x86/sev-es: Mitigate some HV attack vectors

Joerg Roedel lkml 4 versions Oct 19, 2020 – Oct 29, 2020 Applied

Status from this message: The following commit has been merged into the x86/seves branch of tip:

Get series with b4

b4 am [email protected]

Versions newest first · linked by author and title

v4 Latest Oct 29, 20205 patches 5 repliesApplied
v3 Oct 21, 20205 patches 11 repliesSuperseded
v2 Oct 20, 20205 patches 4 repliesSuperseded

Earlier versions · 1

Version	Posted	Patches	Replies	Status
v1	Oct 19, 2020	5 patches	13 replies	Superseded

Changes to v3 from the cover letter

- Addressed Boris' review comments

Patches in v4 Applied

#	Subject and files	Size	Replies
1/5	x86/boot/compressed/64: Introduce sev_status`arch/x86/boot/compressed/mem_encrypt.S`	+15 -1	1 reply
2/5	x86/boot/compressed/64: Add CPUID sanity check to early #VC handler`arch/x86/kernel/sev-es-shared.c`	+26 -0	1 reply
3/5	x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path`arch/x86/boot/compressed/ident_map_64.c` `arch/x86/boot/compressed/mem_encrypt.S` `arch/x86/boot/compressed/misc.h` +1 more	+97 -0	1 reply
4/5	x86/head/64: Check SEV encryption before switching to kernel page-table`arch/x86/kernel/head_64.S` `arch/x86/mm/mem_encrypt.c`	+17 -0	1 reply
5/5	x86/sev-es: Do not support MMIO to/from encrypted memory`arch/x86/kernel/sev-es.c`	+13 -7	1 reply

Reviews trailers per patch

All 5 patches have a Reviewed-by or Acked-by.

Patch	Tom Lendacky
1/5	R-b
2/5	R-b
3/5	R-b
4/5	R-b
5/5	R-b

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.

Read the v4 thread

Cover letter [PATCH v4 0/5] x86/sev-es: Mitigate some HV attack vectors

From: Joerg Roedel <[email protected]>

Hi,

here are some enhancements to the SEV(-ES) code in the Linux kernel to self-protect it against some newly detected hypervisor attacks. There are 3 attacks addressed here:

1) Hypervisor does not present the SEV-enabled bit via CPUID

2) The Hypervisor presents the wrong C-bit position via CPUID

3) An encrypted RAM page is mapped as MMIO in the nested page-table, causing #VC exceptions and possible leak of the data to the hypervisor or data/code injection from the Hypervisor.

The attacks are described in more detail in this paper:

	https://arxiv.org/abs/2010.07094

Please review.

Thanks,

Joerg

Changes to v3:

- Addressed Boris' review comments

Changes to v2:

- Use %r8/%r9 to modify %cr4 in sev_verify_cbit() and return the new page-table pointer in that function.

Changes to v1:

- Disable CR4.PGE during C-bit test

- Do not safe/restore caller-safed registers in set_sev_encryption_mask()

Joerg Roedel (5):
x86/boot/compressed/64: Introduce sev_status x86/boot/compressed/64: Add CPUID sanity check to early #VC handler x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path x86/head/64: Check SEV encryption before switching to kernel
page-table
x86/sev-es: Do not support MMIO to/from encrypted memory

 arch/x86/boot/compressed/ident_map_64.c |  1 +
 arch/x86/boot/compressed/mem_encrypt.S  | 20 +++++-
 arch/x86/boot/compressed/misc.h         |  2 +
 arch/x86/kernel/head_64.S               | 16 +++++
 arch/x86/kernel/sev-es-shared.c         | 26 +++++++
 arch/x86/kernel/sev-es.c                | 20 ++++--
 arch/x86/kernel/sev_verify_cbit.S       | 90 +++++++++++++++++++++++++
 arch/x86/mm/mem_encrypt.c               |  1 +
 8 files changed, 168 insertions(+), 8 deletions(-)
 create mode 100644 arch/x86/kernel/sev_verify_cbit.S

Signature · 1 line

2.28.0

Read the cover letter in its thread