Re: [PATCH v6 08/42] x86/sev-es: initialize sev_status/features within #VC handler

Borislav Petkov
2021-10-21T18:46:47Z

On Thu, Oct 21, 2021 at 06:47:50PM +0100, Dr. David Alan Gilbert wrote:
> Hang on, I think it's perfectly fine for it to clear that bit - it just
> gets caught if it *sets* it (i.e. claims to be a chip unaffected by the
> bug).
>
> i.e. if guestval=0 then (GustVal & whatever) == GuestVal
> fine
>
> ?

Bah, ofc. The name of the bit is NullSelectorClearsBase - so when it is
clear, we will note we're affected, as that patch does:

+ /*
+ * CPUID bit above wasn't set. If this kernel is still running
+ * as a HV guest, then the HV has decided not to advertize
+ * that CPUID bit for whatever reason. For example, one
+ * member of the migration pool might be vulnerable. Which
+ * means, the bug is present: set the BUG flag and return.
+ */
+ if (cpu_has(c, X86_FEATURE_HYPERVISOR)) {
+ set_cpu_bug(c, X86_BUG_NULL_SEG);
+ return;
+ }

I have managed to flip the meaning in my mind.

Ok, that makes more sense.

Thx.

--
Regards/Gruss,
Boris.