lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 22 Aug 2016 19:25:51 -0400 From: Brijesh Singh <brijesh.singh@....com> To: <simon.guinot@...uanux.org>, <linux-efi@...r.kernel.org>, <brijesh.singh@....com>, <kvm@...r.kernel.org>, <rkrcmar@...hat.com>, <matt@...eblueprint.co.uk>, <linus.walleij@...aro.org>, <linux-mm@...ck.org>, <paul.gortmaker@...driver.com>, <hpa@...or.com>, <dan.j.williams@...el.com>, <aarcange@...hat.com>, <sfr@...b.auug.org.au>, <andriy.shevchenko@...ux.intel.com>, <herbert@...dor.apana.org.au>, <bhe@...hat.com>, <xemul@...allels.com>, <joro@...tes.org>, <x86@...nel.org>, <mingo@...hat.com>, <msalter@...hat.com>, <ross.zwisler@...ux.intel.com>, <bp@...e.de>, <dyoung@...hat.com>, <thomas.lendacky@....com>, <jroedel@...e.de>, <keescook@...omium.org>, <toshi.kani@....com>, <mathieu.desnoyers@...icios.com>, <devel@...uxdriverproject.org>, <tglx@...utronix.de>, <mchehab@...nel.org>, <iamjoonsoo.kim@....com>, <labbott@...oraproject.org>, <tony.luck@...el.com>, <alexandre.bounine@....com>, <kuleshovmail@...il.com>, <linux-kernel@...r.kernel.org>, <mcgrof@...nel.org>, <linux-crypto@...r.kernel.org>, <pbonzini@...hat.com>, <akpm@...ux-foundation.org>, <davem@...emloft.net> Subject: [RFC PATCH v1 11/28] x86: Don't decrypt trampoline area if SEV is active From: Tom Lendacky <thomas.lendacky@....com> When Secure Encrypted Virtualization is active instruction fetches are always interpreted as being from encrypted memory so the trampoline area must remain encrypted when SEV is active. Signed-off-by: Tom Lendacky <thomas.lendacky@....com> --- arch/x86/realmode/init.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/arch/x86/realmode/init.c b/arch/x86/realmode/init.c index c3edb49..f3207e5 100644 --- a/arch/x86/realmode/init.c +++ b/arch/x86/realmode/init.c @@ -138,10 +138,13 @@ static void __init set_real_mode_permissions(void) /* * If memory encryption is active, the trampoline area will need to * be in non-encrypted memory in order to bring up other processors - * successfully. + * successfully. This only applies to SME, SEV requires the trampoline + * to be encrypted. */ - sme_early_mem_dec(__pa(base), size); - sme_set_mem_dec(base, size); + if (!sev_active) { + sme_early_mem_dec(__pa(base), size); + sme_set_mem_dec(base, size); + } set_memory_nx((unsigned long) base, size >> PAGE_SHIFT); set_memory_ro((unsigned long) base, ro_size >> PAGE_SHIFT);
Powered by blists - more mailing lists