linux-kernel - Re: [Part2 PATCH v9 00/38] x86: Secure Encrypted Virtualization (AMD)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 21 Dec 2017 09:51:14 -0600
From:   Brijesh Singh <brijesh.singh@....com>
To:     Paolo Bonzini <pbonzini@...hat.com>, kvm@...r.kernel.org,
        linux-kernel@...r.kernel.org, x86@...nel.org
Cc:     brijesh.singh@....com, bp@...en8.de,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        "H. Peter Anvin" <hpa@...or.com>,
        Radim KrÄmÃ¡Å™ 
        <rkrcmar@...hat.com>, Joerg Roedel <joro@...tes.org>,
        Borislav Petkov <bp@...e.de>,
        Tom Lendacky <thomas.lendacky@....com>,
        Herbert Xu <herbert@...dor.apana.org.au>,
        "David S . Miller" <davem@...emloft.net>,
        Gary Hook <gary.hook@....com>, linux-crypto@...r.kernel.org
Subject: Re: [Part2 PATCH v9 00/38] x86: Secure Encrypted Virtualization (AMD)



On 12/21/17 7:06 AM, Paolo Bonzini wrote:
....

Hi Paolo,
 

> Hi Brijesh,
>
> I have a couple comments:
>
> 1) how is MSR_AMD64_SEV's value passed to the guest, and where is it in
> the manual?

It is a non interceptable read-only MSR set by the HW when SEV feature
is enabled in VMRUN instruction.
>
> 2) ECX should be 0 in the guest's 0x8000_001f leaf, because we don't
> support nested SEV guests.  Likewise, EAX bit 2 should be 0 since you
> don't emulate the page flush MSR.

IIRC, I do clear both EAX Page_Flush and nested virtualization case from
Qemu SEV feature is enabled.
> Both can be fixed on top (and I can do the second myself of course), so
> there should be no need for a v10.  

Thanks