| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <1536616151-16738-2-git-send-email-brijesh.singh@amd.com>
Date: Mon, 10 Sep 2018 16:49:07 -0500
From: Brijesh Singh <brijesh.singh@....com>
To: x86@...nel.org, linux-kernel@...r.kernel.org, kvm@...r.kernel.org
Cc: Brijesh Singh <brijesh.singh@....com>,
Tom Lendacky <thomas.lendacky@....com>,
Thomas Gleixner <tglx@...utronix.de>,
Borislav Petkov <bp@...e.de>, "H. Peter Anvin" <hpa@...or.com>,
Paolo Bonzini <pbonzini@...hat.com>,
Sean Christopherson <sean.j.christopherson@...el.com>,
Radim Krčmář <rkrcmar@...hat.com>
Subject: [PATCH v7 1/5] x86/mm: Restructure sme_encrypt_kernel()
Re-arrange the sme_encrypt_kernel() by moving the workarea map/unmap
logic in a separate static function. There are no logical changes in this
patch. The restructuring will allow us to expand the sme_encrypt_kernel
in future.
Signed-off-by: Brijesh Singh <brijesh.singh@....com>
Reviewed-by: Tom Lendacky <thomas.lendacky@....com>
Reviewed-by: Borislav Petkov <bp@...e.de>
Cc: Tom Lendacky <thomas.lendacky@....com>
Cc: kvm@...r.kernel.org
Cc: Thomas Gleixner <tglx@...utronix.de>
Cc: Borislav Petkov <bp@...e.de>
Cc: "H. Peter Anvin" <hpa@...or.com>
Cc: linux-kernel@...r.kernel.org
Cc: Paolo Bonzini <pbonzini@...hat.com>
Cc: Sean Christopherson <sean.j.christopherson@...el.com>
Cc: "Radim Krčmář" <rkrcmar@...hat.com>
---
arch/x86/mm/mem_encrypt_identity.c | 160 ++++++++++++++++++++++++-------------
1 file changed, 104 insertions(+), 56 deletions(-)
diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c
index a19ef1a..f488d46 100644
--- a/arch/x86/mm/mem_encrypt_identity.c
+++ b/arch/x86/mm/mem_encrypt_identity.c
@@ -73,6 +73,22 @@ struct sme_populate_pgd_data {
unsigned long vaddr_end;
};
+struct sme_workarea_data {
+ unsigned long kernel_start;
+ unsigned long kernel_end;
+ unsigned long kernel_len;
+
+ unsigned long initrd_start;
+ unsigned long initrd_end;
+ unsigned long initrd_len;
+
+ unsigned long workarea_start;
+ unsigned long workarea_end;
+ unsigned long workarea_len;
+
+ unsigned long decrypted_base;
+};
+
static char sme_cmdline_arg[] __initdata = "mem_encrypt";
static char sme_cmdline_on[] __initdata = "on";
static char sme_cmdline_off[] __initdata = "off";
@@ -267,19 +283,17 @@ static unsigned long __init sme_pgtable_calc(unsigned long len)
return entries + tables;
}
-void __init sme_encrypt_kernel(struct boot_params *bp)
+static void __init build_workarea_map(struct boot_params *bp,
+ struct sme_workarea_data *wa,
+ struct sme_populate_pgd_data *ppd)
{
unsigned long workarea_start, workarea_end, workarea_len;
unsigned long execute_start, execute_end, execute_len;
unsigned long kernel_start, kernel_end, kernel_len;
unsigned long initrd_start, initrd_end, initrd_len;
- struct sme_populate_pgd_data ppd;
unsigned long pgtable_area_len;
unsigned long decrypted_base;
- if (!sme_active())
- return;
-
/*
* Prepare for encrypting the kernel and initrd by building new
* pagetables with the necessary attributes needed to encrypt the
@@ -359,17 +373,17 @@ void __init sme_encrypt_kernel(struct boot_params *bp)
* pagetables and when the new encrypted and decrypted kernel
* mappings are populated.
*/
- ppd.pgtable_area = (void *)execute_end;
+ ppd->pgtable_area = (void *)execute_end;
/*
* Make sure the current pagetable structure has entries for
* addressing the workarea.
*/
- ppd.pgd = (pgd_t *)native_read_cr3_pa();
- ppd.paddr = workarea_start;
- ppd.vaddr = workarea_start;
- ppd.vaddr_end = workarea_end;
- sme_map_range_decrypted(&ppd);
+ ppd->pgd = (pgd_t *)native_read_cr3_pa();
+ ppd->paddr = workarea_start;
+ ppd->vaddr = workarea_start;
+ ppd->vaddr_end = workarea_end;
+ sme_map_range_decrypted(ppd);
/* Flush the TLB - no globals so cr3 is enough */
native_write_cr3(__native_read_cr3());
@@ -380,9 +394,9 @@ void __init sme_encrypt_kernel(struct boot_params *bp)
* then be populated with new PUDs and PMDs as the encrypted and
* decrypted kernel mappings are created.
*/
- ppd.pgd = ppd.pgtable_area;
- memset(ppd.pgd, 0, sizeof(pgd_t) * PTRS_PER_PGD);
- ppd.pgtable_area += sizeof(pgd_t) * PTRS_PER_PGD;
+ ppd->pgd = ppd->pgtable_area;
+ memset(ppd->pgd, 0, sizeof(pgd_t) * PTRS_PER_PGD);
+ ppd->pgtable_area += sizeof(pgd_t) * PTRS_PER_PGD;
/*
* A different PGD index/entry must be used to get different
@@ -400,75 +414,109 @@ void __init sme_encrypt_kernel(struct boot_params *bp)
decrypted_base <<= PGDIR_SHIFT;
/* Add encrypted kernel (identity) mappings */
- ppd.paddr = kernel_start;
- ppd.vaddr = kernel_start;
- ppd.vaddr_end = kernel_end;
- sme_map_range_encrypted(&ppd);
+ ppd->paddr = kernel_start;
+ ppd->vaddr = kernel_start;
+ ppd->vaddr_end = kernel_end;
+ sme_map_range_encrypted(ppd);
/* Add decrypted, write-protected kernel (non-identity) mappings */
- ppd.paddr = kernel_start;
- ppd.vaddr = kernel_start + decrypted_base;
- ppd.vaddr_end = kernel_end + decrypted_base;
- sme_map_range_decrypted_wp(&ppd);
+ ppd->paddr = kernel_start;
+ ppd->vaddr = kernel_start + decrypted_base;
+ ppd->vaddr_end = kernel_end + decrypted_base;
+ sme_map_range_decrypted_wp(ppd);
if (initrd_len) {
/* Add encrypted initrd (identity) mappings */
- ppd.paddr = initrd_start;
- ppd.vaddr = initrd_start;
- ppd.vaddr_end = initrd_end;
- sme_map_range_encrypted(&ppd);
+ ppd->paddr = initrd_start;
+ ppd->vaddr = initrd_start;
+ ppd->vaddr_end = initrd_end;
+ sme_map_range_encrypted(ppd);
/*
* Add decrypted, write-protected initrd (non-identity) mappings
*/
- ppd.paddr = initrd_start;
- ppd.vaddr = initrd_start + decrypted_base;
- ppd.vaddr_end = initrd_end + decrypted_base;
- sme_map_range_decrypted_wp(&ppd);
+ ppd->paddr = initrd_start;
+ ppd->vaddr = initrd_start + decrypted_base;
+ ppd->vaddr_end = initrd_end + decrypted_base;
+ sme_map_range_decrypted_wp(ppd);
}
/* Add decrypted workarea mappings to both kernel mappings */
- ppd.paddr = workarea_start;
- ppd.vaddr = workarea_start;
- ppd.vaddr_end = workarea_end;
- sme_map_range_decrypted(&ppd);
+ ppd->paddr = workarea_start;
+ ppd->vaddr = workarea_start;
+ ppd->vaddr_end = workarea_end;
+ sme_map_range_decrypted(ppd);
- ppd.paddr = workarea_start;
- ppd.vaddr = workarea_start + decrypted_base;
- ppd.vaddr_end = workarea_end + decrypted_base;
- sme_map_range_decrypted(&ppd);
+ ppd->paddr = workarea_start;
+ ppd->vaddr = workarea_start + decrypted_base;
+ ppd->vaddr_end = workarea_end + decrypted_base;
+ sme_map_range_decrypted(ppd);
- /* Perform the encryption */
- sme_encrypt_execute(kernel_start, kernel_start + decrypted_base,
- kernel_len, workarea_start, (unsigned long)ppd.pgd);
+ wa->kernel_start = kernel_start;
+ wa->kernel_end = kernel_end;
+ wa->kernel_len = kernel_len;
- if (initrd_len)
- sme_encrypt_execute(initrd_start, initrd_start + decrypted_base,
- initrd_len, workarea_start,
- (unsigned long)ppd.pgd);
+ wa->initrd_start = initrd_start;
+ wa->initrd_end = initrd_end;
+ wa->initrd_len = initrd_len;
+
+ wa->workarea_start = workarea_start;
+ wa->workarea_end = workarea_end;
+ wa->workarea_len = workarea_len;
+
+ wa->decrypted_base = decrypted_base;
+}
+static void __init teardown_workarea_map(struct sme_workarea_data *wa,
+ struct sme_populate_pgd_data *ppd)
+{
/*
* At this point we are running encrypted. Remove the mappings for
* the decrypted areas - all that is needed for this is to remove
* the PGD entry/entries.
*/
- ppd.vaddr = kernel_start + decrypted_base;
- ppd.vaddr_end = kernel_end + decrypted_base;
- sme_clear_pgd(&ppd);
-
- if (initrd_len) {
- ppd.vaddr = initrd_start + decrypted_base;
- ppd.vaddr_end = initrd_end + decrypted_base;
- sme_clear_pgd(&ppd);
+ ppd->vaddr = wa->kernel_start + wa->decrypted_base;
+ ppd->vaddr_end = wa->kernel_end + wa->decrypted_base;
+ sme_clear_pgd(ppd);
+
+ if (wa->initrd_len) {
+ ppd->vaddr = wa->initrd_start + wa->decrypted_base;
+ ppd->vaddr_end = wa->initrd_end + wa->decrypted_base;
+ sme_clear_pgd(ppd);
}
- ppd.vaddr = workarea_start + decrypted_base;
- ppd.vaddr_end = workarea_end + decrypted_base;
- sme_clear_pgd(&ppd);
+ ppd->vaddr = wa->workarea_start + wa->decrypted_base;
+ ppd->vaddr_end = wa->workarea_end + wa->decrypted_base;
+ sme_clear_pgd(ppd);
/* Flush the TLB - no globals so cr3 is enough */
native_write_cr3(__native_read_cr3());
}
+void __init sme_encrypt_kernel(struct boot_params *bp)
+{
+ struct sme_populate_pgd_data ppd;
+ struct sme_workarea_data wa;
+
+ if (!sme_active())
+ return;
+
+ build_workarea_map(bp, &wa, &ppd);
+
+ /* When SEV is active, encrypt kernel and initrd */
+ sme_encrypt_execute(wa.kernel_start,
+ wa.kernel_start + wa.decrypted_base,
+ wa.kernel_len, wa.workarea_start,
+ (unsigned long)ppd.pgd);
+
+ if (wa.initrd_len)
+ sme_encrypt_execute(wa.initrd_start,
+ wa.initrd_start + wa.decrypted_base,
+ wa.initrd_len, wa.workarea_start,
+ (unsigned long)ppd.pgd);
+
+ teardown_workarea_map(&wa, &ppd);
+}
+
void __init sme_enable(struct boot_params *bp)
{
const char *cmdline_ptr, *cmdline_arg, *cmdline_on, *cmdline_off;
--
2.7.4
Powered by blists - more mailing lists