linux-kernel - Re: [RFT PATCH v3 01/21] x86/sev: Separate MSR and GHCB based snp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMj1kXFadOW5pHLWBEdw=wt+5WHpcjY5RdWgyA7pOW149ByEDg@mail.gmail.com>
Date: Thu, 15 May 2025 15:22:14 +0100
From: Ard Biesheuvel <ardb@...nel.org>
To: Borislav Petkov <bp@...en8.de>
Cc: Ard Biesheuvel <ardb+git@...gle.com>, linux-kernel@...r.kernel.org, 
	linux-efi@...r.kernel.org, x86@...nel.org, Ingo Molnar <mingo@...nel.org>, 
	Dionna Amalie Glaze <dionnaglaze@...gle.com>, Kevin Loughlin <kevinloughlin@...gle.com>, 
	Tom Lendacky <thomas.lendacky@....com>
Subject: Re: [RFT PATCH v3 01/21] x86/sev: Separate MSR and GHCB based
 snp_cpuid() via a callback

On Thu, 15 May 2025 at 12:10, Borislav Petkov <bp@...en8.de> wrote:
>
> On Mon, May 12, 2025 at 09:08:36PM +0200, Ard Biesheuvel wrote:
> > From: Ard Biesheuvel <ardb@...nel.org>
> >
> > There are two distinct callers of snp_cpuid(): one where the MSR
> > protocol is always used, and one where the GHCB page based interface is
> > always used.
>
> Yeah, let's stick to the nomenclature, pls: you have a GHCB protocol and a MSR
> protocol. We call both protocols. :)
>
> > The snp_cpuid() logic does not care about the distinction, which only
> > matters at a lower level. But the fact that it supports both interfaces
> > means that the GHCB page based logic is pulled into the early startup
> > code where PA to VA conversions are problematic, given that it runs from
> > the 1:1 mapping of memory.
> >
> > So keep snp_cpuid() itself in the startup code, but factor out the
> > hypervisor calls via a callback, so that the GHCB page handling can be
> > moved out.
> >
> > Code refactoring only - no functional change intended.
> >
> > Signed-off-by: Ard Biesheuvel <ardb@...nel.org>
> > ---
> >  arch/x86/boot/startup/sev-shared.c | 58 ++++----------------
> >  arch/x86/coco/sev/vc-shared.c      | 49 ++++++++++++++++-
> >  arch/x86/include/asm/sev.h         |  3 +-
> >  3 files changed, 61 insertions(+), 49 deletions(-)
>
> ...
>
> > @@ -484,21 +447,21 @@ snp_cpuid_get_validated_func(struct cpuid_leaf *leaf)
> >       return false;
> >  }
> >
> > -static void snp_cpuid_hv(struct ghcb *ghcb, struct es_em_ctxt *ctxt, struct cpuid_leaf *leaf)
> > +static void snp_cpuid_hv_no_ghcb(void *ctx, struct cpuid_leaf *leaf)
>
> Uff, those suffixes make my head hurt. So this is the MSR prot CPUID. Let's
> call it this way:
>
>         snp_cpuid_msr_prot()
>
> and the other one
>
>         snp_cpuid_ghcb_prot()
>
> All clear this way.
>
> >  {
> > -     if (sev_cpuid_hv(ghcb, ctxt, leaf))
> > +     if (__sev_cpuid_hv_msr(leaf))
>
> __sev_cpuid_msr_prot
>
> >               sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_CPUID_HV);
> >  }
> >
> >  static int __heada
>
> Let's zap that ugly linebreak.
>
> > -snp_cpuid_postprocess(struct ghcb *ghcb, struct es_em_ctxt *ctxt,
> > -                   struct cpuid_leaf *leaf)
> > +snp_cpuid_postprocess(void (*cpuid_hv)(void *ctx, struct cpuid_leaf *),
>
> Let's call that just "cpuid" now that it can be different things and it is
> a pointer.
>
> > +                   void *ctx, struct cpuid_leaf *leaf)
> >  {
> >       struct cpuid_leaf leaf_hv = *leaf;
> >
> >       switch (leaf->fn) {
> >       case 0x1:
> > -             snp_cpuid_hv(ghcb, ctxt, &leaf_hv);
> > +             cpuid_hv(ctx, &leaf_hv);
> >
> >               /* initial APIC ID */
> >               leaf->ebx = (leaf_hv.ebx & GENMASK(31, 24)) | (leaf->ebx & GENMASK(23, 0));
> > @@ -517,7 +480,7 @@ snp_cpuid_postprocess(struct ghcb *ghcb, struct es_em_ctxt *ctxt,
> >               break;
> >       case 0xB:
> >               leaf_hv.subfn = 0;
> > -             snp_cpuid_hv(ghcb, ctxt, &leaf_hv);
> > +             cpuid_hv(ctx, &leaf_hv);
> >
> >               /* extended APIC ID */
> >               leaf->edx = leaf_hv.edx;
> > @@ -565,7 +528,7 @@ snp_cpuid_postprocess(struct ghcb *ghcb, struct es_em_ctxt *ctxt,
> >               }
> >               break;
> >       case 0x8000001E:
> > -             snp_cpuid_hv(ghcb, ctxt, &leaf_hv);
> > +             cpuid_hv(ctx, &leaf_hv);
> >
> >               /* extended APIC ID */
> >               leaf->eax = leaf_hv.eax;
> > @@ -587,7 +550,8 @@ snp_cpuid_postprocess(struct ghcb *ghcb, struct es_em_ctxt *ctxt,
> >   * should be treated as fatal by caller.
> >   */
> >  int __head
>
> And that ugly linebreak too pls.
>
> ...
>
> Here's a diff ontop with my changes. I think it looks a lot saner now and one
> can really differentiate which is which.
>

Thanks, I'll fold that in.