Re: [RFC PATCH v1 09/28] x86/efi: Access EFI data as encrypted when SEV is active

From	Borislav Petkov <bp@suse.de>
Newsgroups	linux.kernel
Subject	Re: [RFC PATCH v1 09/28] x86/efi: Access EFI data as encrypted when SEV is active
Date	2016-09-22 19:30 +0200
Message-ID	<skfYS-NW-11@gated-at.bofh.it> (permalink)
References	(3 earlier) <skdu1-7CL-19@gated-at.bofh.it> <skdNn-7ZV-17@gated-at.bofh.it> <skdNn-7ZV-15@gated-at.bofh.it> <skfFv-Hc-9@gated-at.bofh.it> <skfFv-Hc-7@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Thu, Sep 22, 2016 at 07:08:50PM +0200, Paolo Bonzini wrote:
> That's not how I read it.  I just figured that the BIOS has some magic
> things high in the physical address space and if you reduce the physical
> address space the BIOS (which is called from e.g. EFI runtime services)
> would have problems with that.

Yeah, I had to ask about that myself and Tom will have it explained
better in the next version.

The reduction in physical address space happens when SME enabled because
you need a couple of bits in the PTE with which to say which key has
encrypted that page. So it is an indelible part of the SME machinery.

Btw, section "7.10 Secure Memory Encryption" has an initial writeup:

http://support.amd.com/TechDocs/24593.pdf

Now that I skim over it, it doesn't mention the BIOS thing but that'll
be updated.

HTH.

-- 
Regards/Gruss,
    Boris.

SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
--

Thread

Re: [RFC PATCH v1 09/28] x86/efi: Access EFI data as encrypted when  SEV is active Borislav Petkov <bp@suse.de> - 2016-09-22 16:40 +0200
  Re: [RFC PATCH v1 09/28] x86/efi: Access EFI data as encrypted when  SEV is active Paolo Bonzini <pbonzini@redhat.com> - 2016-09-22 16:50 +0200
    Re: [RFC PATCH v1 09/28] x86/efi: Access EFI data as encrypted when  SEV is active Paolo Bonzini <pbonzini@redhat.com> - 2016-09-22 17:10 +0200
      Re: [RFC PATCH v1 09/28] x86/efi: Access EFI data as encrypted when  SEV is active Paolo Bonzini <pbonzini@redhat.com> - 2016-09-22 19:10 +0200
        Re: [RFC PATCH v1 09/28] x86/efi: Access EFI data as encrypted when  SEV is active Borislav Petkov <bp@suse.de> - 2016-09-22 19:30 +0200
      Re: [RFC PATCH v1 09/28] x86/efi: Access EFI data as encrypted when  SEV is active Borislav Petkov <bp@suse.de> - 2016-09-22 19:10 +0200
        Re: [RFC PATCH v1 09/28] x86/efi: Access EFI data as encrypted when  SEV is active Borislav Petkov <bp@suse.de> - 2016-09-22 21:20 +0200
          Re: [RFC PATCH v1 09/28] x86/efi: Access EFI data as encrypted when  SEV is active Borislav Petkov <bp@suse.de> - 2016-09-22 22:20 +0200
    Re: [RFC PATCH v1 09/28] x86/efi: Access EFI data as encrypted when  SEV is active Borislav Petkov <bp@suse.de> - 2016-09-22 17:10 +0200
    Re: [RFC PATCH v1 09/28] x86/efi: Access EFI data as encrypted when  SEV is active Paolo Bonzini <pbonzini@redhat.com> - 2016-09-22 21:00 +0200
  Re: [RFC PATCH v1 09/28] x86/efi: Access EFI data as encrypted when  SEV is active Paolo Bonzini <pbonzini@redhat.com> - 2016-09-22 20:30 +0200
    Re: [RFC PATCH v1 09/28] x86/efi: Access EFI data as encrypted when  SEV is active Borislav Petkov <bp@suse.de> - 2016-09-22 20:40 +0200
      Re: [RFC PATCH v1 09/28] x86/efi: Access EFI data as encrypted when  SEV is active Kai Huang <kaih.linux@gmail.com> - 2016-09-23 11:40 +0200
        Re: [RFC PATCH v1 09/28] x86/efi: Access EFI data as encrypted when  SEV is active Borislav Petkov <bp@suse.de> - 2016-09-23 12:00 +0200

csiph-web