linux-kernel - Re: [PATCH v13 19/19] x86/efi: EFI stub DRTM launch support for Secure Launch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAMj1kXEAZS+839zmpW3WfwvTRMZmRbPYGpEoY=Xj9qFch9J7BA@mail.gmail.com>
Date: Wed, 9 Apr 2025 11:15:34 +0200
From: Ard Biesheuvel <ardb@...nel.org>
To: Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>
Cc: ross.philipson@...cle.com, hpa@...or.com, linux-kernel@...r.kernel.org, 
	x86@...nel.org, linux-integrity@...r.kernel.org, linux-doc@...r.kernel.org, 
	linux-crypto@...r.kernel.org, kexec@...ts.infradead.org, 
	linux-efi@...r.kernel.org, iommu@...ts.linux.dev, 
	dpsmith@...rtussolutions.com, tglx@...utronix.de, mingo@...hat.com, 
	bp@...en8.de, dave.hansen@...ux.intel.com, mjg59@...f.ucam.org, 
	James.Bottomley@...senpartnership.com, peterhuewe@....de, jarkko@...nel.org, 
	jgg@...pe.ca, luto@...capital.net, nivedita@...m.mit.edu, 
	herbert@...dor.apana.org.au, davem@...emloft.net, corbet@....net, 
	ebiederm@...ssion.com, dwmw2@...radead.org, baolu.lu@...ux.intel.com, 
	kanth.ghatraju@...cle.com, andrew.cooper3@...rix.com, 
	trenchboot-devel@...glegroups.com
Subject: Re: [PATCH v13 19/19] x86/efi: EFI stub DRTM launch support for
 Secure Launch

On Wed, 9 Apr 2025 at 00:35, Konrad Rzeszutek Wilk
<konrad.wilk@...cle.com> wrote:
>
> ..snip..
> > > > @@ -925,6 +1014,11 @@ void __noreturn efi_stub_entry(efi_handle_t handle,
> > > >           goto fail;
> > > >   }
> > > >
> > > > +#if (IS_ENABLED(CONFIG_SECURE_LAUNCH))
> > > > + /* If a Secure Launch is in progress, this never returns */
> > > > + efi_secure_launch(boot_params);
> > > > +#endif
> > > > +
> > > >   /*
> > > >    * Call the SEV init code while still running with the firmware's
> > > >    * GDT/IDT, so #VC exceptions will be handled by EFI.
> > >
> > > efi_set_u64_form()?
> > >
> > > What the heck is that? If it actually involves two u32 packed into a 64 field, why not simply do two stores?
> > >
> >
> > Well the story is this. The EFI maintainers asked me to use the
> > efi_set_u64_split() type functions (this one splits a u64 into 2 u32). I
> > went to look and there was no function that did the opposite action so I
> > added it. The original function was called efi_set_u64_split() so
> > efi_set_u64_form() was what I came up with. I can name it anything that is
> > desired.
>
> Hey Peter,
>
> Is there anything in particular that needs to be done to this patch?
>

If anyone feels strongly enough about this, we can fix it in a
follow-up patch. The code works as expected, so no need to derail this
series even further.