Re: [PATCH Part1 v5 31/38] x86/compressed/64: add identity mapping for Confidential Computing blob

[Borislav Petkov]

On Fri, Aug 20, 2021 at 10:19:26AM -0500, Brijesh Singh wrote:
> diff --git a/arch/x86/boot/compressed/ident_map_64.c b/arch/x86/boot/compressed/ident_map_64.c
> index 3cf7a7575f5c..54374e0f0257 100644
> --- a/arch/x86/boot/compressed/ident_map_64.c
> +++ b/arch/x86/boot/compressed/ident_map_64.c
> @@ -37,6 +37,9 @@
>  #include <asm/setup.h>	/* For COMMAND_LINE_SIZE */
>  #undef _SETUP
>  
> +#define __BOOT_COMPRESSED
> +#include <asm/sev.h> /* For sev_snp_active() + ConfidentialComputing blob */
> +

When you move all the cc_blob parsing to the compressed kernel, all that
ugly ifdeffery won't be needed.

>  extern unsigned long get_cmd_line_ptr(void);
>  
>  /* Used by PAGE_KERN* macros: */
> @@ -163,6 +166,21 @@ void initialize_identity_maps(void *rmode)
>  	cmdline = get_cmd_line_ptr();
>  	add_identity_map(cmdline, cmdline + COMMAND_LINE_SIZE);

Carve that ...

> +	/*
> +	 * The ConfidentialComputing blob is used very early in uncompressed
> +	 * kernel to find CPUID memory to handle cpuid instructions. Make sure
> +	 * an identity-mapping exists so they can be accessed after switchover.
> +	 */
> +	if (sev_snp_enabled()) {
> +		struct cc_blob_sev_info *cc_info =
> +			(void *)(unsigned long)boot_params->cc_blob_address;
> +
> +		add_identity_map((unsigned long)cc_info,
> +				 (unsigned long)cc_info + sizeof(*cc_info));
> +		add_identity_map((unsigned long)cc_info->cpuid_phys,
> +				 (unsigned long)cc_info->cpuid_phys + cc_info->cpuid_len);
> +	}
> +
>  	/* Load the new page-table. */
>  	sev_verify_cbit(top_level_pgt);

... up to here into a separate function called sev_prep_identity_maps()
so that SEV-specific code flow is not in the generic code path.

>  	write_cr3(top_level_pgt);

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette