568 "EHLO na01-by2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S933487AbcECPza (ORCPT ); Tue, 3 May 2016 11:55:30 -0400 Authentication-Results: amd.com; dkim=none (message not signed) header.d=none;amd.com; dmarc=none action=none header.from=amd.com; Subject: Re: [RFC PATCH v1 00/18] x86: Secure Memory Encryption (AMD) To: "Elliott, Robert (Persistent Memory)" , "linux-arch@vger.kernel.org" , "linux-efi@vger.kernel.org" , "kvm@vger.kernel.org" , "linux-doc@vger.kernel.org" , "x86@kernel.org" , "linux-kernel@vger.kernel.org" , "kasan-dev@googlegroups.com" , "linux-mm@kvack.org" , "iommu@lists.linux-foundation.org" References: <20160426225553.13567.19459.stgit@tlendack-t1.amdoffice.net> <94D0CD8314A33A4D9D801C0FE68B402963918FDA@G4W3296.americas.hpqcorp.net> CC: =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , Arnd Bergmann , Jonathan Corbet , Matt Fleming , Joerg Roedel , "Konrad Rzeszutek Wilk" , Paolo Bonzini , "Ingo Molnar" , Borislav Petkov , "H. Peter Anvin" , Andrey Ryabinin , "Alexander Potapenko" , Thomas Gleixner , "Dmitry Vyukov" From: Tom Lendacky Message-ID: <5728C9E1.3050803@amd.com> Date: Tue, 3 May 2016 10:55:13 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.6.0 MIME-Version: 1.0 In-Reply-To: <94D0CD8314A33A4D9D801C0FE68B402963918FDA@G4W3296.americas.hpqcorp.net> Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-Originating-IP: [165.204.77.1] X-ClientProxiedBy: CY1PR14CA0032.namprd14.prod.outlook.com (10.163.13.170) To BN3PR1201MB1108.namprd12.prod.outlook.com (10.165.77.20) X-MS-Office365-Filtering-Correlation-Id: 6a01a08f-97e6-4a27-32fd-08d3736b57b2 X-Microsoft-Exchange-Diagnostics: 1;BN3PR1201MB1108;2:omduuU+vK/+Npttty8c31cRDZr/QqmrjsE4uMYgyyM9vLupXV7hslXY6q26/tp1j2nxAPhcSMArGA8sZYbaYAHf7jl04r3FrWZNQUirW/HcQN1czQYL7RSZ1tQVaCOGmvX9ApaQg/OsO7mwXIn1zLjgGAz8Y4jQhfHWeWaGjJ7ZoiWn0SXL0KrUmjkwjNqKd;3:xEYP2oy2XDNxabpeuJONb0fTqNkoGXC4kwz0uRWCUcoChEz5489kHaUP4qzQR0dQQJNp0lzF8Y7GeXTDj5WA+Ch01vNpOQ/tzbvUyTvkWcULLNyOUkc8HcwfR0qZxnSs;25:ieFAjlhvypTAchlHRTc0OQsyU1GefOy03Rd/PlLB+8/0hmaVq1p65F6+WMrrHkryrn7TABYiVrEPpxiVGox9e2Z5JgBeJ4Q5wNVmxOMLwl8HcprRmEff2Jj1xwl5rwDfm9ATdd8vVMZKeZ0CbfvSVpAbABhtJ5vexkBLU8y1nCv0e2Tqgjh1aOn/8g8E4sHL4PQA42IgKn/I/aDnDOwIkfs4aWOpvtLTStqZ9GgyxZQKZkan8lcGVWM1Ig/lLkeh3d5R/5KoAQwFoWq+hCiMa7GjOLdvYBw+Beupr6WtsxME8/ZdDYx+kjf3d9ZeJ74DC+sb3nnxqTp0cI1etTo1Cg== X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BN3PR1201MB1108; X-Microsoft-Exchange-Diagnostics: 1;BN3PR1201MB1108;20:c/WtTPbcr1ZEhremY6RBVXRhEP6MWafDZzEaeFH9sm2l03dVGcdX6opprGuX5nJDwq+CyYldHMRghQjfAAtetyl0wLVuTKkHcBGGaDu60/je6w0+GNfnr6ZQbGwvOmfP6vB2sQMc/32h/E/sYS+Lf1bj1A1L+xq/+1XvgyooE9JklA726CJGdHcPGHqUBuv977l9EAT3gLJafqPwk7Y1PxVTJ2rS5es9+jBqZ6B/dWDmtp9lqOAywFbrWz0Joxp/a002KgmCvYWmtPyiLRX8V9WS2jyAFUKDad4DcgxX+TO/N9xOos0JWaj2HoJTTMlAYMRIqRmF1yptZcgzzNjr7YtI4Z8+6/nlCSVUif+5wxy9rikyBH/RBKwsQ0rA9ezC+IiBRJWoUjPTxvSUTPZ45juQCPPq8xHMIQK96CorgbDNdVcyjrzxl1lo2M2nGQfnkuaDVnT/m3p1PJwXy6dkYlD3Dq+fIs7t2Gm1JGze8zOyMkkpY6L7h6uoX7fEeNrH;4:xlvZS+C/saZvwa2oa114ZbspBxlhHidHubgaysV2OZFOe9I+ccGr7R++DEWVcVlOrPKMi6cu4Rb5Ue0VK4zMVh/WdoNa0KRkY1k7OUnb5ZDk3mOn9Ic+URxDT1x/t+BtYB7tzSrFY8HldaUqihlyoHThwr86KTPUvu28xqAomQSUxkM0/VjzMK+kI7jdZKir+YvwC707xLXh/8n+iHnjjgbf9OtVaXxSJbv2GoW05ZA2q4UGd+9ALvegEjLpZ9YBtEiH2R6crSqskuG7Qn8EFSda5ObeU38a9MRGAY/7PsZiPggP3LcduMYL5bYaAeOe6uXKRv1qw68as9QrlJHB8MD0FPm7jLoKWa1hfGv5pSFmXl/XY2deJgGvnZaOfTcnhqPDCvNm7IjvWkkf0NGP4MTrvnHBAzpnrc1TtdaBIOQ= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(9101521096)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026);SRVR:BN3PR1201MB1108;BCL:0;PCL:0;RULEID:;SRVR:BN3PR1201MB1108; X-Forefront-PRVS: 0931CB1479 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(4630300001)(6009001)(6049001)(377454003)(24454002)(13464003)(50986999)(33656002)(47776003)(76176999)(65816999)(54356999)(64126003)(50466002)(4001350100001)(5004730100002)(2501003)(65956001)(66066001)(65806001)(189998001)(586003)(5001770100001)(23676002)(81166005)(5008740100001)(59896002)(19580395003)(19580405001)(92566002)(4326007)(42186005)(83506001)(230700001)(6116002)(86362001)(77096005)(36756003)(3846002)(80316001)(2950100001)(2201001)(921003)(1121003)(217873001);DIR:OUT;SFP:1101;SCL:1;SRVR:BN3PR1201MB1108;H:[10.236.18.82];FPR:;SPF:None;MLV:sfv;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtCTjNQUjEyMDFNQjExMDg7MjM6UDhMQ2FPKzE1NHo4SGdxTXkxVkRYNFpB?= =?utf-8?B?NlBURGpyWTlwSWdOSzNybnRyeWlFZGM4QXQ2YkdYTXlCbEpOVzVLMnFBam5K?= =?utf-8?B?d0JNcDhNZE40Y2NQMXRQUjJyRmpnWXZPbEZrUSszTStSYkMyWHZBSVNFTmF1?= =?utf-8?B?MS8zSFFXSXdqbzk4dG9FTklQOHVpelhRckw3TTArbXozb1NYbUpvQkhQMFB5?= =?utf-8?B?WVVkUDdoZzJWY0JYbnFpZGFPZ0prbXdJZzZiR0dzVThNcGtsOFZiNWYwTmtS?= =?utf-8?B?S2xueEh0VW9paXd2SFI4ekRHQzJGT2Jjd0Zrcm5kbW5WWE1qWE0zT1dIU1A2?= =?utf-8?B?QU15U3F1ZEZlMUI3MkZpR3FrYmFOY2F5eVRiVTVZbW9rL1d1ZWVRcEt2RG9F?= =?utf-8?B?K3JHWTR4ZWRMYjQvVDkvWlBBTzlNazhkcC8yUVFuMDdTT2c2MTE4cm5MdXZQ?= =?utf-8?B?REc5L25Ud1E2Z25Ebk82bUJud2RSYlNaanFCUmYzT05vWnJ5QTN1bkdtb1RO?= =?utf-8?B?Zmg5ZURxeTFJK2ZBWk8vVWdsNnJpTTd2WW5zYjJHeUc5bEZrUWFIY1RubVVu?= =?utf-8?B?QitwSGR2WUFkQUVITXc4U3UvaGhNWC9TTS84SjR3bHhNVDFHQk5rTTEvbytV?= =?utf-8?B?NEp5TTBpbVQvajd6cVFRSkxxR29GalpURU1La0lzSWhuQXFzVUVId1BnVHpp?= =?utf-8?B?K05RRTlQQmpmN2dCV2tnSkJSQWFnbG9lQ3JpM0pnK3VLY3ZmYSs1VEV6Qm9p?= =?utf-8?B?MkF6ck1Cblk0Wm1sWGdOOUo2MGJkVDhkV0RBNkZlbyttdnZuTEZDc1Boam1J?= =?utf-8?B?Z0hKT3ZPS1NYS3BXTXFvL1ZrNWwwMHRxNWxUTTRIYUc2bnFYUDE1SFRSVnJW?= =?utf-8?B?QUxFTHFrZEVjaHloQkFrWmt2d3RoNDFVbDl3L0YvYTdGOG04aVpDT05UQVdh?= =?utf-8?B?dllFemJYUFg5NU5Ec1RqdVJBOVpaRzg1aUZQMGJ3Sm44SUZnS3ZtV0RVMDhF?= =?utf-8?B?Y0h3MjRvSVlPYTRBcDV0UmkrUXJoNDlpRTlMblIrTVdrQWZQb0w3eFpwdWdM?= =?utf-8?B?VmNtU3ZRYVcwejNWU2xpYTVqWjF2OXhLeThrSGJENFdXWjlmaU80M2RJUzdm?= =?utf-8?B?Z295Y3BpOXQ0MHM4Q2hoV0dNUHFZNXZBUk41QTJ2VzRRMkxJR3ZLQ1FScEY2?= =?utf-8?B?VEZLeTZnNndhUC9TQUUwLzhMeE1RenhOM0J0QUhqTW9oU25FK1lZNXkydHFF?= =?utf-8?B?b0NxZDRZbmlhNW53RWNQQ3BLS3FETFBjZWprYS9qeXk3SlFpTFMzQmRWeHhj?= =?utf-8?B?bm4zQ3gwRzNWRUtxUGUwWUpZNnB5Si9MRzFDb0RWZWlpTWJaaFVadmpjV0ZW?= =?utf-8?B?alJ4eWE0R2pDakZ2L2tOWEl4cDRybVdXR0Jpc3BobURLNkZNY3B2YW5DQjIv?= =?utf-8?B?WWNEMG40ZHRzaVZBL2plMUVOdHFuMXJET2RlYXhEa21rRU9XNVJUL1BrZVBP?= =?utf-8?B?RUxiYTlHOU5FdzFaNC83U05ybzZTWWZaUlZZeFhiRWFxMHRmaGN1WmU0SG9Z?= =?utf-8?B?SFEvZlpFZXlBeXFMZFI1M0orTzRid0lrUT09?= X-Microsoft-Exchange-Diagnostics: 1;BN3PR1201MB1108;5:hCSF5pfqOX+hFSymRXwwS6kPMO5z94kO2kpK+1qBKXGpMTN0pPf6+11e0LqS7/XzgmG3wm9VpF/nGrhrDE8uT+wk4izsVr+p35DoxGvBgCULMUiLo3n9Sn4kWNSq4S9uLGW3B2wpTgZAnaPFFxktfA==;24:x3R+EfyDuIxunzYeEGxfliKNw4beoQrf2DjPzkEiqXgZcEQZxknKEO3dlphaM5/fwN0XJYgZotSQ9rq2rAFODw9VPA1ejzKNwPD5plyz2Ng=;7:R5KR/oqxMny9Xc/bV0fUDlyfTZTYCQJK7ZUHrVZxkXv3Zh+7s7ti/Y7SJsTR7zA8AnFPPbO4d5pV8V5qxIzFaCm2w0BqHh0mmuhCN/PZydOmgLuZep3UDyKLRjmOWNqwZQI1x5CXWeNbXpdMUt944ehiRyzmvajfLozpgEJUdaA=;20:bCrdcktyo/jnK0F+qPVIqW1SZaSh8KwSGa5ftfRR3wVA+mK+BDJVnyfw/1SeBY/Av1T90Y77breiMjoBulD47VWfOOrl9ceLb4WoMh18A8UALhQkUCbAlzfQrdXDw49QJrjV81X2aY3RtLCHvGUB0DWtph+rHClTP150xfBZ7nFOr+dlFGVBoeL7dYcweerjmBgBegLI4We+rflnHhvIhLHFplllQZmJ4VLrzMlxdgzq2IaumasAbccVtWufjLpv X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 May 2016 15:55:23.4518 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR1201MB1108 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 04/30/2016 01:13 AM, Elliott, Robert (Persistent Memory) wrote: >> -----Original Message----- >> From: linux-kernel-owner@vger.kernel.org [mailto:linux-kernel- >> owner@vger.kernel.org] On Behalf Of Tom Lendacky >> Sent: Tuesday, April 26, 2016 5:56 PM >> Subject: [RFC PATCH v1 00/18] x86: Secure Memory Encryption (AMD) >> >> This RFC patch series provides support for AMD's new Secure Memory >> Encryption (SME) feature. >> >> SME can be used to mark individual pages of memory as encrypted through the >> page tables. A page of memory that is marked encrypted will be automatically >> decrypted when read from DRAM and will be automatically encrypted when >> written to DRAM. Details on SME can found in the links below. >> > ... >> ... Certain data must be accounted for >> as having been placed in memory before SME was enabled (EFI, initrd, etc.) >> and accessed accordingly. >> > ... >> x86/efi: Access EFI related tables in the clear >> x86: Access device tree in the clear >> x86: Do not specify encrypted memory for VGA mapping > > If the SME encryption key "is created randomly each time a system is booted," > data on NVDIMMs won't decrypt properly on the next boot. You need to exclude > persistent memory regions (reported in the UEFI memory map as > EfiReservedMemoryType with the NV attribute, or as EfiPersistentMemory). The current plan is for the AMD Secure Processor to securely save the SME encryption key when NVDIMMs are installed on a system. The saved SME key will be restored if an NVDIMM restore event needs to be performed. If there isn't an NVDIMM restore event, then the randomly generated key will be used. Thanks, Tom > > Perhaps the SEV feature will allow key export/import that could work for > NVDIMMs. > > --- > Robert Elliott, HPE Persistent Memory > >