linux-kernel - Re: [PATCH v2] x86/efi: Safely enable unaccepted memory in UEFI

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e1986845-9eb9-2147-5073-5d7a45633aba@intel.com>
Date:   Wed, 18 Jan 2023 07:40:05 -0800
From:   Dave Hansen <dave.hansen@...el.com>
To:     Ard Biesheuvel <ardb@...nel.org>,
        Tom Lendacky <thomas.lendacky@....com>,
        Matthew Garrett <mjg59@...f.ucam.org>,
        Mark Rutland <mark.rutland@....com>,
        Borislav Petkov <bp@...en8.de>
Cc:     Gerd Hoffmann <kraxel@...hat.com>,
        "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
        Dionna Glaze <dionnaglaze@...gle.com>,
        linux-kernel@...r.kernel.org, linux-efi@...r.kernel.org,
        x86@...nel.org, jiewen.yao@...el.com, devel@...2.groups.io,
        "Min M. Xu" <min.m.xu@...el.org>,
        James Bottomley <jejb@...ux.ibm.com>,
        Erdem Aktas <erdemaktas@...gle.com>,
        Dave Hansen <dave.hansen@...ux.intel.com>
Subject: Re: [PATCH v2] x86/efi: Safely enable unaccepted memory in UEFI

On 1/18/23 07:09, Ard Biesheuvel wrote:
> However, I guess we're at a point where SEV and TDX really want
> different solutions, so I think divergence might be the way to
> proceed.

I don't think they want different things really.

TDX doesn't need this protocol.  It sounds like SEV does need it,
though.  That doesn't mean they really diverge.  They're *both* going to
have to poke at this protocol knob to get the firmware to not accept the
memory.

This does slightly change the motivation for doing explicit unaccepted
memory support in the kernel.

I also don't know _quite_ how this will look to a guest.  For instance,
will they see different memory maps based on which protocol they are
using?  I assume so, but didn't see any of that explicitly mentioned in
this patch.