linux-kernel - Re: AMD SME encrpytion and PCI BAR pages to user space

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20201021115933.GS6219@nvidia.com>
Date:   Wed, 21 Oct 2020 08:59:33 -0300
From:   Jason Gunthorpe <jgg@...dia.com>
To:     Tom Lendacky <thomas.lendacky@....com>
CC:     <x86@...nel.org>, <linux-kernel@...r.kernel.org>,
        <linux-arch@...r.kernel.org>, <linux-mm@...ck.org>,
        <kvm@...r.kernel.org>,
        Radim Krčmář <rkrcmar@...hat.com>,
        Arnd Bergmann <arnd@...db.de>,
        Matt Fleming <matt@...eblueprint.co.uk>,
        "Konrad Rzeszutek Wilk" <konrad.wilk@...cle.com>,
        Andrey Ryabinin <aryabinin@...tuozzo.com>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        "Andy Lutomirski" <luto@...nel.org>,
        "H. Peter Anvin" <hpa@...or.com>,
        Paolo Bonzini <pbonzini@...hat.com>,
        Alexander Potapenko <glider@...gle.com>,
        "Thomas Gleixner" <tglx@...utronix.de>,
        Dmitry Vyukov <dvyukov@...gle.com>,
        "Rik van Riel" <riel@...hat.com>,
        Larry Woodman <lwoodman@...hat.com>,
        Dave Young <dyoung@...hat.com>,
        Toshimitsu Kani <toshi.kani@....com>,
        "Michael S. Tsirkin" <mst@...hat.com>,
        Brijesh Singh <brijesh.singh@....com>
Subject: Re: AMD SME encrpytion and PCI BAR pages to user space

On Mon, Oct 19, 2020 at 11:36:16AM -0500, Tom Lendacky wrote:

> > io_remap_pfn_range()? Is there use cases where a caller actually wants
> > encrypted io memory?
> 
> As long as you never have physical memory / ram being mapped in this path,
> it seems that applying pgprot_decrypted() would be ok.

I made a patch along these lines:

https://github.com/jgunthorpe/linux/commits/amd_sme_fix

Just waiting for the 0-day bots to check it

I now have a report that SME works OK but when the same test is done
inside a VM with SEV it fails again - is there something else needed
for the SEV case?

This would be using VFIO with qemu and KVM to assign the PCI device to
the guest, it seems the guest kernel driver is able to use the device
but the guest userspace fails.

Regards,
Jason