linux-kernel - Re: [PATCH] x86/sev-es: Invalidate the GHCB after completing VMGEXIT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YKJio9XDepU+CR28@suse.de>
Date:   Mon, 17 May 2021 14:33:39 +0200
From:   Joerg Roedel <jroedel@...e.de>
To:     Tom Lendacky <thomas.lendacky@....com>
Cc:     linux-kernel@...r.kernel.org, x86@...nel.org,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        Paolo Bonzini <pbonzini@...hat.com>,
        Jim Mattson <jmattson@...gle.com>,
        Sean Christopherson <seanjc@...gle.com>,
        Vitaly Kuznetsov <vkuznets@...hat.com>,
        Wanpeng Li <wanpengli@...cent.com>,
        Brijesh Singh <brijesh.singh@....com>
Subject: Re: [PATCH] x86/sev-es: Invalidate the GHCB after completing VMGEXIT

Hi Tom,

On Fri, May 14, 2021 at 02:12:33PM -0500, Tom Lendacky wrote:
>  arch/x86/kernel/sev-shared.c |  1 +
>  arch/x86/kernel/sev.c        | 37 ++++++++++++++++++------------------
>  2 files changed, 20 insertions(+), 18 deletions(-)

Having this change in one patch is okay. No need to split it up.

> +static __always_inline void sev_es_put_ghcb(struct ghcb_state *state)
> +{
> +	struct sev_es_runtime_data *data;
> +	struct ghcb *ghcb;
> +
> +	data = this_cpu_read(runtime_data);
> +	ghcb = &data->ghcb_page;
> +
> +	if (state->ghcb) {
> +		/* Restore GHCB from Backup */
> +		*ghcb = *state->ghcb;
> +		data->backup_ghcb_active = false;
> +		state->ghcb = NULL;
> +	} else {
> +		vc_ghcb_invalidate(ghcb);

A comment would be good to explain why the invalidate here is
necessary.

Regards,

	Joerg