by tip-bot for Vasyl Gomonovych

[permalink] [raw]

Subject: [tip:x86/mm] x86/mm: Add support to make use of Secure Memory Encryption

Commit-ID: aca20d5462149333ba8b24a4a352be5b7a00dfd2
Gitweb: http://git.kernel.org/tip/aca20d5462149333ba8b24a4a352be5b7a00dfd2
Author: Tom Lendacky <[email protected]>
AuthorDate: Mon, 17 Jul 2017 16:10:35 -0500
Committer: Ingo Molnar <[email protected]>
CommitDate: Tue, 18 Jul 2017 20:23:26 +0200

x86/mm: Add support to make use of Secure Memory Encryption

Add support to check if SME has been enabled and if memory encryption
should be activated (checking of command line option based on the
configuration of the default state). If memory encryption is to be
activated, then the encryption mask is set and the kernel is encrypted
"in place."

Signed-off-by: Tom Lendacky <[email protected]>
Reviewed-by: Thomas Gleixner <[email protected]>
Cc: Alexander Potapenko <[email protected]>
Cc: Andrey Ryabinin <[email protected]>
Cc: Andy Lutomirski <[email protected]>
Cc: Arnd Bergmann <[email protected]>
Cc: Borislav Petkov <[email protected]>
Cc: Brijesh Singh <[email protected]>
Cc: Dave Young <[email protected]>
Cc: Dmitry Vyukov <[email protected]>
Cc: Jonathan Corbet <[email protected]>
Cc: Konrad Rzeszutek Wilk <[email protected]>
Cc: Larry Woodman <[email protected]>
Cc: Linus Torvalds <[email protected]>
Cc: Matt Fleming <[email protected]>
Cc: Michael S. Tsirkin <[email protected]>
Cc: Paolo Bonzini <[email protected]>
Cc: Peter Zijlstra <[email protected]>
Cc: Radim Krčmář <[email protected]>
Cc: Rik van Riel <[email protected]>
Cc: Toshimitsu Kani <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Link: http://lkml.kernel.org/r/5f0da2fd4cce63f556117549e2c89c170072209f.1500319216.git.thomas.lendacky@amd.com
Signed-off-by: Ingo Molnar <[email protected]>
---
arch/x86/include/asm/mem_encrypt.h | 6 ++-
arch/x86/kernel/head64.c | 5 ++-
arch/x86/mm/mem_encrypt.c | 77 +++++++++++++++++++++++++++++++++++++-
3 files changed, 83 insertions(+), 5 deletions(-)

diff --git a/arch/x86/include/asm/mem_encrypt.h b/arch/x86/include/asm/mem_encrypt.h
index 7122c36..8e618fc 100644
--- a/arch/x86/include/asm/mem_encrypt.h
+++ b/arch/x86/include/asm/mem_encrypt.h
@@ -17,6 +17,8 @@

#include <linux/init.h>

+#include <asm/bootparam.h>
+
#ifdef CONFIG_AMD_MEM_ENCRYPT

extern unsigned long sme_me_mask;
@@ -38,7 +40,7 @@ void __init sme_unmap_bootdata(char *real_mode_data);
void __init sme_early_init(void);

void __init sme_encrypt_kernel(void);
-void __init sme_enable(void);
+void __init sme_enable(struct boot_params *bp);

/* Architecture __weak replacement functions */
void __init mem_encrypt_init(void);
@@ -60,7 +62,7 @@ static inline void __init sme_unmap_bootdata(char *real_mode_data) { }
static inline void __init sme_early_init(void) { }

static inline void __init sme_encrypt_kernel(void) { }
-static inline void __init sme_enable(void) { }
+static inline void __init sme_enable(struct boot_params *bp) { }

#endif /* CONFIG_AMD_MEM_ENCRYPT */

diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index 0cdb53b..925b292 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -45,7 +45,8 @@ static void __head *fixup_pointer(void *ptr, unsigned long physaddr)
return ptr - (void *)_text + (void *)physaddr;
}

-unsigned long __head __startup_64(unsigned long physaddr)
+unsigned long __head __startup_64(unsigned long physaddr,
+ struct boot_params *bp)
{
unsigned long load_delta, *p;
unsigned long pgtable_flags;
@@ -70,7 +71,7 @@ unsigned long __head __startup_64(unsigned long physaddr)
for (;;);

/* Activate Secure Memory Encryption (SME) if supported and enabled */
- sme_enable();
+ sme_enable(bp);

/* Include the SME encryption mask in the fixup value */
load_delta += sme_get_me_mask();
diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c
index e5d5439..0fbd092 100644
--- a/arch/x86/mm/mem_encrypt.c
+++ b/arch/x86/mm/mem_encrypt.c
@@ -15,6 +15,7 @@
#include <linux/mm.h>
#include <linux/dma-mapping.h>
#include <linux/swiotlb.h>
+#include <linux/mem_encrypt.h>

#include <asm/tlbflush.h>
#include <asm/fixmap.h>
@@ -23,6 +24,13 @@
#include <asm/set_memory.h>
#include <asm/cacheflush.h>
#include <asm/sections.h>
+#include <asm/processor-flags.h>
+#include <asm/msr.h>
+#include <asm/cmdline.h>
+
+static char sme_cmdline_arg[] __initdata = "mem_encrypt";
+static char sme_cmdline_on[] __initdata = "on";
+static char sme_cmdline_off[] __initdata = "off";

/*
* Since SME related variables are set early in the boot process they must
@@ -190,6 +198,8 @@ void __init mem_encrypt_init(void)

/* Call into SWIOTLB to update the SWIOTLB DMA buffers */
swiotlb_update_mem_attributes();
+
+ pr_info("AMD Secure Memory Encryption (SME) active\n");
}

void swiotlb_set_mem_attributes(void *vaddr, unsigned long size)
@@ -513,6 +523,71 @@ void __init sme_encrypt_kernel(void)
native_write_cr3(__native_read_cr3());
}

-void __init sme_enable(void)
+void __init __nostackprotector sme_enable(struct boot_params *bp)
{
+ const char *cmdline_ptr, *cmdline_arg, *cmdline_on, *cmdline_off;
+ unsigned int eax, ebx, ecx, edx;
+ bool active_by_default;
+ unsigned long me_mask;
+ char buffer[16];
+ u64 msr;
+
+ /* Check for the SME support leaf */
+ eax = 0x80000000;
+ ecx = 0;
+ native_cpuid(&eax, &ebx, &ecx, &edx);
+ if (eax < 0x8000001f)
+ return;
+
+ /*
+ * Check for the SME feature:
+ * CPUID Fn8000_001F[EAX] - Bit 0
+ * Secure Memory Encryption support
+ * CPUID Fn8000_001F[EBX] - Bits 5:0
+ * Pagetable bit position used to indicate encryption
+ */
+ eax = 0x8000001f;
+ ecx = 0;
+ native_cpuid(&eax, &ebx, &ecx, &edx);
+ if (!(eax & 1))
+ return;
+
+ me_mask = 1UL << (ebx & 0x3f);
+
+ /* Check if SME is enabled */
+ msr = __rdmsr(MSR_K8_SYSCFG);
+ if (!(msr & MSR_K8_SYSCFG_MEM_ENCRYPT))
+ return;
+
+ /*
+ * Fixups have not been applied to phys_base yet and we're running
+ * identity mapped, so we must obtain the address to the SME command
+ * line argument data using rip-relative addressing.
+ */
+ asm ("lea sme_cmdline_arg(%%rip), %0"
+ : "=r" (cmdline_arg)
+ : "p" (sme_cmdline_arg));
+ asm ("lea sme_cmdline_on(%%rip), %0"
+ : "=r" (cmdline_on)
+ : "p" (sme_cmdline_on));
+ asm ("lea sme_cmdline_off(%%rip), %0"
+ : "=r" (cmdline_off)
+ : "p" (sme_cmdline_off));
+
+ if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT))
+ active_by_default = true;
+ else
+ active_by_default = false;
+
+ cmdline_ptr = (const char *)((u64)bp->hdr.cmd_line_ptr |
+ ((u64)bp->ext_cmd_line_ptr << 32));
+
+ cmdline_find_option(cmdline_ptr, cmdline_arg, buffer, sizeof(buffer));
+
+ if (!strncmp(buffer, cmdline_on, sizeof(buffer)))
+ sme_me_mask = me_mask;
+ else if (!strncmp(buffer, cmdline_off, sizeof(buffer)))
+ sme_me_mask = 0;
+ else
+ sme_me_mask = active_by_default ? me_mask : 0;
}

2017-07-20 09:23:21

On 17 July 2017 at 23:10, Tom Lendacky <[email protected]> wrote:
> The SMP MP-table is built by UEFI and placed in memory in a decrypted
> state. These tables are accessed using a mix of early_memremap(),
> early_memunmap(), phys_to_virt() and virt_to_phys(). Change all accesses
> to use early_memremap()/early_memunmap(). This allows for proper setting
> of the encryption mask so that the data can be successfully accessed when
> SME is active.
>
> Reviewed-by: Borislav Petkov <[email protected]>
> Signed-off-by: Tom Lendacky <[email protected]>
> ---
> arch/x86/kernel/mpparse.c | 98 +++++++++++++++++++++++++++++++++--------------
> 1 file changed, 70 insertions(+), 28 deletions(-)

Hi there,

today I played a bit with crosvm [0] and noticed that 4.14-rc7 doesn't
boot. git-bisect pointed to this patch, and reverting it indeed gets
things working again.

Anybody has an idea of why this could be?

Thanks,

Tomeu

[0] https://chromium.googlesource.com/chromiumos/platform/crosvm

>
> diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c
> index fd37f39..5cbb317 100644
> --- a/arch/x86/kernel/mpparse.c
> +++ b/arch/x86/kernel/mpparse.c
> @@ -429,7 +429,7 @@ static inline void __init construct_default_ISA_mptable(int mpc_default_type)
> }
> }
>
> -static struct mpf_intel *mpf_found;
> +static unsigned long mpf_base;
>
> static unsigned long __init get_mpc_size(unsigned long physptr)
> {
> @@ -451,6 +451,7 @@ static int __init check_physptr(struct mpf_intel *mpf, unsigned int early)
>
> size = get_mpc_size(mpf->physptr);
> mpc = early_memremap(mpf->physptr, size);
> +
> /*
> * Read the physical hardware table. Anything here will
> * override the defaults.
> @@ -497,12 +498,12 @@ static int __init check_physptr(struct mpf_intel *mpf, unsigned int early)
> */
> void __init default_get_smp_config(unsigned int early)
> {
> - struct mpf_intel *mpf = mpf_found;
> + struct mpf_intel *mpf;
>
> if (!smp_found_config)
> return;
>
> - if (!mpf)
> + if (!mpf_base)
> return;
>
> if (acpi_lapic && early)
> @@ -515,6 +516,12 @@ void __init default_get_smp_config(unsigned int early)
> if (acpi_lapic && acpi_ioapic)
> return;
>
> + mpf = early_memremap(mpf_base, sizeof(*mpf));
> + if (!mpf) {
> + pr_err("MPTABLE: error mapping MP table\n");
> + return;
> + }
> +
> pr_info("Intel MultiProcessor Specification v1.%d\n",
> mpf->specification);
> #if defined(CONFIG_X86_LOCAL_APIC) && defined(CONFIG_X86_32)
> @@ -529,7 +536,7 @@ void __init default_get_smp_config(unsigned int early)
> /*
> * Now see if we need to read further.
> */
> - if (mpf->feature1 != 0) {
> + if (mpf->feature1) {
> if (early) {
> /*
> * local APIC has default address
> @@ -542,8 +549,10 @@ void __init default_get_smp_config(unsigned int early)
> construct_default_ISA_mptable(mpf->feature1);
>
> } else if (mpf->physptr) {
> - if (check_physptr(mpf, early))
> + if (check_physptr(mpf, early)) {
> + early_memunmap(mpf, sizeof(*mpf));
> return;
> + }
> } else
> BUG();
>
> @@ -552,6 +561,8 @@ void __init default_get_smp_config(unsigned int early)
> /*
> * Only use the first configuration found.
> */
> +
> + early_memunmap(mpf, sizeof(*mpf));
> }
>
> static void __init smp_reserve_memory(struct mpf_intel *mpf)
> @@ -561,15 +572,16 @@ static void __init smp_reserve_memory(struct mpf_intel *mpf)
>
> static int __init smp_scan_config(unsigned long base, unsigned long length)
> {
> - unsigned int *bp = phys_to_virt(base);
> + unsigned int *bp;
> struct mpf_intel *mpf;
> - unsigned long mem;
> + int ret = 0;
>
> apic_printk(APIC_VERBOSE, "Scan for SMP in [mem %#010lx-%#010lx]\n",
> base, base + length - 1);
> BUILD_BUG_ON(sizeof(*mpf) != 16);
>
> while (length > 0) {
> + bp = early_memremap(base, length);
> mpf = (struct mpf_intel *)bp;
> if ((*bp == SMP_MAGIC_IDENT) &&
> (mpf->length == 1) &&
> @@ -579,24 +591,26 @@ static int __init smp_scan_config(unsigned long base, unsigned long length)
> #ifdef CONFIG_X86_LOCAL_APIC
> smp_found_config = 1;
> #endif
> - mpf_found = mpf;
> + mpf_base = base;
>
> - pr_info("found SMP MP-table at [mem %#010llx-%#010llx] mapped at [%p]\n",
> - (unsigned long long) virt_to_phys(mpf),
> - (unsigned long long) virt_to_phys(mpf) +
> - sizeof(*mpf) - 1, mpf);
> + pr_info("found SMP MP-table at [mem %#010lx-%#010lx] mapped at [%p]\n",
> + base, base + sizeof(*mpf) - 1, mpf);
>
> - mem = virt_to_phys(mpf);
> - memblock_reserve(mem, sizeof(*mpf));
> + memblock_reserve(base, sizeof(*mpf));
> if (mpf->physptr)
> smp_reserve_memory(mpf);
>
> - return 1;
> + ret = 1;
> }
> - bp += 4;
> + early_memunmap(bp, length);
> +
> + if (ret)
> + break;
> +
> + base += 16;
> length -= 16;
> }
> - return 0;
> + return ret;
> }
>
> void __init default_find_smp_config(void)
> @@ -838,29 +852,40 @@ static int __init update_mp_table(void)
> char oem[10];
> struct mpf_intel *mpf;
> struct mpc_table *mpc, *mpc_new;
> + unsigned long size;
>
> if (!enable_update_mptable)
> return 0;
>
> - mpf = mpf_found;
> - if (!mpf)
> + if (!mpf_base)
> + return 0;
> +
> + mpf = early_memremap(mpf_base, sizeof(*mpf));
> + if (!mpf) {
> + pr_err("MPTABLE: mpf early_memremap() failed\n");
> return 0;
> + }
>
> /*
> * Now see if we need to go further.
> */
> - if (mpf->feature1 != 0)
> - return 0;
> + if (mpf->feature1)
> + goto do_unmap_mpf;
>
> if (!mpf->physptr)
> - return 0;
> + goto do_unmap_mpf;
>
> - mpc = phys_to_virt(mpf->physptr);
> + size = get_mpc_size(mpf->physptr);
> + mpc = early_memremap(mpf->physptr, size);
> + if (!mpc) {
> + pr_err("MPTABLE: mpc early_memremap() failed\n");
> + goto do_unmap_mpf;
> + }
>
> if (!smp_check_mpc(mpc, oem, str))
> - return 0;
> + goto do_unmap_mpc;
>
> - pr_info("mpf: %llx\n", (u64)virt_to_phys(mpf));
> + pr_info("mpf: %llx\n", (u64)mpf_base);
> pr_info("physptr: %x\n", mpf->physptr);
>
> if (mpc_new_phys && mpc->length > mpc_new_length) {
> @@ -878,21 +903,32 @@ static int __init update_mp_table(void)
> new = mpf_checksum((unsigned char *)mpc, mpc->length);
> if (old == new) {
> pr_info("mpc is readonly, please try alloc_mptable instead\n");
> - return 0;
> + goto do_unmap_mpc;
> }
> pr_info("use in-position replacing\n");
> } else {
> + mpc_new = early_memremap(mpc_new_phys, mpc_new_length);
> + if (!mpc_new) {
> + pr_err("MPTABLE: new mpc early_memremap() failed\n");
> + goto do_unmap_mpc;
> + }
> mpf->physptr = mpc_new_phys;
> - mpc_new = phys_to_virt(mpc_new_phys);
> memcpy(mpc_new, mpc, mpc->length);
> + early_memunmap(mpc, size);
> mpc = mpc_new;
> + size = mpc_new_length;
> /* check if we can modify that */
> if (mpc_new_phys - mpf->physptr) {
> struct mpf_intel *mpf_new;
> /* steal 16 bytes from [0, 1k) */
> + mpf_new = early_memremap(0x400 - 16, sizeof(*mpf_new));
> + if (!mpf_new) {
> + pr_err("MPTABLE: new mpf early_memremap() failed\n");
> + goto do_unmap_mpc;
> + }
> pr_info("mpf new: %x\n", 0x400 - 16);
> - mpf_new = phys_to_virt(0x400 - 16);
> memcpy(mpf_new, mpf, 16);
> + early_memunmap(mpf, sizeof(*mpf));
> mpf = mpf_new;
> mpf->physptr = mpc_new_phys;
> }
> @@ -909,6 +945,12 @@ static int __init update_mp_table(void)
> */
> replace_intsrc_all(mpc, mpc_new_phys, mpc_new_length);
>
> +do_unmap_mpc:
> + early_memunmap(mpc, size);
> +
> +do_unmap_mpf:
> + early_memunmap(mpf, sizeof(*mpf));
> +
> return 0;
> }
>
> --
> 1.9.1
>

From 1573205811371646492@xxx Mon Jul 17 21:12:56 +0000 2017
X-GM-THRID: 1573205811371646492
X-Gmail-Labels: Inbox,Category Forums