x86, tboot: Add support for S3 memory integrity protection

This patch adds support for S3 memory integrity protection within an Intel(R)
TXT launched kernel, for all kernel and userspace memory.  All RAM used by the
kernel and userspace, as indicated by memory ranges of type E820_RAM and
E820_RESERVED_KERN in the e820 table, will be integrity protected.

The MAINTAINERS file is also updated to reflect the maintainers of the
TXT-related code.

All MACing is done in tboot, based on a complexity analysis and tradeoff.

v3: Compared with v2, this patch adds a check of array size in
tboot.c, and a note to specify which c/s of tboot supports this kind
of MACing in intel_txt.txt.

Signed-off-by: Shane Wang <shane.wang@intel.com>
LKML-Reference: <4B973DDA.6050902@intel.com>
Signed-off-by: Joseph Cihula <joseph.cihula@intel.com>
Acked-by: Pavel Machek <pavel@ucw.cz>
Acked-by: Rafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>

1 files changed, 11 insertions, 9 deletions

diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c
index 86c9f91b48ae..cc2c60474fd0 100644
--- a/arch/x86/kernel/tboot.c
+++ b/arch/x86/kernel/tboot.c
@@ -175,6 +175,9 @@ static void add_mac_region(phys_addr_t start, unsigned long size)
         struct tboot_mac_region *mr;
         phys_addr_t end = start + size;
 
+        if (tboot->num_mac_regions >= MAX_TB_MAC_REGIONS)
+                panic("tboot: Too many MAC regions\n");
+
         if (start && size) {
                 mr = &tboot->mac_regions[tboot->num_mac_regions++];
                 mr->start = round_down(start, PAGE_SIZE);
@@ -184,18 +187,17 @@ static void add_mac_region(phys_addr_t start, unsigned long size)
 
 static int tboot_setup_sleep(void)
 {
+        int i;
+
         tboot->num_mac_regions = 0;
 
-        /* S3 resume code */
-        add_mac_region(acpi_wakeup_address, WAKEUP_SIZE);
+        for (i = 0; i < e820.nr_map; i++) {
+                if ((e820.map[i].type != E820_RAM)
+                 && (e820.map[i].type != E820_RESERVED_KERN))
+                        continue;
 
-#ifdef CONFIG_X86_TRAMPOLINE
-        /* AP trampoline code */
-        add_mac_region(virt_to_phys(trampoline_base), TRAMPOLINE_SIZE);
-#endif
-
-        /* kernel code + data + bss */
-        add_mac_region(virt_to_phys(_text), _end - _text);
+                add_mac_region(e820.map[i].addr, e820.map[i].size);
+        }
 
         tboot->acpi_sinfo.kernel_s3_resume_vector = acpi_wakeup_address;