lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 27 Oct 2020 12:09:45 +0100 From: Borislav Petkov <bp@...en8.de> To: Joerg Roedel <joro@...tes.org> Cc: x86@...nel.org, Joerg Roedel <jroedel@...e.de>, Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>, "H. Peter Anvin" <hpa@...or.com>, Dave Hansen <dave.hansen@...ux.intel.com>, Andy Lutomirski <luto@...nel.org>, Peter Zijlstra <peterz@...radead.org>, Kees Cook <keescook@...omium.org>, Arvind Sankar <nivedita@...m.mit.edu>, Martin Radev <martin.b.radev@...il.com>, Tom Lendacky <thomas.lendacky@....com>, linux-kernel@...r.kernel.org Subject: Re: [PATCH v3 3/5] x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path On Wed, Oct 21, 2020 at 02:39:36PM +0200, Joerg Roedel wrote: > From: Joerg Roedel <jroedel@...e.de> > > Check whether the hypervisor reported the correct C-bit when running as > an SEV guest. Using a wrong C-bit position could be used to leak > sensitive data from the guest to the hypervisor. > > The check function is in arch/x86/kernel/sev_verify_cbit.S so that it > can be re-used in the running kernel image. > > Signed-off-by: Joerg Roedel <jroedel@...e.de> > --- > arch/x86/boot/compressed/ident_map_64.c | 1 + > arch/x86/boot/compressed/mem_encrypt.S | 4 ++ > arch/x86/boot/compressed/misc.h | 2 + > arch/x86/kernel/sev_verify_cbit.S | 90 +++++++++++++++++++++++++ > 4 files changed, 97 insertions(+) > create mode 100644 arch/x86/kernel/sev_verify_cbit.S > > diff --git a/arch/x86/boot/compressed/ident_map_64.c b/arch/x86/boot/compressed/ident_map_64.c > index 063a60edcf99..73abba3312a7 100644 > --- a/arch/x86/boot/compressed/ident_map_64.c > +++ b/arch/x86/boot/compressed/ident_map_64.c > @@ -153,6 +153,7 @@ void initialize_identity_maps(void) > * into cr3. > */ > add_identity_map((unsigned long)_head, (unsigned long)_end); > + sev_verify_cbit(top_level_pgt); > write_cr3(top_level_pgt); > } Btw, might wanna redo them ontop of -rc1 because this looks like this after Arvind's three fixes: diff --git a/arch/x86/boot/compressed/ident_map_64.c b/arch/x86/boot/compressed/ident_map_64.c index a5e5db6ada3c..81f6003553f8 100644 --- a/arch/x86/boot/compressed/ident_map_64.c +++ b/arch/x86/boot/compressed/ident_map_64.c @@ -162,6 +162,7 @@ void initialize_identity_maps(void *rmode) add_identity_map((unsigned long)boot_params, (unsigned long)(boot_params + 1)); cmdline = get_cmd_line_ptr(); add_identity_map(cmdline, cmdline + COMMAND_LINE_SIZE); + sev_verify_cbit(top_level_pgt); /* Load the new page-table. */ write_cr3(top_level_pgt); -- Regards/Gruss, Boris. https://people.kernel.org/tglx/notes-about-netiquette
Powered by blists - more mailing lists