MIME-Version: 1.0
References: <8afff0c64feb6b96db36112cb865243f4ae280ca.1634922135.git.thomas.lendacky@amd.com>
 <c997e8a2-b364-2a8e-d247-438e9d937a1e@amd.com> <CAMj1kXGH7aGR==o1L2dnA9U9L==gM0__10UGznnyZwkHrT84sw@mail.gmail.com>
 <YXmEo8iMNIn1esYC@zn.tnic> <CAMj1kXEZkw99MPssHWFRL_k0okeGF47VYL+o8p72hBWkqW927g@mail.gmail.com>
 <f939e968-149f-1caf-c1fb-5939eafae31c@amd.com> <15ceb556-0b56-2833-206e-0cf9b9d2cb45@amd.com>
 <CAMj1kXHKxObuebZJMWQQwg014rYzvoBgWPZxfCYakuf+GSoqhg@mail.gmail.com> <6d6b4982-ce69-4fd4-1bb8-5c35b360a95f@amd.com>
In-Reply-To: <6d6b4982-ce69-4fd4-1bb8-5c35b360a95f@amd.com>
From:   Ard Biesheuvel <ardb@kernel.org>
Date:   Fri, 3 Dec 2021 19:13:36 +0100
Message-ID: <CAMj1kXFkL8AkgE431CJWsD2T7uXh5PiR44iXLBKfTQQuDuNbyg@mail.gmail.com>
Subject: Re: [PATCH v2] x86/sme: Explicitly map new EFI memmap table as encrypted
To:     Tom Lendacky <thomas.lendacky@amd.com>
Cc:     Borislav Petkov <bp@alien8.de>,
        linux-efi <linux-efi@vger.kernel.org>,
        platform-driver-x86@vger.kernel.org,
        Thomas Gleixner <tglx@linutronix.de>,
        Ingo Molnar <mingo@redhat.com>,
        "H. Peter Anvin" <hpa@zytor.com>,
        Darren Hart <dvhart@infradead.org>,
        Andy Shevchenko <andy@infradead.org>,
        Matt Fleming <matt@codeblueprint.co.uk>,
        "# 3.4.x" <stable@vger.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        X86 ML <x86@kernel.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Fri, 3 Dec 2021 at 17:22, Tom Lendacky <thomas.lendacky@amd.com> wrote:
>
> On 12/3/21 4:30 AM, Ard Biesheuvel wrote:
> > On Wed, 1 Dec 2021 at 15:06, Tom Lendacky <thomas.lendacky@amd.com> wrote:
> >>
> >> On 10/27/21 12:04 PM, Tom Lendacky wrote:
> >>>
> >>>
> >>> On 10/27/21 11:59 AM, Ard Biesheuvel wrote:
> >>>> On Wed, 27 Oct 2021 at 18:56, Borislav Petkov <bp@alien8.de> wrote:
> >>>>>
> >>>>> On Wed, Oct 27, 2021 at 05:14:35PM +0200, Ard Biesheuvel wrote:
> >>>>>> I could take it, but since it will ultimately go through -tip anyway,
> >>>>>> perhaps better if they just take it directly? (This will change after
> >>>>>> the next -rc1 though)
> >>>>>>
> >>>>>> Boris?
> >>>>>
> >>>>> Yeah, I'm being told this is not urgent enough to rush in now so you
> >>>>> could queue it into your fixes branch for 5.16 once -rc1 is out and send
> >>>>> it to Linus then. The stable tag is just so it gets backported to the
> >>>>> respective trees.
> >>>>>
> >>>>> But if you prefer I should take it, then I can queue it after -rc1.
> >>>>> It'll boil down to the same thing though.
> >>>>>
> >>>>
> >>>> No, in that case, I can take it myself.
> >>>>
> >>>> Tom, does that work for you?
> >>>
> >>> Yup, that works for me. Thanks guys!
> >>
> >> I don't see this in any tree yet, so just a gentle reminder in case it
> >> dropped off the radar.
> >>
> >
> > Apologies for the delay, I've pushed this out to -next now.
> >
> > Before I send it to Linus, can you please confirm (for my peace of
> > mind) how this only affects systems that have memory encryption
> > available and enabled in the first place?
>
> Certainly.
>
> An early_memremap() call uses the FIXMAP_PAGE_NORMAL protection value for
> performing the mapping. Prior to performing the actual mapping though, a
> call to early_memremap_pgprot_adjust() is made to possibly alter the
> protection value, but only if memory encryption is active.
>
> Changing the call to early_memremap_prot() and providing
> pgprot_encrypted(FIXMAP_PAGE_NORMAL) as the protection value results in an
> equivalent call to early_memremap() when memory encryption is not active.
> This is because the pgprot_encrypted() is, in effect, a NOP when memory
> encryption is not active.
>
> So when memory encryption is not available or active, the result of an
> early_memremap_prot() call with a protection value of
> pgprot_encrypted(FIXMAP_PAGE_NORMAL) is equivalent to an early_memremap()
> call.
>
> Let me know if that answers your question.
>

It does, thanks.