lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 22 Sep 2016 16:59:47 +0200 From: Borislav Petkov <bp@...e.de> To: Paolo Bonzini <pbonzini@...hat.com> Cc: Brijesh Singh <brijesh.singh@....com>, thomas.lendacky@....com, simon.guinot@...uanux.org, linux-efi@...r.kernel.org, kvm@...r.kernel.org, rkrcmar@...hat.com, matt@...eblueprint.co.uk, linus.walleij@...aro.org, linux-mm@...ck.org, paul.gortmaker@...driver.com, hpa@...or.com, dan.j.williams@...el.com, aarcange@...hat.com, sfr@...b.auug.org.au, andriy.shevchenko@...ux.intel.com, herbert@...dor.apana.org.au, bhe@...hat.com, xemul@...allels.com, joro@...tes.org, x86@...nel.org, mingo@...hat.com, msalter@...hat.com, ross.zwisler@...ux.intel.com, dyoung@...hat.com, jroedel@...e.de, keescook@...omium.org, toshi.kani@....com, mathieu.desnoyers@...icios.com, devel@...uxdriverproject.org, tglx@...utronix.de, mchehab@...nel.org, iamjoonsoo.kim@....com, labbott@...oraproject.org, tony.luck@...el.com, alexandre.bounine@....com, kuleshovmail@...il.com, linux-kernel@...r.kernel.org, mcgrof@...nel.org, linux-crypto@...r.kernel.org, akpm@...ux-foundation.org, davem@...emloft.net Subject: Re: [RFC PATCH v1 09/28] x86/efi: Access EFI data as encrypted when SEV is active On Thu, Sep 22, 2016 at 04:45:51PM +0200, Paolo Bonzini wrote: > The main difference between the SME and SEV encryption, from the point > of view of the kernel, is that real-mode always writes unencrypted in > SME and always writes encrypted in SEV. But UEFI can run in 64-bit mode > and learn about the C bit, so EFI boot data should be unprotected in SEV > guests. Actually, it is different: you can start fully encrypted in SME, see: https://lkml.kernel.org/r/20160822223539.29880.96739.stgit@tlendack-t1.amdoffice.net The last paragraph alludes to a certain transparent mode where you're already encrypted and only certain pieces like EFI is not encrypted. I think the aim is to have the transparent mode be the default one, which makes most sense anyway. The EFI regions are unencrypted for obvious reasons and you need to access them as such. > Because the firmware volume is written to high memory in encrypted > form, and because the PEI phase runs in 32-bit mode, the firmware > code will be encrypted; on the other hand, data that is placed in low > memory for the kernel can be unencrypted, thus limiting differences > between SME and SEV. When you run fully encrypted, you still need to access EFI tables in the clear. That's why I'm confused about this patch here. -- Regards/Gruss, Boris. SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg) --
Powered by blists - more mailing lists