linux-kernel - Re: [PATCH v10 07/24] virt: sev-guest: Store VMPCK index to SNP guest device structure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240628035217.GAZn4zcWMZy3mgCKky@fat_crate.local>
Date: Fri, 28 Jun 2024 05:52:17 +0200
From: Borislav Petkov <bp@...en8.de>
To: Nikunj A Dadhania <nikunj@....com>
Cc: linux-kernel@...r.kernel.org, thomas.lendacky@....com, x86@...nel.org,
	kvm@...r.kernel.org, mingo@...hat.com, tglx@...utronix.de,
	dave.hansen@...ux.intel.com, pgonda@...gle.com, seanjc@...gle.com,
	pbonzini@...hat.com
Subject: Re: [PATCH v10 07/24] virt: sev-guest: Store VMPCK index to SNP
 guest device structure

On Fri, Jun 21, 2024 at 06:08:46PM +0530, Nikunj A Dadhania wrote:
> Currently, SEV guest driver retrieves the pointers to VMPCK and
> os_area_msg_seqno from the secrets page. In order to get rid of this
> dependency,

And we do this because...?

> use vmpck_id to index the appropriate key and the corresponding
> message sequence number.
> 
> Signed-off-by: Nikunj A Dadhania <nikunj@....com>
> ---
>  drivers/virt/coco/sev-guest/sev-guest.c | 74 ++++++++++++-------------
>  1 file changed, 37 insertions(+), 37 deletions(-)

...

>  static bool is_vmpck_empty(struct snp_guest_dev *snp_dev)
>  {
>  	char zero_key[VMPCK_KEY_LEN] = {0};
> +	u8 *key = get_vmpck(snp_dev);
>  
> -	if (snp_dev->vmpck)
> -		return !memcmp(snp_dev->vmpck, zero_key, VMPCK_KEY_LEN);
> -
> -	return true;
> +	return !memcmp(key, zero_key, VMPCK_KEY_LEN);

There's a count_nonzero_bytes() function which you can export and use here
instead of expanding the stack unnecessarily.

In any case, there are multiple methods how to check whether a buffer is
zeroes, which are cheaper than this.

> -static u8 *get_vmpck(int id, struct snp_secrets_page *secrets, u32 **seqno)
> +static bool assign_vmpck(struct snp_guest_dev *dev, unsigned int vmpck_id)
>  {
> -	if (!(id < VMPCK_MAX_NUM))
> -		return NULL;
> +	if (!(vmpck_id < VMPCK_MAX_NUM))

Yeah, flip that logic.

> +		return false;
> +
> +	dev->vmpck_id = vmpck_id;
>  
> -	*seqno = &secrets->os_area.msg_seqno[id];
> -	return secrets->vmpck[id];
> +	return true;
>  }

...

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette