From patchwork Tue Feb 13 04:07:46 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kevin Loughlin X-Patchwork-Id: 200203 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7300:bc8a:b0:106:860b:bbdd with SMTP id dn10csp317648dyb; Mon, 12 Feb 2024 20:08:54 -0800 (PST) X-Forwarded-Encrypted: i=3; AJvYcCXomVC8uYSwciSkEgNuxFLDeUvjDI22ao+zZsbfk3LjrHOUyaS2sXJZmLnGVbm8JePXlUjl+SAA1eUI4pEvr3T941RKaA== X-Google-Smtp-Source: AGHT+IEthNOJyFb6iRgXVUhae3OwObBXTsyFQrXyGY3v7x5QDMqSI0Sq5uykisv9wptQO/K1BWWV X-Received: by 2002:a17:903:11c7:b0:1d9:c17b:43f3 with SMTP id q7-20020a17090311c700b001d9c17b43f3mr11133167plh.15.1707797334175; Mon, 12 Feb 2024 20:08:54 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1707797334; cv=pass; d=google.com; s=arc-20160816; b=Enkwrse3+yGb4WGJuCHgjXG/zmm4D2wZey7YeRD3VKajL/5aCs3gqX89MgC1KWisHN r8P13X+TDKsQK6wcBrTJyL+WF/8KXfTt3boVAPoKwutlrePbHmrMEc+5ut8T3e5Vw8M5 5Ay5sg1iTGKyIdcyg08uI+4qAqjLU9ZriuUCXwU6YsJ59O2KRnozAFE8Byop2/ZkSzCz QucqVyD/539My12DrQNESrHfM/mXC3MfRJm5MFNrX0etiQpVP5WtzPSitMPCrA98N8Ua 1o+wu4XUVpnHDLcK57iRHa0D4Ga38/XfzSFdntqdRDVixY3VEQFHxPc42eq4X24IyeOq 1XpQ== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=cc:to:from:subject:message-id:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:date:dkim-signature; bh=0LSkrrIqOo2Ij+GmdViPgbZ5m7gk2v6++xUFUDFhlew=; fh=HtV5D+0xOTF3FfroDcCPYqm1Mhh2XfdIEAMAUEJZUc4=; b=fjhZIvpLBbtTtgJeuqi7TN3WBLAJywjcSB+063TQhdNcqJNY6hGkPfNHfSlKRIYvJb XRT9QpGNsxmmSzfakMHfTt8AVD7Vh2lEqoH/qFbCLiZHxytHqsdLji6eQF4hpBF8D2Qt NgOYkkmVa0yj+++ntDk1gl7SiMGVXqBcxlPdhi9cvz2tisfyyqf2KsfaUWt8CQr9K7Bn 8qY/uHkwACI6ad2+uxJgw+gZ35Um9GRdzsKyBqO26CCVwvuPWELsuXv8os+uHpvI8Fu/ wytv9rwNBdUaWT6xPTz/iwb9p03ZNSuIsBp28RllW8DpoH2uVl2vbnS2KsLZ+ezQ1hT3 l90Q==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@google.com header.s=20230601 header.b=O2vHDOoR; arc=pass (i=1 spf=pass spfdomain=flex--kevinloughlin.bounces.google.com dkim=pass dkdomain=google.com dmarc=pass fromdomain=google.com); spf=pass (google.com: domain of linux-kernel+bounces-62926-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-62926-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com X-Forwarded-Encrypted: i=2; AJvYcCXao/JxS/mvlD0VBjJvDnz7W4YRdj9s+0JoaF9ScXUWO7/9Y9UKPbXuLMjcmbeP3hgOBWUQSNbRsHuEmwOEX3zkWQ9QfQ== Received: from sy.mirrors.kernel.org (sy.mirrors.kernel.org. [2604:1380:40f1:3f00::1]) by mx.google.com with ESMTPS id o11-20020a170902d4cb00b001d71d722818si1365643plg.513.2024.02.12.20.08.53 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Feb 2024 20:08:54 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-62926-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) client-ip=2604:1380:40f1:3f00::1; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20230601 header.b=O2vHDOoR; arc=pass (i=1 spf=pass spfdomain=flex--kevinloughlin.bounces.google.com dkim=pass dkdomain=google.com dmarc=pass fromdomain=google.com); spf=pass (google.com: domain of linux-kernel+bounces-62926-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-62926-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sy.mirrors.kernel.org (Postfix) with ESMTPS id CAB74B235F7 for ; Tue, 13 Feb 2024 04:08:48 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id B048BC13D; Tue, 13 Feb 2024 04:08:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="O2vHDOoR" Received: from mail-yb1-f201.google.com (mail-yb1-f201.google.com [209.85.219.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F3B86A93C for ; Tue, 13 Feb 2024 04:08:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1707797300; cv=none; b=oIxBiISVNJjNQkoVR+yqR0e/Y3I/HEE8olDR/JhQb6wPCMKDRhg84msPPXkiuMwrRnPvpA0Jeqm5kN7R5qY0ZmXDh2pV5HJCA/7a0HEMZlfVhPYw6nI3nLdjyJrYTdIsWJeovv2C/XBLKy4ed/TU3mD53Tj1CZT2Kr3RzxPw6FY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1707797300; c=relaxed/simple; bh=XBoMbI6Uy0zLsI3tD3x3/UZWmHsrnqrbzy9wDgXaWQU=; h=Date:Mime-Version:Message-ID:Subject:From:To:Cc:Content-Type; b=dxX8DbplxwAWQXxVkW0r7uamFHAPJJcYdZjU2BBLPFMjmRh566A3MK8zdnxBj3CJedfw9YBd2pDnACUhvGhy+gx3aUOfcLbtK2I4AKGZECtCTQrS243PlvszGu+L6NomMSYLhgX1GBBI1Ke7FIgZR6Oo94MEX4yc2IvxtcpH7Uo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--kevinloughlin.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=O2vHDOoR; arc=none smtp.client-ip=209.85.219.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--kevinloughlin.bounces.google.com Received: by mail-yb1-f201.google.com with SMTP id 3f1490d57ef6-dbe9e13775aso6121085276.1 for ; Mon, 12 Feb 2024 20:08:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1707797298; x=1708402098; darn=vger.kernel.org; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=0LSkrrIqOo2Ij+GmdViPgbZ5m7gk2v6++xUFUDFhlew=; b=O2vHDOoRLOZDWcnDlKeag0kcxDFvWNU1kwZvi5BzAlr907lDQET2BdTu9FavwpVV9y 4FmIDxj+drNiKHHI9PGqKsHHso7d7d25YWsJZd4ARNImBbiUFsZAxtPWTJg/VFG/LwkO NzLUN2PnV6j3D/Jsjzsed2/VkAaGAZAZtrvccquglnGI+nfl0BUC2tcc4cRKccb//odC SKhN4Cq5KNvLvJt96bSMRfa1dLN16wACnWYKyeyDw6wgMymMD4MKzOYH44ghCbSRBavn +nNT7k2QAlEDbonR65Gy8L8u776xio9CEzSFIQEp3Ye9dMsH2ND/H8/zeiR2hh1SChOG d/ZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1707797298; x=1708402098; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=0LSkrrIqOo2Ij+GmdViPgbZ5m7gk2v6++xUFUDFhlew=; b=mZXHScTfTHGVMIcJ90+w53iQcrjJw1iJ7Kj7fFOU3BGF+3CIrVSRyJf2AKf8p6VuWg 6fHXVsuQBnv45aSTPM1LQjS7bIaihPXybTqI8PyPsW/aa3HBp8pBeooQRkkxoDluDYDs Xin8nu8vxX1T3YQH/tqSj2jGBTp/MUCcVoZxKOkKl+ygghBQYszdwPUBYdLTSQUVF9Fw K7ijc2QLAPcf/uKMMERdtWHIZ4JJIAfYQgxsJtGukhizA9FGDdEySx1zkIL6odJ0efnp 0Js91VxHytNtTMkmC2IYBJPaIu+dOIueO1onOyD/sYG6FT3NgSkq4GD0ZQGs3ugyb2Vb OFiQ== X-Forwarded-Encrypted: i=1; AJvYcCUb2irBBhJ+lShtiZJ/5QKiiCn2Ky4xtXiAMQMs0zgCPIqi26o0DWGrE1H6F4d7Of/4eKIGOH8txxW/awS6of787LQvz33dze8F/+RM X-Gm-Message-State: AOJu0YxgtfomCgT2jDuZXLVHubTr09KWtSMgj9iq/y/3b1apdDsinPZc rKu/Su3ZN5Cm6z4qwwzHOhNJaCz1C5fVGFfVIRZ6eS3zvwpJpmw1BIgQzOqoQ8Wf3aF9V+sybg5 iFrwvbCdSjPXlsXSglkMd3G6NXGQjVQ== X-Received: from loughlin00.c.googlers.com ([fda3:e722:ac3:cc00:2b:ff92:c0a8:1b6f]) (user=kevinloughlin job=sendgmr) by 2002:a05:6902:1109:b0:dc6:207e:e8b1 with SMTP id o9-20020a056902110900b00dc6207ee8b1mr2320133ybu.2.1707797297966; Mon, 12 Feb 2024 20:08:17 -0800 (PST) Date: Tue, 13 Feb 2024 04:07:46 +0000 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-Mailer: git-send-email 2.43.0.687.g38aa6559b0-goog Message-ID: <20240213040747.1745939-1-kevinloughlin@google.com> Subject: [PATCH] x86/kernel: Validate ROM before DMI scanning when SEV-SNP is active From: Kevin Loughlin To: Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Baoquan He , Josh Poimboeuf , "Peter Zijlstra (Intel)" , Yuntao Wang , Kevin Loughlin , Tom Lendacky , Ard Biesheuvel , Dionna Glaze , Alexander Shishkin , Ross Lagerwall , Kai Huang , Brijesh Singh , linux-kernel@vger.kernel.org Cc: Adam Dunlap , Peter Gonda , Jacob Xu , Sidharth Telang , Conrad Grobler , Andri Saar X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1790755297706569467 X-GMAIL-MSGID: 1790755297706569467 SEV-SNP requires encrypted memory to be validated before access. The kernel is responsible for validating the ROM memory range because the range is not part of the e820 table and therefore not pre-validated by the BIOS. While the current SEV-SNP code attempts to validate the ROM range in probe_roms(), this does not suffice for all existing use cases. In particular, if EFI_CONFIG_TABLES are not enabled and CONFIG_DMI_SCAN_MACHINE_NON_EFI_FALLBACK is set, the kernel will attempt to access the memory at SMBIOS_ENTRY_POINT_SCAN_START (which falls in the ROM range) prior to validation. The specific problematic call chain occurs during dmi_setup() -> dmi_scan_machine() and results in a crash during boot if SEV-SNP is enabled under these conditions. This commit thus provides the simple solution of moving the ROM range validation from probe_roms() to before dmi_setup(), such that a SEV-SNP guest satisfying the above use case now successfully boots. Fixes: 9704c07bf9f7 ("x86/kernel: Validate ROM memory before accessing when SEV-SNP is active") Signed-off-by: Kevin Loughlin --- arch/x86/include/asm/setup.h | 6 ++++++ arch/x86/kernel/probe_roms.c | 19 +++++++++---------- arch/x86/kernel/setup.c | 10 ++++++++++ 3 files changed, 25 insertions(+), 10 deletions(-) diff --git a/arch/x86/include/asm/setup.h b/arch/x86/include/asm/setup.h index 5c83729c8e71..5c8f5b0d0f9f 100644 --- a/arch/x86/include/asm/setup.h +++ b/arch/x86/include/asm/setup.h @@ -117,6 +117,12 @@ void *extend_brk(size_t size, size_t align); __section(".bss..brk") __aligned(1) __used \ static char __brk_##name[size] +#ifdef CONFIG_AMD_MEM_ENCRYPT +void snp_prep_rom_range(void); +#else +static inline void snp_prep_rom_range(void) { } +#endif + extern void probe_roms(void); void clear_bss(void); diff --git a/arch/x86/kernel/probe_roms.c b/arch/x86/kernel/probe_roms.c index 319fef37d9dc..83b192f5e3cc 100644 --- a/arch/x86/kernel/probe_roms.c +++ b/arch/x86/kernel/probe_roms.c @@ -196,6 +196,15 @@ static int __init romchecksum(const unsigned char *rom, unsigned long length) return !length && !sum; } +#ifdef CONFIG_AMD_MEM_ENCRYPT +void __init snp_prep_rom_range(void) +{ + snp_prep_memory(video_rom_resource.start, + ((system_rom_resource.end + 1) - video_rom_resource.start), + SNP_PAGE_STATE_PRIVATE); +} +#endif + void __init probe_roms(void) { unsigned long start, length, upper; @@ -203,16 +212,6 @@ void __init probe_roms(void) unsigned char c; int i; - /* - * The ROM memory range is not part of the e820 table and is therefore not - * pre-validated by BIOS. The kernel page table maps the ROM region as encrypted - * memory, and SNP requires encrypted memory to be validated before access. - * Do that here. - */ - snp_prep_memory(video_rom_resource.start, - ((system_rom_resource.end + 1) - video_rom_resource.start), - SNP_PAGE_STATE_PRIVATE); - /* video rom */ upper = adapter_rom_resources[0].start; for (start = video_rom_resource.start; start < upper; start += 2048) { diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c index 84201071dfac..19f870728486 100644 --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c @@ -902,6 +902,16 @@ void __init setup_arch(char **cmdline_p) efi_init(); reserve_ibft_region(); + + /* + * The ROM memory range is not part of the e820 table and is therefore not + * pre-validated by BIOS. The kernel page table maps the ROM region as encrypted + * memory, and SNP requires encrypted memory to be validated before access. + * This should be done before dmi_setup(), which may access the ROM region + * even before probe_roms() is called. + */ + snp_prep_rom_range(); + dmi_setup(); /*