From patchwork Wed Feb 21 11:35:18 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 204176 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:693c:2685:b0:108:e6aa:91d0 with SMTP id mn5csp979141dyc; Wed, 21 Feb 2024 03:39:24 -0800 (PST) X-Forwarded-Encrypted: i=3; AJvYcCWxepK9Z7CYb0tAzOQCfLcrHJyd5tk91Zzo2fW4cwj8ejpwrYQjdWDkyP/C3AxbMj7uxASsVgX46tNUcS/RuFSC0S3/Rg== X-Google-Smtp-Source: AGHT+IFF6X4My7omfBert9d6HuMYaIf5d1+f/yA8CBlG5us7q9vs05PGXP9M12x10hj1Zt8qFFjS X-Received: by 2002:a05:6871:823:b0:21a:34e1:bfd3 with SMTP id q35-20020a056871082300b0021a34e1bfd3mr17137354oap.25.1708515563753; Wed, 21 Feb 2024 03:39:23 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1708515563; cv=pass; d=google.com; s=arc-20160816; b=NyR7KRvls9tEs0skwGhnCxpUDcs3270a5s8cCXhQdVGIQRtKQbZWhrdvOnxdTD4pz5 E8Wk4f21NlOI2r/dKQ8G7X6WzyV9pZu3ZhhnVssUAeJQyhF69HaL5P/fxuO6o5NXNDGO p6kuAKdygj+7jhJk1lQbINXlub+mjT94nCPfUYJakhEYexnv/kGF0slPxu1PytH61D9p 0AzQKsmEUlLitl96HXHG2zcDkSkc57/pBAAlmyCHJB1wq85cYrqV267CyK/2yDql6mFX ljcd0vxRINOTFilY8+6jNQBT+H2ATovKg2enkjq0yj6/7fXjxCxRZlTj7o6zxy3XY7cx 7+Mg== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=cc:to:from:subject:message-id:references:mime-version :list-unsubscribe:list-subscribe:list-id:precedence:in-reply-to:date :dkim-signature; bh=tevHFXJ+OOPc1/guz1Xb2v+32aOKjnUq6Qv962Lc8AE=; fh=fMhMPvo8duafGkM4xZHdH7fULbau3etefTGsKa+Qy7I=; b=VqPVLJOIDVkVoYmtppTxG24PcPPk445O29td2c3BZtyYb36Zdn9vn1LoyCck3RNGts uUdszPUQvA37CbhjlVE9JwGPPPECGLLVQoqPnUqRdvbwvIZidfBxWYvrVzJxXPa8XVuU uKw/MOzl5GFd9bKsXF7qpNnPPtxSsFjdrHaEXzIyfMbsI+LPoGpNZiUkgu5EkO2lEqiX bhx72YTuuoymCOvTF2W4stQVdP6Lduoo1qrGKPoikH2/sVbueXIpa9e0T/I4gEYfGdWH J++zxK7qNVT6iS20zsU0YE2sa1TknnVtwoxbxSg45uhbN62akwj0MNYRbh5cEyXtCcTb Hi4g==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@google.com header.s=20230601 header.b=xWTU47Dk; arc=pass (i=1 spf=pass spfdomain=flex--ardb.bounces.google.com dkim=pass dkdomain=google.com dmarc=pass fromdomain=google.com); spf=pass (google.com: domain of linux-kernel+bounces-74641-ouuuleilei=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) smtp.mailfrom="linux-kernel+bounces-74641-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: from sv.mirrors.kernel.org (sv.mirrors.kernel.org. [139.178.88.99]) by mx.google.com with ESMTPS id bw38-20020a056a0204a600b005dc80a2a308si7994347pgb.436.2024.02.21.03.39.23 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 21 Feb 2024 03:39:23 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-74641-ouuuleilei=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20230601 header.b=xWTU47Dk; arc=pass (i=1 spf=pass spfdomain=flex--ardb.bounces.google.com dkim=pass dkdomain=google.com dmarc=pass fromdomain=google.com); spf=pass (google.com: domain of linux-kernel+bounces-74641-ouuuleilei=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) smtp.mailfrom="linux-kernel+bounces-74641-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sv.mirrors.kernel.org (Postfix) with ESMTPS id 890032836AA for ; Wed, 21 Feb 2024 11:39:23 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 927634E1DC; Wed, 21 Feb 2024 11:36:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="xWTU47Dk" Received: from mail-wr1-f74.google.com (mail-wr1-f74.google.com [209.85.221.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8DF5D4E1BF for ; Wed, 21 Feb 2024 11:36:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.74 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1708515364; cv=none; b=gdIFjXQVi0lh63bMcxkXIq5+ngFQ4x2pXY3r0iXmyGXdURk1aTbWQ/Bb4VN/yD+NdIdFieb9/VBelpYP85oBrtcr8aDB5eFMkgCEwrmVf0n9wf/pSxVc20amz8wOmes8YzTqwdzhZz+v4Uu0/xzYobWn1R9yNTW5ixX1RRVdfuc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1708515364; c=relaxed/simple; bh=iv8WXooCR9hoiH3pMKa/9TfgmsuasaiYtcPtFFzw3QI=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=SndZMASpAwZtA2R4SLvbd4cBjm7NHnquIlxiRsU7x54GSxT4iCzA1gNtf7et4RZfOqb6EvdixKC6yLL312dmd8xRpbZG9Bt9osBJWKHEF2JVshE1g2f8/rBGU2TXfWe3WZc3tkuICQCEc2+XHTyDzhukZeIysGW4+cwFEhDLMzU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--ardb.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=xWTU47Dk; arc=none smtp.client-ip=209.85.221.74 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--ardb.bounces.google.com Received: by mail-wr1-f74.google.com with SMTP id ffacd0b85a97d-33d60ac6781so1120646f8f.0 for ; Wed, 21 Feb 2024 03:36:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1708515361; x=1709120161; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=tevHFXJ+OOPc1/guz1Xb2v+32aOKjnUq6Qv962Lc8AE=; b=xWTU47DkRFKzKWef6Xy3xIpCrckMs8ylSGlcHq6QG2fGWjUr25x7s0JdtdL4v+iT4k /CJIZ/jWUUXvGNfbgu1unMo/ZbrSI9vY85IykkoTZjLCm4FD+p1T6vW/s/P614pfHMJz nlUv+GOQjbXf5GfqvM4B5IFw6yZdRtIa5V3mLWVX6KMplqdp8Ykgo7B1Q4sOaIfbOkP7 HepGp0lf1xSk9v/4U3Mrp2+TjCKNKSvOrM32hOq0qKntB/tiOyS2VrjMX54deER415ek MAhmGMDg5eoKvIPePnzOMOjIqsw+B0KqYmWg/xT6d7LN+UGqEis5P+yHGJlKCfwUVPE/ Ugzw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1708515361; x=1709120161; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=tevHFXJ+OOPc1/guz1Xb2v+32aOKjnUq6Qv962Lc8AE=; b=CalSoDkRQgbGSrxcrK9ByeKbN5yNTW7pQC2htk3PCh/zCvTmS8+v0QRiP+0Fg7MhdC +ZgqHPYQFRbG5FG7+QDmsr/nXGpEh9POqhHO7kYbCl6tP+B1jjosQzitLa/smG0P95oE 8EanDf8QYtHQ+wtV9zoCFxih/+KIlq/J1roZ1QEoRK8eE5f9jL7MUqDRyEI2R5HY82Oh OoZct6l+O95rQDejeZhc1DCXhXtCquMfRMZUQ0lHetsa/aVh7wDciiP8QYEiG0Ve4eIS FS36hEzwDSGVzk2k/BQBmNmOSYfzayNccJZsxbDZwQ2NcvykrEwv9d3bn1oskEDJDTXv pS4A== X-Gm-Message-State: AOJu0YwvwoMQpEvAxC5hRzfWpz7kRZAtfR+swdfqrmGU6X/zyMWWLYjf LwBDWfJrBnprNSII+X8/5J2unD3OZfyMcj/AQuWK+117iPw/wzmB+tunFv3AbvZ8N1/ldZdbCJy KGyniS2K0x8rgktmLU0565yuMNWZyepOcTQzPxvun1es+KldvaBPXWDmH7n+MDteIcRpb8m+nUw Kp1RPC9JCX9pnguXs8HYlDtygNkv8JHA== X-Received: from palermo.c.googlers.com ([fda3:e722:ac3:cc00:28:9cb1:c0a8:118a]) (user=ardb job=sendgmr) by 2002:a5d:6d8f:0:b0:33d:4dc7:ee2 with SMTP id l15-20020a5d6d8f000000b0033d4dc70ee2mr57756wrs.5.1708515360743; Wed, 21 Feb 2024 03:36:00 -0800 (PST) Date: Wed, 21 Feb 2024 12:35:18 +0100 In-Reply-To: <20240221113506.2565718-18-ardb+git@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20240221113506.2565718-18-ardb+git@google.com> X-Developer-Key: i=ardb@kernel.org; a=openpgp; fpr=F43D03328115A198C90016883D200E9CA6329909 X-Developer-Signature: v=1; a=openpgp-sha256; l=3958; i=ardb@kernel.org; h=from:subject; bh=PHNTEzBLgbyUsxeGtN9QWmwRz8NSWIe83iLY3QrvkGo=; b=owGbwMvMwCFmkMcZplerG8N4Wi2JIfXq/U9ZK1dd2mLOnCwavPTfm2Pn2/Vrn9zLPzbvtSdvW JNl16R7HaUsDGIcDLJiiiwCs/++23l6olSt8yxZmDmsTCBDGLg4BWAiPr6MDE0nLl1Z69QwX87h H+/V5a/uLhVSuvys+d217dnHq66W6eYw/C+Zf6v8zv6ogAtOaxmU4y/sNfu1tKlEzUAxfNnSZ89 u/eUAAA== X-Mailer: git-send-email 2.44.0.rc0.258.g7320e95886-goog Message-ID: <20240221113506.2565718-29-ardb+git@google.com> Subject: [PATCH v5 11/16] x86/sme: Avoid SME/SVE related checks on non-SME/SVE platforms From: Ard Biesheuvel To: linux-kernel@vger.kernel.org Cc: Ard Biesheuvel , Kevin Loughlin , Tom Lendacky , Dionna Glaze , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , Andy Lutomirski , Arnd Bergmann , Nathan Chancellor , Nick Desaulniers , Justin Stitt , Kees Cook , Brian Gerst , linux-arch@vger.kernel.org, llvm@lists.linux.dev X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1791508415828182446 X-GMAIL-MSGID: 1791508415828182446 From: Ard Biesheuvel Reorganize the early SME/SVE init code so that SME/SVE related calls are deferred until it has been determined that the platform actually supports this, and so those calls could actually make sense. This removes logic from the early boot path that executes from the 1:1 mapping when booting a CONFIG_AMD_MEM_ENCRYPT=y kernel on a system that does not implement that (i.e., 99% of distro kernels) Signed-off-by: Ard Biesheuvel --- arch/x86/include/asm/mem_encrypt.h | 4 ++-- arch/x86/kernel/head64.c | 6 +++--- arch/x86/mm/mem_encrypt_identity.c | 8 +++----- 3 files changed, 8 insertions(+), 10 deletions(-) diff --git a/arch/x86/include/asm/mem_encrypt.h b/arch/x86/include/asm/mem_encrypt.h index b31eb9fd5954..b1437ba0b3b8 100644 --- a/arch/x86/include/asm/mem_encrypt.h +++ b/arch/x86/include/asm/mem_encrypt.h @@ -48,7 +48,7 @@ void __init sme_unmap_bootdata(char *real_mode_data); void __init sme_early_init(void); void __init sme_encrypt_kernel(struct boot_params *bp); -void __init sme_enable(struct boot_params *bp); +void sme_enable(struct boot_params *bp); int __init early_set_memory_decrypted(unsigned long vaddr, unsigned long size); int __init early_set_memory_encrypted(unsigned long vaddr, unsigned long size); @@ -82,7 +82,7 @@ static inline void __init sme_unmap_bootdata(char *real_mode_data) { } static inline void __init sme_early_init(void) { } static inline void __init sme_encrypt_kernel(struct boot_params *bp) { } -static inline void __init sme_enable(struct boot_params *bp) { } +static inline void sme_enable(struct boot_params *bp) { } static inline void sev_es_init_vc_handling(void) { } diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c index 0b827cbf6ee4..b33f47489505 100644 --- a/arch/x86/kernel/head64.c +++ b/arch/x86/kernel/head64.c @@ -98,9 +98,6 @@ static unsigned long __head sme_postprocess_startup(struct boot_params *bp, pmdv unsigned long vaddr, vaddr_end; int i; - /* Encrypt the kernel and related (if SME is active) */ - sme_encrypt_kernel(bp); - /* * Clear the memory encryption mask from the .bss..decrypted section. * The bss section will be memset to zero later in the initialization so @@ -108,6 +105,9 @@ static unsigned long __head sme_postprocess_startup(struct boot_params *bp, pmdv * attribute. */ if (sme_get_me_mask()) { + /* Encrypt the kernel and related */ + sme_encrypt_kernel(bp); + vaddr = (unsigned long)__start_bss_decrypted; vaddr_end = (unsigned long)__end_bss_decrypted; diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c index 0166ab1780cc..7ddcf960e92a 100644 --- a/arch/x86/mm/mem_encrypt_identity.c +++ b/arch/x86/mm/mem_encrypt_identity.c @@ -45,6 +45,7 @@ #include #include #include +#include #include #include "mm_internal.h" @@ -502,18 +503,15 @@ void __init sme_encrypt_kernel(struct boot_params *bp) native_write_cr3(__native_read_cr3()); } -void __init sme_enable(struct boot_params *bp) +void __head sme_enable(struct boot_params *bp) { const char *cmdline_ptr, *cmdline_arg, *cmdline_on; unsigned int eax, ebx, ecx, edx; unsigned long feature_mask; unsigned long me_mask; char buffer[16]; - bool snp; u64 msr; - snp = snp_init(bp); - /* Check for the SME/SEV support leaf */ eax = 0x80000000; ecx = 0; @@ -546,7 +544,7 @@ void __init sme_enable(struct boot_params *bp) feature_mask = (msr & MSR_AMD64_SEV_ENABLED) ? AMD_SEV_BIT : AMD_SME_BIT; /* The SEV-SNP CC blob should never be present unless SEV-SNP is enabled. */ - if (snp && !(msr & MSR_AMD64_SEV_SNP_ENABLED)) + if (snp_init(bp) && !(msr & MSR_AMD64_SEV_SNP_ENABLED)) snp_abort(); /* Check if memory encryption is enabled */