From: Joerg Roedel <joro@8bytes.org>
To: Borislav Petkov <bp@alien8.de>
Cc: kvm@vger.kernel.org, Peter Zijlstra <peterz@infradead.org>,
Dave Hansen <dave.hansen@linux.intel.com>,
virtualization@lists.linux-foundation.org,
Arvind Sankar <nivedita@alum.mit.edu>,
hpa@zytor.com, Jiri Slaby <jslaby@suse.cz>,
x86@kernel.org, David Rientjes <rientjes@google.com>,
Martin Radev <martin.b.radev@gmail.com>,
Tom Lendacky <thomas.lendacky@amd.com>,
Joerg Roedel <jroedel@suse.de>, Kees Cook <keescook@chromium.org>,
Cfir Cohen <cfir@google.com>, Andy Lutomirski <luto@kernel.org>,
Dan Williams <dan.j.williams@intel.com>,
Juergen Gross <jgross@suse.com>, Mike Stunes <mstunes@vmware.com>,
linux-kernel@vger.kernel.org,
Sean Christopherson <sean.j.christopherson@intel.com>,
Masami Hiramatsu <mhiramat@kernel.org>,
Erdem Aktas <erdemaktas@google.com>
Subject: Re: [PATCH 6/7] x86/boot/compressed/64: Check SEV encryption in 32-bit boot-path
Date: Tue, 9 Mar 2021 11:02:36 +0100 [thread overview]
Message-ID: <YEdHvAWaWv8YDiUB@8bytes.org> (raw)
In-Reply-To: <20210302194353.GH15469@zn.tnic>
On Tue, Mar 02, 2021 at 08:43:53PM +0100, Borislav Petkov wrote:
> On Wed, Feb 10, 2021 at 11:21:34AM +0100, Joerg Roedel wrote:
> > + /*
> > + * Store the sme_me_mask as an indicator that SEV is active. It will be
> > + * set again in startup_64().
>
> So why bother? Or does something needs it before that?
This was actually a bug. The startup32_check_sev_cbit() needs something
to skip the check when SEV is not active. Therefore the value is set
here in sme_me_mask, but the function later checks sev_status.
I fixed it by setting sev_status to 1 here (indicates SEV is active).
Regards,
Joerg
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
WARNING: multiple messages have this Message-ID (diff)
From: Joerg Roedel <joro@8bytes.org>
To: Borislav Petkov <bp@alien8.de>
Cc: x86@kernel.org, Joerg Roedel <jroedel@suse.de>,
hpa@zytor.com, Andy Lutomirski <luto@kernel.org>,
Dave Hansen <dave.hansen@linux.intel.com>,
Peter Zijlstra <peterz@infradead.org>,
Jiri Slaby <jslaby@suse.cz>,
Dan Williams <dan.j.williams@intel.com>,
Tom Lendacky <thomas.lendacky@amd.com>,
Juergen Gross <jgross@suse.com>,
Kees Cook <keescook@chromium.org>,
David Rientjes <rientjes@google.com>,
Cfir Cohen <cfir@google.com>, Erdem Aktas <erdemaktas@google.com>,
Masami Hiramatsu <mhiramat@kernel.org>,
Mike Stunes <mstunes@vmware.com>,
Sean Christopherson <sean.j.christopherson@intel.com>,
Martin Radev <martin.b.radev@gmail.com>,
Arvind Sankar <nivedita@alum.mit.edu>,
linux-kernel@vger.kernel.org, kvm@vger.kernel.org,
virtualization@lists.linux-foundation.org
Subject: Re: [PATCH 6/7] x86/boot/compressed/64: Check SEV encryption in 32-bit boot-path
Date: Tue, 9 Mar 2021 11:02:36 +0100 [thread overview]
Message-ID: <YEdHvAWaWv8YDiUB@8bytes.org> (raw)
In-Reply-To: <20210302194353.GH15469@zn.tnic>
On Tue, Mar 02, 2021 at 08:43:53PM +0100, Borislav Petkov wrote:
> On Wed, Feb 10, 2021 at 11:21:34AM +0100, Joerg Roedel wrote:
> > + /*
> > + * Store the sme_me_mask as an indicator that SEV is active. It will be
> > + * set again in startup_64().
>
> So why bother? Or does something needs it before that?
This was actually a bug. The startup32_check_sev_cbit() needs something
to skip the check when SEV is not active. Therefore the value is set
here in sme_me_mask, but the function later checks sev_status.
I fixed it by setting sev_status to 1 here (indicates SEV is active).
Regards,
Joerg
next prev parent reply other threads:[~2021-03-09 10:02 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-10 10:21 [PATCH 0/7] x86/seves: Support 32-bit boot path and other updates Joerg Roedel
2021-02-10 10:21 ` Joerg Roedel
2021-02-10 10:21 ` [PATCH 1/7] x86/boot/compressed/64: Cleanup exception handling before booting kernel Joerg Roedel
2021-02-10 10:21 ` Joerg Roedel
2021-02-10 10:21 ` [PATCH 2/7] x86/boot/compressed/64: Reload CS in startup_32 Joerg Roedel
2021-02-10 10:21 ` Joerg Roedel
2021-02-10 10:21 ` [PATCH 3/7] x86/boot/compressed/64: Setup IDT in startup_32 boot path Joerg Roedel
2021-02-10 10:21 ` Joerg Roedel
2021-02-24 10:49 ` Borislav Petkov
2021-02-24 10:49 ` Borislav Petkov
2021-02-10 10:21 ` [PATCH 4/7] x86/boot/compressed/64: Add 32-bit boot #VC handler Joerg Roedel
2021-02-10 10:21 ` Joerg Roedel
2021-02-25 12:13 ` Borislav Petkov
2021-02-25 12:13 ` Borislav Petkov
2021-02-10 10:21 ` [PATCH 5/7] x86/boot/compressed/64: Add CPUID sanity check to 32-bit boot-path Joerg Roedel
2021-02-10 10:21 ` Joerg Roedel
2021-02-10 10:21 ` [PATCH 6/7] x86/boot/compressed/64: Check SEV encryption in " Joerg Roedel
2021-02-10 10:21 ` Joerg Roedel
2021-02-10 16:25 ` Dave Hansen
2021-02-10 16:25 ` Dave Hansen
2021-02-10 16:46 ` Joerg Roedel
2021-02-10 16:46 ` Joerg Roedel
2021-02-10 16:47 ` Dave Hansen
2021-02-10 16:47 ` Dave Hansen
2021-02-10 20:44 ` Tom Lendacky
2021-02-10 20:44 ` Tom Lendacky
2021-03-02 19:43 ` Borislav Petkov
2021-03-02 19:43 ` Borislav Petkov
2021-03-09 10:02 ` Joerg Roedel [this message]
2021-03-09 10:02 ` Joerg Roedel
2021-02-10 10:21 ` [PATCH 7/7] x86/sev-es: Replace open-coded hlt-loops with sev_es_terminate() Joerg Roedel
2021-02-10 10:21 ` Joerg Roedel
2021-02-10 14:58 ` [PATCH 0/7] x86/seves: Support 32-bit boot path and other updates Konrad Rzeszutek Wilk
2021-02-10 14:58 ` Konrad Rzeszutek Wilk
2021-02-10 15:12 ` Joerg Roedel
2021-02-10 15:12 ` Joerg Roedel
2021-02-10 15:19 ` Konrad Rzeszutek Wilk
2021-02-10 15:19 ` Konrad Rzeszutek Wilk
2021-02-10 15:27 ` Joerg Roedel
2021-02-10 15:27 ` Joerg Roedel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YEdHvAWaWv8YDiUB@8bytes.org \
--to=joro@8bytes.org \
--cc=bp@alien8.de \
--cc=cfir@google.com \
--cc=dan.j.williams@intel.com \
--cc=dave.hansen@linux.intel.com \
--cc=erdemaktas@google.com \
--cc=hpa@zytor.com \
--cc=jgross@suse.com \
--cc=jroedel@suse.de \
--cc=jslaby@suse.cz \
--cc=keescook@chromium.org \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=martin.b.radev@gmail.com \
--cc=mhiramat@kernel.org \
--cc=mstunes@vmware.com \
--cc=nivedita@alum.mit.edu \
--cc=peterz@infradead.org \
--cc=rientjes@google.com \
--cc=sean.j.christopherson@intel.com \
--cc=thomas.lendacky@amd.com \
--cc=virtualization@lists.linux-foundation.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.