From patchwork Mon May 8 07:03:27 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 90982 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp1966179vqo; Mon, 8 May 2023 00:13:59 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ6ehWjT4sCDQKqduSUL3THVEXVbEoO+Cu+CoVDgfSxN/RodbNBuS/4t/KaRbycqJAY6Jy4r X-Received: by 2002:a17:90a:d304:b0:24d:ec16:6f8c with SMTP id p4-20020a17090ad30400b0024dec166f8cmr9350843pju.20.1683530039281; Mon, 08 May 2023 00:13:59 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1683530039; cv=none; d=google.com; s=arc-20160816; b=UbwUp4kL+iUCadfMqiw2Tw/UPm5PoKcwgclrkwjpF1WTClYVYG8niLLHJmPrOy7azq i/2f8izPHaw/24T88vC7rF4ydJfdw0vqRAY+Z0Cf7pzkGZ+5PHn+JPOJYki4+ouu5dqt H4cC/PPXWS///yyw1L35aVr07rYL0rs52hEJ8krOjFCfmrxeRIUixDdPrBSUcM/BOAiB Joz9p5B9WQHApMJ5TIDPUWQI+eI3FDLhkQwmj7ZAIvkdf3EwM7fC27YUi05lpV7baU1d 9duL8jfbvPzRp0O1U2OgUouOFQigesji4Brr62fNinwJKfFmPeJe0plwFu6tIGojJJIY xbvA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=vQfH0BL+vsdfMDRcwUJ5f6UYDy9CdYJHXKaz77NnfDw=; b=0+irbTz0sigj4YHMOa+aobUltXEmDuFZl1v91cjXuuEXRN5Y/RnlSjCP/nhO/HqzAg 5oCe/Tl6S2lNiz29Fc+ZvVKtouHcrSVGLHUOa8Y3tNE5APMzhrTzLhBHxQsnqwVsgBcq ZM4JTPalNla7AfI5/wlIoIIzKVwjtoAoPLHu7idrg07ESsgsWdsXkmskzcR6BVW+8hT/ jEhuZ2msAn76NocqGSjq3EcwhFGp2yTpdSEtyvwX96U0jZNsZefkPWsf3Akb2dJTX2Dh vIuLtLnwQ+hrhBgA7ggLK1o6baSUE/oCImMb8K0U8etCYyUAtqVJS8RgSiHpft+jfFbK Izeg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=dizxd39p; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id k3-20020a637b43000000b0052c575f1d8dsi7784628pgn.260.2023.05.08.00.13.44; Mon, 08 May 2023 00:13:59 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=dizxd39p; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233234AbjEHHGQ (ORCPT + 99 others); Mon, 8 May 2023 03:06:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46010 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233215AbjEHHFc (ORCPT ); Mon, 8 May 2023 03:05:32 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2E41E1A48B; Mon, 8 May 2023 00:04:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7F1ED61FAB; Mon, 8 May 2023 07:04:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2CC39C4339B; Mon, 8 May 2023 07:04:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1683529491; bh=1s9q3daoOQOBrHBekUCXV36l5RIRydobOaLGHT6RGX8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dizxd39pyJpk7qPy00tyI7ARKRjwRCg6IbXhfAaFqS0fOwEzHwhyiE+1QoeLCnLWc JbwYT6S6c4DtlbA5C1sv7hulLiRj01KNcNbkMnI4IBM71JZicp1+sx4Y2SOVYVhyM/ h0v/3N5R92HJjDjb5bhpKH7mVE++907eyPB6y/nfWDZjYjz/v8eFehJBgDtK4iu1l4 dRcdVERloU/AOCE6ZVaSqPMNO9EvQvGNjCfTx9bIUAbF/93bLXpxKOsZ5hqyXAnZiA JNkvWN2KtBVLrJ6h3vzE8uBrV+dAlfdod0j7SUY7lKs9ANMfjXOw+7ymkaABdHNuhW OQara+MdLdPpQ== From: Ard Biesheuvel To: linux-efi@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Ard Biesheuvel , Evgeniy Baskov , Borislav Petkov , Andy Lutomirski , Dave Hansen , Ingo Molnar , Peter Zijlstra , Thomas Gleixner , Alexey Khoroshilov , Peter Jones , Gerd Hoffmann , Dave Young , Mario Limonciello , Kees Cook , Tom Lendacky , "Kirill A . Shutemov" , Linus Torvalds Subject: [PATCH v2 17/20] x86: efistub: Check SEV/SNP support while running in the firmware Date: Mon, 8 May 2023 09:03:27 +0200 Message-Id: <20230508070330.582131-18-ardb@kernel.org> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230508070330.582131-1-ardb@kernel.org> References: <20230508070330.582131-1-ardb@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4790; i=ardb@kernel.org; h=from:subject; bh=1s9q3daoOQOBrHBekUCXV36l5RIRydobOaLGHT6RGX8=; b=owGbwMvMwCFmkMcZplerG8N4Wi2JISVi3j5DUbGKXbHtG99vV/+zWC9A+SD3nk2i2485Lvu/7 krjnd3MHaUsDGIcDLJiiiwCs/++23l6olSt8yxZmDmsTCBDGLg4BWAiHy8z/NNLYbZetyhzwqPG +cWubxYvXOhTfb7+m8JZxguvt+/iqGhhZNgcumHK2ei/33QOaG/ucT5cvmRaaPePdV99Jtzf4LF 0Bws3AA== X-Developer-Key: i=ardb@kernel.org; a=openpgp; fpr=F43D03328115A198C90016883D200E9CA6329909 X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1765309194187088635?= X-GMAIL-MSGID: =?utf-8?q?1765309194187088635?= The decompressor executes in an environment with little or no access to a console, and without any ability to return an error back to the caller (the bootloader). So the only recourse we have when the SEV/SNP context is not quite what the kernel expects is to terminate the guest entirely. This is a bit harsh, and also unnecessary when booting via the EFI stub, given that it provides all the support that SEV guests need to probe the underlying platform. So let's do the SEV initialization and SNP feature check before calling ExitBootServices(), and simply return with an error if the SNP feature mask is not as expected. Signed-off-by: Ard Biesheuvel --- arch/x86/boot/compressed/sev.c | 12 ++++++++---- arch/x86/include/asm/sev.h | 4 ++++ drivers/firmware/efi/libstub/x86-stub.c | 17 +++++++++++++++++ 3 files changed, 29 insertions(+), 4 deletions(-) diff --git a/arch/x86/boot/compressed/sev.c b/arch/x86/boot/compressed/sev.c index 014b89c890887b9a..19c40873fdd209b5 100644 --- a/arch/x86/boot/compressed/sev.c +++ b/arch/x86/boot/compressed/sev.c @@ -315,20 +315,24 @@ static void enforce_vmpl0(void) */ #define SNP_FEATURES_PRESENT (0) +u64 snp_get_unsupported_features(void) +{ + if (!(sev_status & MSR_AMD64_SEV_SNP_ENABLED)) + return 0; + return sev_status & SNP_FEATURES_IMPL_REQ & ~SNP_FEATURES_PRESENT; +} + void snp_check_features(void) { u64 unsupported; - if (!(sev_status & MSR_AMD64_SEV_SNP_ENABLED)) - return; - /* * Terminate the boot if hypervisor has enabled any feature lacking * guest side implementation. Pass on the unsupported features mask through * EXIT_INFO_2 of the GHCB protocol so that those features can be reported * as part of the guest boot failure. */ - unsupported = sev_status & SNP_FEATURES_IMPL_REQ & ~SNP_FEATURES_PRESENT; + unsupported = snp_get_unsupported_features(); if (unsupported) { if (ghcb_version < 2 || (!boot_ghcb && !early_setup_ghcb())) sev_es_terminate(SEV_TERM_SET_GEN, GHCB_SNP_UNSUPPORTED); diff --git a/arch/x86/include/asm/sev.h b/arch/x86/include/asm/sev.h index 13dc2a9d23c1eb25..bf27b91644d0da5a 100644 --- a/arch/x86/include/asm/sev.h +++ b/arch/x86/include/asm/sev.h @@ -157,6 +157,7 @@ static __always_inline void sev_es_nmi_complete(void) __sev_es_nmi_complete(); } extern int __init sev_es_efi_map_ghcbs(pgd_t *pgd); +extern void sev_enable(struct boot_params *bp); static inline int rmpadjust(unsigned long vaddr, bool rmp_psize, unsigned long attrs) { @@ -202,12 +203,14 @@ void snp_set_wakeup_secondary_cpu(void); bool snp_init(struct boot_params *bp); void __init __noreturn snp_abort(void); int snp_issue_guest_request(u64 exit_code, struct snp_req_data *input, struct snp_guest_request_ioctl *rio); +u64 snp_get_unsupported_features(void); #else static inline void sev_es_ist_enter(struct pt_regs *regs) { } static inline void sev_es_ist_exit(void) { } static inline int sev_es_setup_ap_jump_table(struct real_mode_header *rmh) { return 0; } static inline void sev_es_nmi_complete(void) { } static inline int sev_es_efi_map_ghcbs(pgd_t *pgd) { return 0; } +static inline void sev_enable(struct boot_params *bp) { } static inline int pvalidate(unsigned long vaddr, bool rmp_psize, bool validate) { return 0; } static inline int rmpadjust(unsigned long vaddr, bool rmp_psize, unsigned long attrs) { return 0; } static inline void setup_ghcb(void) { } @@ -225,6 +228,7 @@ static inline int snp_issue_guest_request(u64 exit_code, struct snp_req_data *in { return -ENOTTY; } +static inline u64 snp_get_unsupported_features(void) { return 0; } #endif #endif diff --git a/drivers/firmware/efi/libstub/x86-stub.c b/drivers/firmware/efi/libstub/x86-stub.c index ce8434fce0c37982..33d11ba78f1d8c4f 100644 --- a/drivers/firmware/efi/libstub/x86-stub.c +++ b/drivers/firmware/efi/libstub/x86-stub.c @@ -15,6 +15,7 @@ #include #include #include +#include #include "efistub.h" @@ -714,6 +715,22 @@ static efi_status_t exit_boot_func(struct efi_boot_memmap *map, &p->efi->efi_memmap, &p->efi->efi_memmap_hi); p->efi->efi_memmap_size = map->map_size; + /* + * Call the SEV init code while still running with the firmware's + * GDT/IDT, so #VC exceptions will be handled by EFI. + */ + if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) { + u64 unsupported; + + sev_enable(p->boot_params); + unsupported = snp_get_unsupported_features(); + if (unsupported) { + efi_err("Unsupported SEV-SNP features detected: 0x%llx\n", + unsupported); + return EFI_UNSUPPORTED; + } + } + return EFI_SUCCESS; }