Re: [PATCH Part1 v5 31/38] x86/compressed/64: add identity mapping for Confidential Computing blob
From: Borislav Petkov <bp@alien8.de>
Date: 2021-08-27 14:43:21
Also in:
kvm, linux-efi, linux-mm, lkml, platform-driver-x86
On Fri, Aug 20, 2021 at 10:19:26AM -0500, Brijesh Singh wrote:
quoted hunk ↗ jump to hunk
diff --git a/arch/x86/boot/compressed/ident_map_64.c b/arch/x86/boot/compressed/ident_map_64.c index 3cf7a7575f5c..54374e0f0257 100644 --- a/arch/x86/boot/compressed/ident_map_64.c +++ b/arch/x86/boot/compressed/ident_map_64.c@@ -37,6 +37,9 @@ #include <asm/setup.h> /* For COMMAND_LINE_SIZE */ #undef _SETUP +#define __BOOT_COMPRESSED +#include <asm/sev.h> /* For sev_snp_active() + ConfidentialComputing blob */ +
When you move all the cc_blob parsing to the compressed kernel, all that ugly ifdeffery won't be needed.
quoted hunk ↗ jump to hunk
extern unsigned long get_cmd_line_ptr(void); /* Used by PAGE_KERN* macros: */@@ -163,6 +166,21 @@ void initialize_identity_maps(void *rmode) cmdline = get_cmd_line_ptr(); add_identity_map(cmdline, cmdline + COMMAND_LINE_SIZE);
Carve that ...
+ /*
+ * The ConfidentialComputing blob is used very early in uncompressed
+ * kernel to find CPUID memory to handle cpuid instructions. Make sure
+ * an identity-mapping exists so they can be accessed after switchover.
+ */
+ if (sev_snp_enabled()) {
+ struct cc_blob_sev_info *cc_info =
+ (void *)(unsigned long)boot_params->cc_blob_address;
+
+ add_identity_map((unsigned long)cc_info,
+ (unsigned long)cc_info + sizeof(*cc_info));
+ add_identity_map((unsigned long)cc_info->cpuid_phys,
+ (unsigned long)cc_info->cpuid_phys + cc_info->cpuid_len);
+ }
+
/* Load the new page-table. */
sev_verify_cbit(top_level_pgt);... up to here into a separate function called sev_prep_identity_maps() so that SEV-specific code flow is not in the generic code path.
write_cr3(top_level_pgt);
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette