From patchwork Mon Apr 10 22:59:26 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Chang S. Bae" X-Patchwork-Id: 81659 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp2207570vqo; Mon, 10 Apr 2023 16:12:57 -0700 (PDT) X-Google-Smtp-Source: AKy350ZoxQtMDJtA8RiSENwTb7ehmQ0e71k3yryVDUMUE/HZvdwHH1gClpRR97fwt5bSC2TDeio/ X-Received: by 2002:a05:6402:b0e:b0:504:a5c8:949d with SMTP id bm14-20020a0564020b0e00b00504a5c8949dmr4197497edb.12.1681168377493; Mon, 10 Apr 2023 16:12:57 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1681168377; cv=none; d=google.com; s=arc-20160816; b=qYm3Unq8WYa5DGG2yMwHUyMuADUW6/5rrocCmgFrit2vW3aOfsXTvS/RGmyvDSC+k0 JT/Un7r6k/nHisnAQsJrVVywEdkFAKmeZOlXD0cm6szjqW6bHVC/d6FV9nLxT/0nYdii ZFqbilkS8XCTAi6DhVa1HyPmbg+YH8LWmSUrhdIjzzSVP7EDasjeF/SwzfFoPb7ZBQX5 S+iKCSQNdVL8akOwuJZVItBfll10uQoWrMxmofivcNjRhAE4SZhRq6F4+4R69YLxLiPq /zaz3lqJg/DstDhkq0xOzbf9SiN9Oc3tm7LrFDokpF0YAcAw5xaF9varRWovrwMltLZu kgkw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:references:in-reply-to:message-id:date:subject :cc:to:from:dkim-signature; bh=//7oJ4AZ/qvmw+v1qhAXIOGSB7L14In/AKPHvE6aJSI=; b=rSAWRM3/mcDDFD9yWzUmFkPqIor0DfKuFW3Svbwp2nAUUq46nzxLkP0srJHCLB9qTX MdA/cNA6cbqhMaU3msxCNSUoM30ZBOMKYuSpRuqYg3eMl6K9iwrLu+XEGXi1AFwOkLXg 7hftNBbayc+fz6JAxsgqs5n/6GlqPn3/CRx5kBe54RBTkGHjVp6I/4YpQc9d/MJ0avfs MTz5gDYIIx/tUCIaxNPtJcD6HaHh0n9H7kQL2eRVMDdv2xrbHW1Xzb+PbV4N79PZq6YI d5xpeSSMCOytmueqe25AtmYKc38M0uX6BwqS/D0HrRw726dKjMrqBep01KlSYCqs96kf X3Ag== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=HTIRaEzq; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id u24-20020aa7d0d8000000b0050480f6caf9si6389899edo.62.2023.04.10.16.12.33; Mon, 10 Apr 2023 16:12:57 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=HTIRaEzq; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229808AbjDJXLp (ORCPT + 99 others); Mon, 10 Apr 2023 19:11:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47526 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229721AbjDJXLl (ORCPT ); Mon, 10 Apr 2023 19:11:41 -0400 Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ECF99212E; Mon, 10 Apr 2023 16:11:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1681168300; x=1712704300; h=from:to:cc:subject:date:message-id:in-reply-to: references; bh=KV4DRDJjZKL8mUaHgawndnJfeklSCTHqnQ39yJrSK6Q=; b=HTIRaEzqbFd/sWyMRO2bdpKE8X6X2uwUVVRZCQH7B3NITV2KprK1t1uo pPmdcxNm7n4PF8jOB0kpCOqtTe/j/lZ/oQOsA54i0NUL0j6qYSOI1OtA6 0SPKcRkKZpy2UEfgcizHDxsr3aeaZ/00c+/CY4195wBrqiVaMgLfky6w5 S5Ucj6sdMBjbgwMqXqhY67pGNIeoWomTETQbb2JYjDP3fS29xtSW0CKfv 8MQGDY4Rpfesr3sj0jxt4206NRakxzYsWXVaTVjPeho/v69Q4fHCOlv+g AsxKGMwd0IuNoAQBeyytGd4MsCYy+r6WVJkNzf6BEAbqVwAdWP3g2Ooj7 A==; X-IronPort-AV: E=McAfee;i="6600,9927,10676"; a="340962502" X-IronPort-AV: E=Sophos;i="5.98,335,1673942400"; d="scan'208";a="340962502" Received: from fmsmga004.fm.intel.com ([10.253.24.48]) by fmsmga102.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 10 Apr 2023 16:11:39 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10676"; a="757607993" X-IronPort-AV: E=Sophos;i="5.98,335,1673942400"; d="scan'208";a="757607993" Received: from chang-linux-3.sc.intel.com ([172.25.66.173]) by fmsmga004.fm.intel.com with ESMTP; 10 Apr 2023 16:11:39 -0700 From: "Chang S. Bae" To: linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, dm-devel@redhat.com Cc: ebiggers@kernel.org, gmazyland@gmail.com, luto@kernel.org, dave.hansen@linux.intel.com, tglx@linutronix.de, bp@suse.de, mingo@kernel.org, x86@kernel.org, herbert@gondor.apana.org.au, ardb@kernel.org, dan.j.williams@intel.com, bernie.keany@intel.com, charishma1.gairuboyina@intel.com, lalithambika.krishnakumar@intel.com, chang.seok.bae@intel.com, Ingo Molnar , Borislav Petkov , "H. Peter Anvin" , Peter Zijlstra Subject: [PATCH v6 02/12] x86/cpufeature: Enumerate Key Locker feature Date: Mon, 10 Apr 2023 15:59:26 -0700 Message-Id: <20230410225936.8940-3-chang.seok.bae@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20230410225936.8940-1-chang.seok.bae@intel.com> References: <20220112211258.21115-1-chang.seok.bae@intel.com> <20230410225936.8940-1-chang.seok.bae@intel.com> X-Spam-Status: No, score=-2.5 required=5.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,SPF_HELO_NONE, SPF_NONE autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1762832812507842270?= X-GMAIL-MSGID: =?utf-8?q?1762832812507842270?= Key Locker is a CPU feature to minimize exposure of clear-text key material. An encoded form, called 'key handle', is referenced for data encryption or decryption instead of accessing the clear text key. A wrapping key loaded in the CPU's software-inaccessible state is used to transform a user key into a key handle. It supports Advanced Encryption Standard (AES) cipher algorithm with new SIMD instruction set like its predecessor (AES-NI). So a new AES implementation will follow in the kernel's crypto library. Here add it to enumerate the hardware capability, but it will not be shown in /proc/cpuinfo as userspace usage is not supported. Make the feature depend on XMM2 as it comes with AES SIMD instructions. Add X86_FEATURE_KEYLOCKER to the disabled features mask. It will be enabled under a new config option. Signed-off-by: Chang S. Bae Reviewed-by: Dan Williams Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: "H. Peter Anvin" Cc: Peter Zijlstra Cc: x86@kernel.org Cc: linux-kernel@vger.kernel.org --- Changes from RFC v2: * Do not publish the feature flag to userspace. * Update the changelog. Changes from RFC v1: * Updated the changelog. --- arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/disabled-features.h | 8 +++++++- arch/x86/include/uapi/asm/processor-flags.h | 2 ++ arch/x86/kernel/cpu/cpuid-deps.c | 1 + 4 files changed, 11 insertions(+), 1 deletion(-) diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h index d9c190cdefa9..878d25e38d7c 100644 --- a/arch/x86/include/asm/cpufeatures.h +++ b/arch/x86/include/asm/cpufeatures.h @@ -390,6 +390,7 @@ #define X86_FEATURE_AVX512_VPOPCNTDQ (16*32+14) /* POPCNT for vectors of DW/QW */ #define X86_FEATURE_LA57 (16*32+16) /* 5-level page tables */ #define X86_FEATURE_RDPID (16*32+22) /* RDPID instruction */ +#define X86_FEATURE_KEYLOCKER (16*32+23) /* "" Key Locker */ #define X86_FEATURE_BUS_LOCK_DETECT (16*32+24) /* Bus Lock detect */ #define X86_FEATURE_CLDEMOTE (16*32+25) /* CLDEMOTE instruction */ #define X86_FEATURE_MOVDIRI (16*32+27) /* MOVDIRI instruction */ diff --git a/arch/x86/include/asm/disabled-features.h b/arch/x86/include/asm/disabled-features.h index 702d93fdd10e..40e8ad2f837d 100644 --- a/arch/x86/include/asm/disabled-features.h +++ b/arch/x86/include/asm/disabled-features.h @@ -38,6 +38,12 @@ # define DISABLE_OSPKE (1<<(X86_FEATURE_OSPKE & 31)) #endif /* CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS */ +#ifdef CONFIG_X86_KEYLOCKER +# define DISABLE_KEYLOCKER 0 +#else +# define DISABLE_KEYLOCKER (1<<(X86_FEATURE_KEYLOCKER & 31)) +#endif /* CONFIG_X86_KEYLOCKER */ + #ifdef CONFIG_X86_5LEVEL # define DISABLE_LA57 0 #else @@ -138,7 +144,7 @@ #define DISABLED_MASK14 0 #define DISABLED_MASK15 0 #define DISABLED_MASK16 (DISABLE_PKU|DISABLE_OSPKE|DISABLE_LA57|DISABLE_UMIP| \ - DISABLE_ENQCMD) + DISABLE_ENQCMD|DISABLE_KEYLOCKER) #define DISABLED_MASK17 0 #define DISABLED_MASK18 (DISABLE_IBT) #define DISABLED_MASK19 0 diff --git a/arch/x86/include/uapi/asm/processor-flags.h b/arch/x86/include/uapi/asm/processor-flags.h index d898432947ff..262348aeaad1 100644 --- a/arch/x86/include/uapi/asm/processor-flags.h +++ b/arch/x86/include/uapi/asm/processor-flags.h @@ -128,6 +128,8 @@ #define X86_CR4_PCIDE _BITUL(X86_CR4_PCIDE_BIT) #define X86_CR4_OSXSAVE_BIT 18 /* enable xsave and xrestore */ #define X86_CR4_OSXSAVE _BITUL(X86_CR4_OSXSAVE_BIT) +#define X86_CR4_KEYLOCKER_BIT 19 /* enable Key Locker */ +#define X86_CR4_KEYLOCKER _BITUL(X86_CR4_KEYLOCKER_BIT) #define X86_CR4_SMEP_BIT 20 /* enable SMEP support */ #define X86_CR4_SMEP _BITUL(X86_CR4_SMEP_BIT) #define X86_CR4_SMAP_BIT 21 /* enable SMAP support */ diff --git a/arch/x86/kernel/cpu/cpuid-deps.c b/arch/x86/kernel/cpu/cpuid-deps.c index e462c1d3800a..24f54f58dbf8 100644 --- a/arch/x86/kernel/cpu/cpuid-deps.c +++ b/arch/x86/kernel/cpu/cpuid-deps.c @@ -82,6 +82,7 @@ static const struct cpuid_dep cpuid_deps[] = { { X86_FEATURE_XFD, X86_FEATURE_XGETBV1 }, { X86_FEATURE_AMX_TILE, X86_FEATURE_XFD }, { X86_FEATURE_SHSTK, X86_FEATURE_XSAVES }, + { X86_FEATURE_KEYLOCKER, X86_FEATURE_XMM2 }, {} };