lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 15 Jul 2020 11:26:38 +0200 From: Joerg Roedel <jroedel@...e.de> To: Kees Cook <keescook@...omium.org> Cc: Joerg Roedel <joro@...tes.org>, x86@...nel.org, hpa@...or.com, Andy Lutomirski <luto@...nel.org>, Dave Hansen <dave.hansen@...ux.intel.com>, Peter Zijlstra <peterz@...radead.org>, Jiri Slaby <jslaby@...e.cz>, Dan Williams <dan.j.williams@...el.com>, Tom Lendacky <thomas.lendacky@....com>, Juergen Gross <jgross@...e.com>, David Rientjes <rientjes@...gle.com>, Cfir Cohen <cfir@...gle.com>, Erdem Aktas <erdemaktas@...gle.com>, Masami Hiramatsu <mhiramat@...nel.org>, Mike Stunes <mstunes@...are.com>, Sean Christopherson <sean.j.christopherson@...el.com>, Martin Radev <martin.b.radev@...il.com>, linux-kernel@...r.kernel.org, kvm@...r.kernel.org, virtualization@...ts.linux-foundation.org Subject: Re: [PATCH v4 70/75] x86/head/64: Don't call verify_cpu() on starting APs Hi Kees, thanks for your reviews! On Tue, Jul 14, 2020 at 06:40:30PM -0700, Kees Cook wrote: > Eek, no. MSR_IA32_MISC_ENABLE_XD_DISABLE needs to be cleared very early > during CPU startup; this can't just be skipped. That MSR is Intel-only, right? The boot-path installed here is only used for SEV-ES guests, running on AMD systems, so this MSR is not even accessed during boot on those VMs. The alternative is to set up exception handling prior to calling verify_cpu, including segments, stack and IDT. Given that verify_cpu() does not add much value to SEV-ES guests, I'd like to avoid adding this complexity. > Also, is UNWIND_HINT_EMPTY needed for the new target? Yes, I think it is, will add it in the next version. Regards, Joerg
Powered by blists - more mailing lists