Re: [PATCH v3 3/5] x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path

2020-10-28 Thread Joerg Roedel
On Tue, Oct 27, 2020 at 12:08:12PM +0100, Borislav Petkov wrote: > On Wed, Oct 21, 2020 at 02:39:36PM +0200, Joerg Roedel wrote: > > diff --git a/arch/x86/kernel/sev_verify_cbit.S > > b/arch/x86/kernel/sev_verify_cbit.S > > new file mode 100644 > > index ..5075458ecad0 > > ---

Re: [PATCH v3 3/5] x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path

2020-10-27 Thread Borislav Petkov
On Wed, Oct 21, 2020 at 02:39:36PM +0200, Joerg Roedel wrote: > diff --git a/arch/x86/kernel/sev_verify_cbit.S > b/arch/x86/kernel/sev_verify_cbit.S > new file mode 100644 > index ..5075458ecad0 > --- /dev/null > +++ b/arch/x86/kernel/sev_verify_cbit.S Why a separate file? You're

Re: [PATCH v3 3/5] x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path

2020-10-27 Thread Borislav Petkov
On Wed, Oct 21, 2020 at 02:39:36PM +0200, Joerg Roedel wrote: > From: Joerg Roedel > > Check whether the hypervisor reported the correct C-bit when running as > an SEV guest. Using a wrong C-bit position could be used to leak > sensitive data from the guest to the hypervisor. > > The check

[PATCH v3 3/5] x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path

2020-10-21 Thread Joerg Roedel
From: Joerg Roedel Check whether the hypervisor reported the correct C-bit when running as an SEV guest. Using a wrong C-bit position could be used to leak sensitive data from the guest to the hypervisor. The check function is in arch/x86/kernel/sev_verify_cbit.S so that it can be re-used in