linux-kernel - Re: [PATCHv2] x86/mm: Fix memory encryption features advertisement

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 16 Jan 2024 10:36:10 +0000
From: "Huang, Kai" <kai.huang@...el.com>
To: "kirill.shutemov@...ux.intel.com" <kirill.shutemov@...ux.intel.com>,
	"tglx@...utronix.de" <tglx@...utronix.de>, "mingo@...hat.com"
	<mingo@...hat.com>, "bp@...en8.de" <bp@...en8.de>,
	"dave.hansen@...ux.intel.com" <dave.hansen@...ux.intel.com>
CC: "hpa@...or.com" <hpa@...or.com>, "thomas.lendacky@....com"
	<thomas.lendacky@....com>, "linux-coco@...ts.linux.dev"
	<linux-coco@...ts.linux.dev>, "jpiotrowski@...ux.microsoft.com"
	<jpiotrowski@...ux.microsoft.com>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>, "Cui, Dexuan" <decui@...rosoft.com>,
	"x86@...nel.org" <x86@...nel.org>
Subject: Re: [PATCHv2] x86/mm: Fix memory encryption features advertisement

On Thu, 2024-01-11 at 14:12 +0300, Kirill A. Shutemov wrote:
> When memory encryption is enabled, the kernel prints the encryption
> flavor that the system supports.
> 
> The check assumes that everything is AMD SME/SEV if it doesn't have
> the TDX CPU feature set.
> 
> Hyper-V vTOM sets cc_vendor to CC_VENDOR_INTEL when it runs as L2 guest
> on top of TDX, but not X86_FEATURE_TDX_GUEST. Hyper-V only needs memory
> encryption enabled for I/O without the rest of CoCo enabling.
> 
> To avoid confusion, check the cc_vendor directly.
> 
> Possible alternative is to completely removing the print statement.
> For a regular TDX guest, the kernel already prints a message indicating
> that it is booting on TDX. Similarly, AMD and Hyper-V can also display
> a message during their enumeration process.
> 
> Signed-off-by: Kirill A. Shutemov <kirill.shutemov@...ux.intel.com>
> Cc: Dexuan Cui <decui@...rosoft.com>
> Cc: Jeremi Piotrowski <jpiotrowski@...ux.microsoft.com>

Seems this fix is for userspace running in hyperv environment being able to use
some easy grep to get which coco vendor it is running on?

If so I think it would be nice to mention it too.

Acked-by: Kai Huang <kai.huang@...el.com>

> ---
>  arch/x86/mm/mem_encrypt.c | 56 +++++++++++++++++++++------------------
>  1 file changed, 30 insertions(+), 26 deletions(-)
> 
> diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c
> index c290c55b632b..d035bce3a2b0 100644
> --- a/arch/x86/mm/mem_encrypt.c
> +++ b/arch/x86/mm/mem_encrypt.c
> @@ -42,38 +42,42 @@ bool force_dma_unencrypted(struct device *dev)
>  
>  static void print_mem_encrypt_feature_info(void)
>  {
> -	pr_info("Memory Encryption Features active:");
> +	pr_info("Memory Encryption Features active: ");
>  
> -	if (cpu_feature_enabled(X86_FEATURE_TDX_GUEST)) {
> -		pr_cont(" Intel TDX\n");
> -		return;
> -	}
> +	switch (cc_vendor) {
> +	case CC_VENDOR_INTEL:
> +		pr_cont("Intel TDX\n");
> +		break;
> +	case CC_VENDOR_AMD:
> +		pr_cont("AMD");
>  
> -	pr_cont(" AMD");
> -
> -	/* Secure Memory Encryption */
> -	if (cc_platform_has(CC_ATTR_HOST_MEM_ENCRYPT)) {
> +		/* Secure Memory Encryption */
> +		if (cc_platform_has(CC_ATTR_HOST_MEM_ENCRYPT)) {
>  		/*
>  		 * SME is mutually exclusive with any of the SEV
>  		 * features below.
> -		 */
> -		pr_cont(" SME\n");
> -		return;
> +		*/
> +			pr_cont(" SME\n");
> +			return;
> +		}
> +
> +		/* Secure Encrypted Virtualization */
> +		if (cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT))
> +			pr_cont(" SEV");
> +
> +		/* Encrypted Register State */
> +		if (cc_platform_has(CC_ATTR_GUEST_STATE_ENCRYPT))
> +			pr_cont(" SEV-ES");
> +
> +		/* Secure Nested Paging */
> +		if (cc_platform_has(CC_ATTR_GUEST_SEV_SNP))
> +			pr_cont(" SEV-SNP");
> +
> +		pr_cont("\n");
> +		break;
> +	default:
> +		pr_cont("Unknown\n");
>  	}
> -
> -	/* Secure Encrypted Virtualization */
> -	if (cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT))
> -		pr_cont(" SEV");
> -
> -	/* Encrypted Register State */
> -	if (cc_platform_has(CC_ATTR_GUEST_STATE_ENCRYPT))
> -		pr_cont(" SEV-ES");
> -
> -	/* Secure Nested Paging */
> -	if (cc_platform_has(CC_ATTR_GUEST_SEV_SNP))
> -		pr_cont(" SEV-SNP");
> -
> -	pr_cont("\n");
>  }
>  
>  /* Architecture __weak replacement functions */