linux-kernel - Re: [PATCH v2 0/4] Only export SME/SEV/SEV

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0c3b0565-e80a-2f92-46b4-52f1d70c6f87@amd.com>
Date:   Fri, 11 Feb 2022 15:13:56 -0600
From:   Tom Lendacky <thomas.lendacky@....com>
To:     Mario Limonciello <mario.limonciello@....com>,
        Borislav Petkov <bp@...en8.de>,
        "maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT)" <x86@...nel.org>
Cc:     Kees Cook <keescook@...omium.org>, hughsient@...il.com,
        Martin Fernandez <martin.fernandez@...ypsium.com>,
        linux-kernel@...r.kernel.org, Brijesh Singh <brijesh.singh@....com>
Subject: Re: [PATCH v2 0/4] Only export SME/SEV/SEV_ES features when activated

On 2/11/22 15:02, Mario Limonciello wrote:
> Currently SME/SEV/SEV_ES feature flags will export if the CPU supports
> them but even if the kernel has not enabled the features for any reason.
> 
> To let userspace react to these feature flags, only set them when the
> kernel has activated them.
> 

You really need to wait for more feedback before issuing a new version so 
quickly. Especially since you asked a question about doing this just for 
SME to which I agreed.

Also, you've used cc_platform_has() incorrectly in patches 1 and 2, so SEV 
support is broke in the hypervisor with these changes.

Please just fix the SME concern that you have.

Thanks,
Tom

> changes from v1->v2:
>   * Squash old patches 1/2 together
>   * Add new patches to KVM/CCP code to use `cc_platform_has` instead
>   * Don't use `cc_platform_has` in the early code, just check `sme_me_mask`
>     and `sev_status` directly.
>   * Split out SME and SEV/SEV_ES clearing as separate patches in case
>     SEV/SEV_ES need other more involved work that what is in this series so
>     far.
> 
> Mario Limonciello (4):
>    crypto: ccp: Use cc_platform_has to determine SEV presence
>    KVM: SVM: Use cc_platform_has instead of CPU feature flags
>    x86/cpu: clear SME features when not in use
>    x86/cpu: clear SEV/SEV_ES features when not in use
> 
>   arch/x86/kernel/cpu/amd.c    | 10 ++++++++++
>   arch/x86/kernel/process.c    |  5 ++++-
>   arch/x86/kvm/svm/sev.c       |  4 ++--
>   drivers/crypto/ccp/sev-dev.c |  2 +-
>   4 files changed, 17 insertions(+), 4 deletions(-)
>