lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 23 May 2020 09:59:24 +0200 From: Borislav Petkov <bp@...en8.de> To: Joerg Roedel <joro@...tes.org> Cc: x86@...nel.org, hpa@...or.com, Andy Lutomirski <luto@...nel.org>, Dave Hansen <dave.hansen@...ux.intel.com>, Peter Zijlstra <peterz@...radead.org>, Thomas Hellstrom <thellstrom@...are.com>, Jiri Slaby <jslaby@...e.cz>, Dan Williams <dan.j.williams@...el.com>, Tom Lendacky <thomas.lendacky@....com>, Juergen Gross <jgross@...e.com>, Kees Cook <keescook@...omium.org>, David Rientjes <rientjes@...gle.com>, Cfir Cohen <cfir@...gle.com>, Erdem Aktas <erdemaktas@...gle.com>, Masami Hiramatsu <mhiramat@...nel.org>, Mike Stunes <mstunes@...are.com>, Joerg Roedel <jroedel@...e.de>, linux-kernel@...r.kernel.org, kvm@...r.kernel.org, virtualization@...ts.linux-foundation.org Subject: Re: [PATCH v3 47/75] x86/sev-es: Add Runtime #VC Exception Handler On Tue, Apr 28, 2020 at 05:16:57PM +0200, Joerg Roedel wrote: > diff --git a/arch/x86/kernel/sev-es.c b/arch/x86/kernel/sev-es.c > index a4fa7f351bf2..bc3a58427028 100644 > --- a/arch/x86/kernel/sev-es.c > +++ b/arch/x86/kernel/sev-es.c > @@ -10,6 +10,7 @@ > #include <linux/sched/debug.h> /* For show_regs() */ > #include <linux/percpu-defs.h> > #include <linux/mem_encrypt.h> > +#include <linux/lockdep.h> > #include <linux/printk.h> > #include <linux/mm_types.h> > #include <linux/set_memory.h> > @@ -25,7 +26,7 @@ > #include <asm/insn-eval.h> > #include <asm/fpu/internal.h> > #include <asm/processor.h> > -#include <asm/trap_defs.h> > +#include <asm/traps.h> > #include <asm/svm.h> > > /* For early boot hypervisor communication in SEV-ES enabled guests */ > @@ -46,10 +47,26 @@ struct sev_es_runtime_data { > > /* Physical storage for the per-cpu IST stacks of the #VC handler */ > struct vmm_exception_stacks vc_stacks __aligned(PAGE_SIZE); > + > + /* Reserve on page per CPU as backup storage for the unencrypted GHCB */ one > + struct ghcb backup_ghcb; I could use some text explaining what those backups are for? > + /* > + * Mark the per-cpu GHCBs as in-use to detect nested #VC exceptions. > + * There is no need for it to be atomic, because nothing is written to > + * the GHCB between the read and the write of ghcb_active. So it is safe > + * to use it when a nested #VC exception happens before the write. > + */ Looks liks that is that text... support for nested #VC exceptions. I'm sure this has come up already but why do we even want to support nested #VCs? IOW, can we do without them first or are they absolutely necessary? I'm guessing VC exceptions inside the VC handler but what are the sensible use cases? Thx. -- Regards/Gruss, Boris. https://people.kernel.org/tglx/notes-about-netiquette
Powered by blists - more mailing lists