linux-kernel - [PATCH v2 4/4] x86/cpu: clear SEV/SEV

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20220211210255.9820-5-mario.limonciello@amd.com>
Date:   Fri, 11 Feb 2022 15:02:55 -0600
From:   Mario Limonciello <mario.limonciello@....com>
To:     Borislav Petkov <bp@...en8.de>,
        "maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT)" <x86@...nel.org>
CC:     Kees Cook <keescook@...omium.org>,
        Thomas Lendacky <Thomas.Lendacky@....com>,
        <hughsient@...il.com>,
        Martin Fernandez <martin.fernandez@...ypsium.com>,
        <linux-kernel@...r.kernel.org>,
        "Brijesh Singh" <brijesh.singh@....com>,
        Mario Limonciello <mario.limonciello@....com>
Subject: [PATCH v2 4/4] x86/cpu: clear SEV/SEV_ES features when not in use

As there are no consumers for these feature flags in the kernel,
don't export these flags to userspace unless the feature has been
enabled by the guest.

Signed-off-by: Mario Limonciello <mario.limonciello@....com>
---
 arch/x86/kernel/cpu/amd.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 9cea774344cb..6623a4995df1 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -614,12 +614,19 @@ static void early_detect_mem_encrypt(struct cpuinfo_x86 *c)
 		if (!(msr & MSR_K7_HWCR_SMMLOCK))
 			goto clear_sev;
 
+		if (!(sev_status & MSR_AMD64_SEV_ENABLED))
+			goto clear_sev;
+
+		if (!(sev_status & MSR_AMD64_SEV_ES_ENABLED))
+			goto clear_sev_es;
+
 		return;
 
 clear_all:
 		setup_clear_cpu_cap(X86_FEATURE_SME);
 clear_sev:
 		setup_clear_cpu_cap(X86_FEATURE_SEV);
+clear_sev_es:
 		setup_clear_cpu_cap(X86_FEATURE_SEV_ES);
 	}
 }
-- 
2.34.1